Hi,

Accepted, but with quite a few caveats that I think would be good to resolve for your next upload...

Licensing findings

Real problem — large set of GPL-2+ files mislabelled AGPL-3+. Files: * (lines 5–14) assigns AGPL-3+ to everything not covered by the narrower stanzas. The GPL-2+ stanza (lines 15–23) lists only src/input/lapd.c, src/trau/osmo_ortp.c, src/input/dahdi.c. Many more files carry explicit GPL-2 licence headers (SPDX-License-Identifier: GPL-2.0+ or the traditional "either version 2… or any later version" text) and therefore wrongly fall under AGPL-3+:

• src/input/e1d.c, src/input/ipa_keepalive.c, src/input/unixsocket.c (SPDX GPL-2.0+)
• src/trau/trau_pcu_ericsson.c, src/trau/trau_rtp_conv.c, src/trau/trau_sync.c, include/osmocom/trau/trau_rtp.h (SPDX GPL-2.0+)
• src/trau/csd_ra2.c, csd_v110.c, raa_prime_decode.c, raa_prime_encode.c, tfo_frame.c, twts007.c and headers include/osmocom/trau/{clearmode,csd_ra2,csd_raa_prime,csd_v110,tfo_frame,trau_frame,twts007}.h (traditional GPL v2+ header, no SPDX)
• every test .c under tests/* (all GPL v2+ headers)

The libraries libosmoabis/libosmotrau are built from an AGPL-3+/GPL-2+ mix; both are free so there is no distribution problem, but the per-file description is materially wrong. Fix: narrow the Files: * stanza (or add a Files stanza listing the above) with License: GPL-2+, keeping the copyright holders that apply. This is the only real licence-accuracy defect.

Missing public-domain stanza. src/trau/amr_misc.c, amr_rtp.c, amr_trau.c and include/osmocom/trau/amr_trau.h state: "This code was contributed to Osmocom Cellular Network Infrastructure project by Mother Mychaela N. Falconia… NOT subject to copyright: no rights reserved, all rights relinquished." They are public domain (a separate License paragraph is warranted), not AGPL-3+ as currently described.

Missing GPL-3+ / FSF for git-version-gen. The file carries "Copyright (C) 2007-2010 Free Software Foundation, Inc." under GPL v3 or later — a different licence short name and a holder absent from the Files: * stanza.

Wrong Upstream-Name. Line 2 says Upstream-Name: libosmocore. This is libosmo-abis (a different project); the Source: field on line 3 is correct. Copy-paste error from the sibling package.

AGPL-3+ full text not reproduced in the paragraph. AGPL-3 is not in /usr/share/common-licenses, yet the License: AGPL-3+ paragraph (lines 36–50) contains only the short warranty notice. The full AGPLv3 text does ship in the source (COPYING, 661 lines), which satisfies the practical requirement, but DEP-5 accuracy would be improved by pasting the full text into the paragraph. Minor.

No licence header at all on include/osmocom/abis/.h, include/internal.h, src/trau/ubit_buf.h, tests/e1inp_ipa_{bsc,bts}_test.c, tests/rtp_test/rtp_test.c, doc/examples/, contrib/jenkins.sh, contrib/trau2rtp/*, the Makefile.am/.pc.in files. These most plausibly fall under the upstream default (COPYING = AGPL-3), and the Files: * stanza covers them; I could not confirm per-file intent. Low risk, not a blocker. The raw captures contrib/trau2rtp/e1_ts2_{efr,fr}.bin/.log.bz2 and the .hex/.in/.ok test data are data, not compiled objects — no preferred-form concern.

Verified consistent: include/mISDNif.h = LGPL-2.1 / Karsten Keil (matches stanza, lines 25–27); dahdi.c, lapd.c, osmo_ortp.c GPL-2+ (matches stanza); no Files-Excluded and no +dfsg, which is consistent (no repack needed). No BSD/MIT/ISC, no JSON licence, no non-free clause anywhere in the tree.

Packaging findings

Build fails (or understates the requirement) — Build-Depends on libosmocore is stale. debian/control has libosmocore-dev (>= 1.9.0), but the (patched, current) configure.ac lines 69–72 require libosmocore, libosmovty, libosmogsm, libosmocodec all >= 1.14.2 (all provided by the libosmocore-dev binary). With only 1.9.x present the PKG_CHECK_MODULES would abort configure. Compare: the 2.2.0-1 changelog correctly bumped libosmo-netif >= 1.8.0 to match configure.ac line 74, so the libosmocore version is a genuine oversight. Fix: libosmocore-dev (>= 1.14.2). (Also verify that version is actually available in the target suite; if not, this package cannot build there.)

Likely broken upgrade path — intermediate SONAMEs not covered. libosmoabis17 only has Breaks/Replaces: libosmoabis10t64, libosmotrau11 only libosmotrau2t64. Upstream bumped SONAME again between 1.6.0 (10t64) and 2.2.0 (17); 2.0.0-2 and 2.1.0-1 are in unstable. If those shipped with the intermediate SONAME (e.g. libosmoabis16t64/libosmotrau10t64), upgrading a machine running them will install the new libs alongside the old ones (no Breaks forces removal). [INFERENCE] — verify the 2.0.0/2.1.0 binary package names against the archive and add the missing Breaks/Replaces, or confirm the numbers actually shipped.

Dead Homepage. Homepage: http://openbsc.osmocom.org/trac/wiki/libosmo-abis — the openBSC trac is retired; README.md and debian/upstream/metadata give https://osmocom.org/projects/libosmo-abis. Update the field.

Stale/dead weight in debian/: debian/control.old is an unneeded leftover shipped in the source; debian/patches/tmp-dahdi-include.patch is not in series (commented out since 1.6.0-4) and embeds ~1400 lines of vendored DAHDI headers — delete it rather than keep it around.

No autopkgtests. debian/tests/ is absent; the upstream tests/ suite is run only in rules via the build. Adding a smoke debian/tests would be good practice but is not a blocker.

watch file (version 4): targets gerrit.osmocom.org tags and would match the current 2.2.0; the dversionmangle=s/+ds// is harmless while the version carries no +ds. It should be converted to the current version 5 format.

Minor: Setting-library-version-explicitly.patch lacks DEP-3 From:/Date: headers (the autotools patch has them — its hardcoded 2.2.0 in configure.ac also needs refreshing on each release, which the changelog does). The debian/* copyright stanza (lines 29–34) omits uploader Victor Seva, who contributed debian/salsa-ci.yml and control rewrites — add the holder.

Thanks!