DFSG NEW review for libpinchesandcacti version 0.0~git20240507.67138b5-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 2 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The bulk of the tree is MIT (Expat) and debian/copyright is a well-formed DEP-5 file whose Files: * and debian/* stanzas are accurate, but the package is not DFSG-free: externalTools/threeEdgeConnected/impl/3_Absorb3edge2x.c (and its header) carry a notice saying the MIT/BSD licence does not apply and that any further incorporation or copying must be permitted by request, and externalTools/LICENSE.txt says the code under it belongs to third-party contributors who reserve all rights and requires their permission for further distribution. The first file is compiled into the shipped libpinchesandcacti.a (debian/rules:8, called from impl/stCactusGraphs.c:232), so the restriction reaches a distributed binary and a distributed source. debian/copyright compounds this by declaring that whole directory MIT with a holder pair that contradicts the files' own headers.

Packaging

debian/ is small, correct and conventional: debhelper-compat 14 with dh $@, a static-only build with a manual override_dh_auto_build/install (upstream's Makefile needs sonLib checked out beside the tree), a real autopkgtest that compiles debian/tests/consumer.c against the installed headers and static archives, DEP-5 copyright, upstream metadata, salsa-ci, Vcs-*, Standards-Version 4.7.4 (current) and a sane initial-release changelog closing #1152146. No patches, no maintainer scripts. The only packaging-relevant concerns are the embedded non-free file above and the fact that the single Build-Depends/Depends, libsonlib-dev, is not in the archive lists I could see.

Issues

1. [blocker] [licensing] externalTools/threeEdgeConnected/impl/3_Absorb3edge2x.c (and .h) are non-free and are compiled into the shipped library

• Files: externalTools/threeEdgeConnected/impl/3_Absorb3edge2x.c:1-9, externalTools/threeEdgeConnected/inc/3_Absorb3edge2x.h:1-9, compiled per debian/rules:8, used from impl/stCactusGraphs.c:232
• Basis: checked, in the package or with a reference tool
• Evidence: The authors of this code have given their permission to distribute and redistribute this code within this software product, however they require that any further incorporation or copying be permitted by request only, hence the BSD/MIT license which applies to much of the other code in this software product does not apply to this file.
• Problem: Redistribution is permitted only as part of this software product, and any further incorporation or copying needs a request to the authors: this restricts modification and reuse and so fails DFSG 1 and 3, and Policy 2.2.1 requires every main package to comply with the DFSG. debian/rules:8 compiles this file into libpinchesandcacti.a, which the -dev package ships, and the file is also distributed in the source; impl/stCactusGraphs.c:232 calls computeThreeEdgeConnectedComponents, so the file cannot simply be dropped from the build. Removing it from the tarball without replacing it would break the library.
• Fix: Do not upload as is. Either obtain a clear free-software relicence from Yung H Tsin and Nima Norouzi (ideally upstream), or exclude the 3-edge-connected implementation and its callers from the source (Files-Excluded) and drop the corresponding functionality, which is not possible for stCactusGraphs as it stands; the file's restriction makes the whole package unfit for main while it is present.

2. [blocker] [licensing] debian/copyright declares externalTools/threeEdgeConnected/* MIT and externalTools/LICENSE.txt copyright Benedict Paten, contradicting the files' own terms

