Review: libpinchesandcacti 0.0~git20240507.67138b5+dfsg-1
Package Information
| Description | cactus graph and pinch graph library pinchesAndCacti implements two graph data structures used by genome alignment tools: pinch graphs, a generalised overlap graph of alignment blocks over sequences, and cactus graphs, which represent the sequence alignments of a genome as a set of nested cycles. This package contains the shared library. |
|---|---|
| Maintainer | Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org> |
| Changed By | Andreas Tille <tille@debian.org> |
| Sponsor | tille@debian.org |
| Distribution | unstable |
| Architecture | any |
| VCS | git: https://salsa.debian.org/med-team/libpinchesandcacti.git (browse) |
| Closes | #1152146 |
| Tracker | https://tracker.debian.org/pkg/libpinchesandcacti |
| Uploaded | 11 days ago |
| Supersedes | 0.0~git20240507.67138b5-1 |
New Package Report
.changes
| Source | libpinchesandcacti |
|---|---|
| Version | 0.0~git20240507.67138b5+dfsg-1 |
| Changed-By | Andreas Tille <tille@debian.org> |
| Architecture | source amd64 |
| Distribution | unstable |
| Date | Tue, 27 Oct 2026 13:08:40 +0100 |
Changelog
libpinchesandcacti (0.0~git20240507.67138b5+dfsg-1) unstable; urgency=medium . * Initial release (Closes: #1152146)
.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | libpinchesandcacti-dev deb libdevel optional arch=any libpinchesandcacti0 deb libs optional arch=any |
| Section | libdevel |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: pinchesAndCacti
Upstream-Contact: Benedict Paten <benedictpaten@gmail.com>
Source: https://github.com/benedictpaten/pinchesAndCacti
Files-Excluded:
externalTools
Files: *
Copyright: 2009-2024 Benedict Paten <benedictpaten@gmail.com>
License: MIT
Files: impl/stCactusGraphs.c
Copyright: 2009-2024 Benedict Paten <benedictpaten@gmail.com>
2014 Erik Garrison
License: MIT
Comment: The three-edge-connected component code is a C port of the independent
MIT implementation in vg, src/algorithms/three_edge_connected_components.cpp,
Copyright (c) 2014 Erik Garrison. vg's bundled copy of pinchesAndCacti under
deps/ was not used.
Files: debian/*
Copyright: 2026 Andreas Tille <tille@debian.org>
License: MIT
License: MIT
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 11 days ago.
Report
DFSG NEW review for libpinchesandcacti version 0.0~git20240507.67138b5+dfsg-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
The package is DEP-5 (copyright-format 1.0) and MIT throughout. The upstream tree is Benedict Paten's MIT code (LICENSE, inc/.h, impl/.c, tests/.c, README, Makefile, include.mk, init.py, .travis.yml), impl/stCactusGraphs.c additionally names Erik Garrison for the three-edge-connected code ported from vg, and debian/ names Andreas Tille. The non-free externalTools/threeEdgeConnected code is gone from the +dfsg tarball, its Makefile rules and its call site are patched away, and nothing in the tree refers to it any more; the MIT text is reproduced in full, so nothing needs /usr/share/common-licenses. No file is left without a licence, and there are no binaries, images, fonts, minified or generated files.
Packaging
Sensible, modern packaging: compat 14 with debhelper-compat and no debian/compat, Standards-Version 4.7.4 (Policy here is 4.7.4.1), correct SONAME/package split into libpinchesandcacti0 and libpinchesandcacti-dev with Multi-Arch: same, d-shlibs/d-shlibmove used for the library installation, an autopkgtest that compiles a consumer against both the static and the shared library, and DEP-3 patches with a clear description of the non-free code replacement. Build-Depends (d-shlibs 0.111, libsonlib-dev 1.1+git20220915.5cbc158+dfsg-1) both exist in the archive. The sonLib static-linking workaround in debian/rules is unusual but explicitly reasoned and exercised by the autopkgtest.
Issues
None.
Verified ◂
- Read the whole tree: all 13 upstream files (LICENSE, README, Makefile, include.mk, .travis.yml, init.py, inc/stCactusGraphs.h, inc/stPinchGraphs.h, impl/stCactusGraphs.c, impl/stPinchGraphs.c, tests/allTests.c, tests/stCactusGraphsTest.c, tests/stPinchGraphsTest.c) and every file under debian/; .pc/ and the binaries were not read, as instructed.
