DFSG NEW review for liblivemedia version 2026.10.24-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 6 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The licensing is DFSG-compliant and debian/copyright (DEP-5, correct Format line) describes the tree accurately. Every upstream file carries the LIVE555 LGPL-3+ notice; the four RTCP/RFC-3550-derived files (liveMedia/rtcp_from_spec.c/.h, liveMedia/include/RTCP.hh, liveMedia/include/OnDemandServerMediaSubsession.hh) are correctly given their own stanza as 'BSD-3-clause or LGPL-3+' after the 2021 relicensing discussed in #981439. The full LGPL-3+, LGPL-2.1+ and BSD-3-clause texts (or the /usr/share/common-licenses pointers) are present. No non-free terms, no built/binary artifacts lacking source, no unlicensed file: the pre-review scan's holder check reports every holder found named, and my own greps for licence wording found nothing beyond LGPL-3+ and the BSD-3 statement.

Packaging

The packaging is in good shape: compat 14 with a minimal dh rules overriding only configure (genMakefiles) and install (PREFIX/LIBDIR), correct Multi-Arch: same splits with matching sonames (122/33/2/3), an autopkgtest that compiles an example against the shipped pkg-config file, current Standards-Version (4.7.4 against Policy 4.7.4.1), and a 3.0 (quilt) source with 5 applied patches. The findings below are small: a stale package description, two patches without DEP-3 headers, one dead patch left in debian/patches, a missing Rules-Requires-Root, and 37 utilities shipped without manual pages whose lintian tags are all suppressed.

Issues

1. [minor] [packaging] livemedia-utils ships 37 binaries with no manual pages, all suppressed in debian/livemedia-utils.lintian-overrides

• Files: debian/livemedia-utils.lintian-overrides, debian/livemedia-utils.install
• Basis: checked, in the package or with a reference tool
• Evidence: overrides file: livemedia-utils: no-manual-page [usr/bin/openRTSP] ... (37 lines, one per binary); no debian/*.1 or debian/*.manpages anywhere in debian/; Policy 12.1: "Each program, utility, and function should have an associated manual page... If no manual page is available, this is considered as a bug"
• Problem: debian/livemedia-utils.install installs all of usr/bin, i.e. the servers and every test tool, and none has a manual page; the lintian tags that report it are suppressed wholesale instead of the pages being provided. The changelog records that manpages for these binaries were once shipped (2016.11.28-1, "debian/*.1: Add initial manpages for binaries"), so this is a regression in user-visible documentation.
• Fix: Ship manual pages for the installed binaries (or at least for the user-facing ones: live555MediaServer, live555ProxyServer, openRTSP, playSIP, sapWatch, vobStreamer) and drop the corresponding overrides; keeping them only for the test binaries is defensible.

2. [minor] [packaging] debian/patches/01_propagate_cflags.patch and 02_fix-link-more-lib.patch carry no DEP-3 header

• Files: debian/patches/01_propagate_cflags.patch, debian/patches/02_fix-link-more-lib.patch
• Basis: checked, in the package or with a reference tool
• Evidence: both files begin directly with --- a/Makefile.tail; no From:, Date:, Subject: or Description: lines, unlike 0001/0002/0003 which have From/Date/Subject
• Problem: DEP-3 requires at least a Description (and recommends Origin/Author/Forwarded); a reviewer cannot tell from the patch itself why the CFLAGS propagation or the extra library link order is needed, nor whether it was sent upstream.
• Fix: Add DEP-3 headers naming the author and describing the change (and Forwarded/Last-Update where known), as the numbered patches already do.

3. [minor] [packaging] debian/patches/0005-Build-without-OpenSSL.patch is dead: present in debian/patches but commented out in series

• Files: debian/patches/series:7, debian/patches/0005-Build-without-OpenSSL.patch
• Basis: checked, in the package or with a reference tool
• Evidence: series line #0005-Build-without-OpenSSL.patch; the patch's own hunk removes -DNO_OPENSSL=1 / sets LIBS_FOR_LIVEMEDIA_LIB =, while debian/control now has an unconditional Build-Depends: libssl-dev and config.linux-with-shared-libraries keeps LIBS_FOR_LIVEMEDIA_LIB = -lssl -lcrypto
• Problem: The patch cannot be applied to the current tree and is not applied; a disabled patch file that contradicts the packaging (OpenSSL is now a hard build dependency) is dead weight that misleads the next maintainer.
• Fix: Delete the file (and its series line), or, if building without OpenSSL is intended again, restore it in series, remove the libssl-dev Build-Depends and keep the ssl uses out of the build.

4. [minor] [packaging] liblivemedia-dev description advertises static libraries that are not built or shipped

• Files: debian/control, debian/liblivemedia-dev.install
• Basis: checked, in the package or with a reference tool
• Evidence: control: "This package contains the headers and static libraries required to build applications that use live555.com."; debian/liblivemedia-dev.install installs only usr/include, usr/lib/*/*.so and usr/lib/*/pkgconfig; rules uses the linux-with-shared-libraries config, whose LIBRARY_LINK = $(CXX) -o builds shared libraries only
• Problem: No .a files are built or installed, so the description is factually wrong about the package contents.
• Fix: Drop "and static libraries" ("headers and shared libraries").