• Files: debian/copyright:11-13 (Files: externalTools/threeEdgeConnected/* / Copyright: 2011 Yung H Tsin and Nima Norouzi / License: MIT), debian/copyright:7-8 (Files: * / Copyright: 2009-2024 Benedict Paten), externalTools/LICENSE.txt:1-4, externalTools/threeEdgeConnected/init.py:3-5
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright says License: MIT for externalTools/threeEdgeConnected/*, while both 3_Absorb3edge2x.c and .h say the BSD/MIT license ... does not apply to this file; externalTools/LICENSE.txt says The code in this directory and its subdirectories belongs to third party contributors who reserve all rights over the code. Any further distribution of their code requires their permission unless otherwise stated., yet it falls under Files: * and is therefore attributed to Benedict Paten under MIT.
• Problem: The License: short name and the licence text provided do not describe the actual terms of the files the stanza covers (copyright-format 6.7), and the Files: * stanza claims MIT and a single holder for a file that states the opposite. The stanza also attributes threeEdgeConnected/Makefile, init.py and threeEdgeTests.py, whose own headers name Benedict Paten (MIT), to Tsin and Norouzi. Policy 2.3 requires debian/copyright to state the copyright and distribution licence accurately for the package, so the file as it stands is wrong on both counts.
• Fix: Once the licensing question above is settled, give 3_Absorb3edge2x.c/.h their own stanza with their real (non-free) terms, or remove them; keep externalTools/LICENSE.txt out of the Files: * MIT attribution and describe it explicitly; narrow the threeEdgeConnected stanza so that files whose headers name Benedict Paten are not attributed to Tsin and Norouzi, or split that directory's stanzas by file.

Verified

• Read the whole tree: 25 upstream files (LICENSE, README, Makefile, include.mk, .travis.yml, init.py, impl/stPinchGraphs.c, impl/stCactusGraphs.c, inc/stPinchGraphs.h, inc/stCactusGraphs.h, tests/.c, externalTools/) and all 12 files under debian/.
• No build products, binaries, archives, minified files, fonts or images anywhere in the tree; the only non-source files are debian/* text files.
• LICENSE is the Expat/MIT text, Copyright (c) 2024 Benedict Paten, and debian/copyright's stand-alone License: MIT paragraph reproduces it verbatim (no pointer to /usr/share/common-licenses needed).
• Per-file notices: //Copyright (C) 2009-2011 by Benedict Paten in init.py, externalTools/init.py, externalTools/threeEdgeConnected/init.py, threeEdgeTests.py, tests/.c and externalTools/threeEdgeConnected/tests/.c, all Released under the MIT license; impl/.c and inc/.h have no notice and fall under Files: *.
• debian/copyright is machine-readable (correct format URL as the first line), so no replacement file is proposed.
• Prescan: it listed no files of its own beyond the author check (every holder found is named in debian/copyright); the two holders Yung H Tsin and Nima Norouzi are named in the threeEdgeConnected stanza, though with the wrong licence.
• debian/ packaging: no debian/patches (series absent), no maintainer scripts, no *.maintscript, no dirs/links/install files; libpinchesandcacti-dev.docs installs debian/README.test and debian/tests/run-unit-test, .examples installs debian/tests/consumer.c, which the autopkgtest run-unit-test copies back out of /usr/share/doc.
• debian/tests/control declares a single test (run-unit-test, Depends: @, build-essential, allow-stderr) that compiles consumer.c against /usr/include/pinchesAndCacti and /usr/include/sonLib and greps PINCHESANDCACTI-OK; only the two public headers are installed, and neither includes 3_Absorb3edge2x.h, so the installed headers are self-contained beyond sonLib.h.
• Standards-Version 4.7.4 is current for the reviewing system's Policy; debhelper-compat (= 14) means dh adds the relationship substvars itself, so the bare Depends: ${misc:Depends}, libsonlib-dev is not a missing-substvar issue.
• Changelog: single 0.0~git20240507.67138b5-1 entry, unstable, closing #1152146, signed and dated Mon, 26 Oct 2026 (a Monday).
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20240507.67138b5, packaged 0.0~git20240507.67138b5).

Not confirmed

• libsonlib-dev — both the Build-Depends and the -dev package's Depends — is not in the reviewing system's package lists and was not found in ftp-master's NEW queues (apt-cache found no libsonlib-dev and no sonlib). The lists can lag behind NEW, so this is not reported as a fault; a build and the autopkgtest would confirm it exists. Related: debian/rules and the autopkgtest link -l:libsonlib.a, i.e. they assume sonLib's static archive is shipped by libsonlib-dev, which I could not check.

Proposed changes

None.