- The prescan reported no copyright holder missing from debian/copyright; its matches are the MIT notices at LICENSE (2024 Benedict Paten), init.py and tests/*.c (2009-2011 Benedict Paten) and debian/patches/0001 (2014 Erik Garrison), all represented in the copyright file. Grep for Copyright/(C)/SPDX/Licensed under/GNU/Apache/public domain found no other holder or licence.
- debian/copyright is DEP-5 1.0 with Format, Upstream-Name, Upstream-Contact, Source, and Files stanzas for , impl/stCactusGraphs.c and debian/; the later stanzas override the earlier ones and together they match every file in the tree. The MIT text in the stand-alone License stanza matches LICENSE verbatim; no /usr/share/common-licenses pointer is needed or used.
- The +dfsg orig tarball contains no externalTools/ (checked its listing) and no reference to 3_Absorb3edge2x.h or computeThreeEdgeConnectedComponents remains outside .pc/ and the patch files; patch 0002 removes the externalTools make rules and patch 0001 replaces the call site and the include. Files-Excluded: externalTools matches the removal.
- No binary, font, image, PDF, archive, minified or generated file is in the tree; the only build products (obj/, libpinchesandcacti.a, libpinchesandcacti.so*) are created by debian/rules and removed by override_dh_auto_clean.
- Packaging: debhelper compat 14 via debhelper-compat (= 14); the debhelper tool confirms that from compat 9 dh exports dpkg-buildflags, so the manual $(CC)/$(CFLAGS)/$(CPPFLAGS)/$(LDFLAGS) compile gets the hardening flags, and that an override_dh_auto_test is skipped under nocheck from compat 13 (the rule checks it itself as well).
- Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool), i.e. the same first two components. Vcs-Git/Vcs-Browser, Homepage, Section and the libs/libdevel split are right; debian/source/format is 3.0 (quilt); debian/changelog is a valid initial release closing #1152146.
- d-shlibs 0.111 and libsonlib-dev 1.1+git20220915.5cbc158+dfsg-1 are in the archive (apt-cache tool), so the Build-Depends can be satisfied.
- debian/tests/control is consistent with the Salsa CI trigger (Testsuite-Triggers: build-essential); debian/tests/run-unit-test builds debian/tests/consumer.c, installed as an example, against both libpinchesandcacti.a and libpinchesandcacti.so, exercising both graph data structures including collapseToCactus and its self-loop handling.
- Upstream's own tests/*.c are CuTest-based and are not built; that is consistent with CuTest not being shipped by libsonlib-dev, and nothing in debian/rules claims to run them. The sonLib static-archive link line (-l:libsonlib.a) used for the library's tests is deliberately documented in debian/rules.
- debian/watch was not reviewed, as instructed.
- uscan found the packaged version as the newest upstream release (upstream
0.0~git20240507.67138b5, packaged0.0~git20240507.67138b5+dfsg).
Not confirmed ◂
- d-shlibs is not installed on the reviewing system and d-shlibmove has no manual page here, so what d-shlibmove moves could not be read. There are no *.install files (the debian/rules comment saying they 'take the build products' is stale), so all installation depends on d-shlibmove: it is invoked with only .so plus --movedev 'inc/.h', and it could not be verified whether it also installs the built libpinchesandcacti.a into libpinchesandcacti-dev. If it does not, the -dev package would ship no static library despite its description, and the autopkgtest's -l:libpinchesandcacti.a link would fail.
- libsonlib-dev is not installed here, so /usr/include/sonLib (used by INCLUDES = -I/usr/include/sonLib) and libsonlib.a (used by -l:libsonlib.a) could not be confirmed on disk.
- The vg file that debian/patches/0001 says the C port was translated from (vg src/algorithms/three_edge_connected_components.cpp, MIT, 2014 Erik Garrison) is not in the package and cannot be fetched, so the provenance argument in the patch and the Comment in debian/copyright could not be checked independently; on the package's own evidence the port is MIT and the non-free original is not referenced.
Proposed changes ◂
None.
Uploader's response to the LLM review
Problem with non-free code of last upload was solved
— Andreas Tille (tille), 11 days ago
Review Information
accepted — allocated to awm 11 days ago, started 11 days ago, completed 11 days ago.