5. [minor] [packaging] Rules-Requires-Root: no was dropped from debian/control though nothing in the package needs root

• Files: debian/control:1-12, debian/changelog
• Basis: checked, in the package or with a reference tool
• Evidence: control has no Rules-Requires-Root field; changelog 2018.08.05-1: "debian/control: - Bump Standards-Version. - Set Rules-Requires-Root: no."
• Problem: The rules do nothing that needs root (dh plus make install DESTDIR=..., no chown/setuid/mknod), so the field's removal only costs an unnecessary fakeroot for every build and loses reproducibility that the package previously had.
• Fix: Add Rules-Requires-Root: no to the source stanza.

6. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• The pre-review scan listed no file to account for: its holder check reports "every holder found is named in debian/copyright" over 517 files, and it flagged no built file, no non-free wording and no unacceptable licence.
• debian/copyright is DEP-5 with the exact 1.0 Format URL; stanzas: Files: * (LGPL-3+), the four RTCP/RFC-3550 files (BSD-3-clause or LGPL-3+, with the #981439 comment), debian/* (LGPL-2.1+); stand-alone License paragraphs give the LGPL-3+, LGPL-2.1+ notice text and point to /usr/share/common-licenses/LGPL-3 and LGPL-2.1, and the full BSD-3-clause text.
• I grepped the tree (excluding .pc/) for Copyright/(C)/(c)/SPDX/Licensed under/Permission is hereby granted/GNU General Public/GNU Lesser/Apache/Mozilla/public domain/commercial/Good, not Evil and for holder-like names: the only upstream notices are the LIVE555 LGPL-3+ header and the Live Networks copyright lines; no third-party holder or licence appears.
• Upstream file inventory covered directory by directory (groupsock, UsageEnvironment, BasicUsageEnvironment, liveMedia + include, testProgs, mediaServer, proxyServer, hlsProxy, WindowsAudioInputDevice, top level); all of it is plain C/C++ source, Makefile fragments, config.* files and build scripts, all under Files: *.
• The two odd upstream files, liveMedia/#RTPInterface.cpp# (an editor autosave of the already-present RTPInterface.cpp) and liveMedia/grep (empty), are in the pristine orig tarball (confirmed in liblivemedia_2026.10.24.orig.tar.gz:live/liveMedia/), are named by no Makefile and are not installed by any debian/*.install; they fall under Files: * LGPL-3+ and are not a licensing or DFSG problem.
• The subdirectory COPYING/COPYING.LESSER and the top-level README are upstream's own copies of GPL-3/LGPL-3 and the build pointer; nothing to report.
• The version no longer carries the -dfsg suffix and debian/copyright has no Files-Excluded; I confirmed the orig tarball contains no .html at all (the openRTSP.html dropped in 2026.09.23-dfsg-3 is simply gone upstream), so no repacking is needed and no whiteroom entry survives anywhere in the tree.
• Patches all apply to the shipped tree (the hunk contexts match the patched Makefile.tail/config files in series order 01, 02, 0001, 0002, 0003); 0001 keeps the hud guard and 0003 the $(CC)/$(CXX) change.
• No debian/clean is needed: debian/rules' configure step generates Makefiles with genMakefiles, and debhelper's makefile buildsystem runs distclean in preference to clean (read in /usr/share/perl5/Debian/Debhelper/Buildsystem/makefile.pm), which removes them, so the changelog's "Drop clean hack, useless now" is correct.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool) - same first two components, not an issue; compat is 14, so no ${shlibs:Depends}/${misc:Depends} is needed in the packages' Depends and their absence is correct.
• debian/tests/control uses @ and @builddeps@ as the autopkgtest specification documents (checked in the autopkgtest document), and the test compiles testRelay.cpp with the shipped live555.pc; dh_installexamples copies each listed file with cp -a into .../examples/, so testProgs/*.cpp land flat as /usr/share/doc/liblivemedia-dev/examples/testRelay.cpp and the test's cd examples; g++ testRelay.cpp finds it.
• Build-Depends libssl-dev is genuinely used: config.linux-with-shared-libraries sets LIBS_FOR_LIVEMEDIA_LIB = -lssl -lcrypto and liveMedia/TLSState.cpp and SRTPCryptographicContext.cpp use OpenSSL; debhelper sets CXXFLAGS/LDFLAGS (with the DEB_CXXFLAGS_MAINT_APPEND/DEB_LDFLAGS_MAINT_APPEND values) in the environment via Dh_Lib::set_buildflags, so the flags do reach the make build.
• Sonames in config.linux-with-shared-libraries (libliveMedia 122, libgroupsock 33, libBasicUsageEnvironment 3-1=2, libUsageEnvironment 5-2=3) match the binary package names and the debian/*.install globs, and the dev package depends on all four with = ${binary:Version}.
• The installed headers branch on NO_STD_LIB (UsageEnvironment.hh's EventLoopWatchVariable typedef, BasicUsageEnvironment0.hh's fTriggersAwaitingHandling array), which Debian defines via DEB_CXXFLAGS_MAINT_APPEND while pkg-config consumers compile without it; both branches are one byte (unsigned char Boolean / std::atomic_flag), so I found no ABI difference and do not report it.
• uscan found the packaged version as the newest upstream release (upstream 2026.10.24, packaged 2026.10.24).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (LGPL-2.1, LGPL-3).

Not confirmed

• A build would show whether the NO_STD_LIB mismatch between the libraries and consumers of the installed headers has any effect at all; from the header text both variants have identical size and alignment, so I expect none.
• I could not read file modes from the tools available, so I could not confirm that debian/tests/buildtest is executable; autopkgtest requires the test file to be executable, and a non-executable one would fail the test at run time.