DFSG NEW review for libmio version 1.1.0~git20230303.8b6b7d8-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is a small, single-origin C++ library: everything except the BSD-3 amalgamation helper is mandreyel's MIT code, and third_party/amalgamate.py with its LICENSE.md is Erik Edlund's BSD-3-clause. Both licences are DFSG-free and mutually compatible, and debian/copyright is DEP-5 with the correct Format line, full text for both licences, no reliance on absent common-licenses files, and both holders named. The single-header single_include/mio/mio.hpp is generated, but its generator (third_party/amalgamate.py), its config and all its input headers are in the tree, so it is not a sourceless artefact. No non-free terms, no binaries, no files without a licence.

Packaging

Clean single-binary Debian Med packaging: compat 14 with dh $@ --buildsystem=cmake, one Architecture: all header-only -dev package with Multi-Arch: foreign, no patches, current Standards-Version, sane changelog, Vcs-* and Homepage, and an autopkgtest that compiles and runs the upstream test and example against the installed headers. override_dh_auto_test additionally builds test/example.cpp from the source tree; at compat 14 dh skips that target under nocheck, so it needs no guard. Nothing in debian/ is missing, obsolete or in the wrong place.

Issues

None.

Verified

• debian/copyright is DEP-5 with the canonical Format: line and three stanzas: Files: * MIT (2018 mandreyel), Files: third_party/* BSD-3-clause (2012 Erik Edlund), Files: debian/* MIT (2026 Andreas Tille). Later stanzas correctly override the catch-all, and the third_party/* pattern's reach into subdirectories is fine (no subdirectories exist).
• Prescan (dfsg-author-check) reported every holder in the tree named; independently, the only holders in file notices are mandreyel (LICENSE, all of include/mio/, all six notice blocks in single_include/mio/mio.hpp) and Erik Edlund (third_party/amalgamate.py, third_party/LICENSE.md). Every upstream file outside third_party/ is therefore covered by Files: *; the 2017 headers against the stanza's 2018 is year drift only.
• single_include/mio/mio.hpp (1763 lines) is an amalgamation, not an opaque artefact: its inputs include/mio/mmap.hpp, include/mio/page.hpp, include/mio/shared_mmap.hpp, include/mio/detail/mmap.ipp and the generator third_party/amalgamate.py with third_party/config.json are all in the tree, and it carries only mandreyel MIT notices. CMakeLists.txt installs include/ only, so it is not shipped in the binary.
• Both licences are free and compatible (MIT, BSD-3-clause; the BSD-3 no-endorsement clause is not a field-of-use restriction), and both full texts are in the stand-alone License: paragraphs, so nothing needs /usr/share/common-licenses. No non-free wording (non-commercial, no-modification, field-of-use, "good, not evil") matches anywhere in the tree.
• The tree (32 files, .pc/ excluded) contains no compiled binaries, archives, bytecode, minified code, fonts or images. third_party/amalgamate.py is a build helper, is not run by debian/rules, and the test/ and .travis.yml files are upstream test and CI sources.
• Build-Depends is debhelper-compat (= 14), dh-sequence-single-binary, cmake; dh-sequence-single-binary is a real dh add-on provided by debhelper 14.5 (apt-cache), valid for this one-binary source, and cmake plus implicit build-essential are all the build needs.
• At compat 14, dh_gencontrol adds relationship substvars itself, so Depends: ${misc:Depends} alone is correct for a header-only package, and dh skips override_dh_auto_test under nocheck (debhelper tool, compat-13 change), so the override needs no nocheck guard of its own.
• Architecture: all with Multi-Arch: foreign is the established shape for a header-only -dev package (libeigen3-dev is all/foreign); Section: libdevel, the ${CXX} use in override_dh_auto_test (make's built-in default is g++), and the in-source test-example/ directory that is removed afterwards are all sound.
• debian/tests/run-unit-test copies /usr/share/doc/libmio-dev/examples/* (installed by debian/libmio-dev.examples = test/*.cpp) and compiles test.cpp and example.cpp against the installed /usr/include/mio; Depends: @, build-essential and Restrictions: allow-stderr cover it.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (same first two components, so current); debian/source/format 3.0 (quilt) with no debian/patches, so nothing to review for DEP-3 headers; changelog 1.1.0~git20230303.8b6b7d8-1, unstable, dated Tue 27 Oct 2026, with an ITP closure; Vcs-Git, Vcs-Browser and Homepage present and consistent with debian/copyright's Source.
• uscan found the packaged version as the newest upstream release (upstream 1.1.0~git20230303.8b6b7d8, packaged 1.1.0~git20230303.8b6b7d8).

Not confirmed

• Whether Files: third_party/* should attribute third_party/config.json to Erik Edlund under BSD-3-clause: the file holds mio's own amalgamation settings (mio's description, target ../single_include/mio/mio.hpp, sources under ../include/mio), while the BSD-3 material of that directory is amalgamate.py and LICENSE.md. Whether the JSON derives from the amalgamate project's own sample config cannot be determined from the package; if it does not, the file is upstream's MIT material and the stanza over-attributes it.
• Whether find_package(mio) fails for 32-bit consumers of this Architecture: all, Multi-Arch: foreign package: CMakeLists.txt calls write_basic_package_version_file() without ARCH_INDEPENDENT, and the reviewing system's WriteBasicConfigVersionFile.cmake then emits a CMAKE_SIZEOF_VOID_P check that sets PACKAGE_VERSION_UNSUITABLE (i386/armhf consumer against the amd64-built version file). This is upstream's code shipped as-is; a 32-bit find_package(mio 1.1.0) would show it.

Proposed changes

None.