DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: libpinchesandcacti 0.0~git20240507.67138b5-1

New Package Report

.changes◂
Sourcelibpinchesandcacti
Version0.0~git20240507.67138b5-1
Changed-ByAndreas Tille <tille@debian.org>
Architecturesource amd64
Distributionunstable
DateMon, 26 Oct 2026 09:04:57 +0100
Changelog◂ 
libpinchesandcacti (0.0~git20240507.67138b5-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152146)
.dsc◂
Sectionlibdevel
Priorityoptional
Componentmain
Package-Listlibpinchesandcacti-dev deb libdevel optional arch=any
libpinchesandcacti0 deb libs optional arch=any
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: pinchesAndCacti
Upstream-Contact: Benedict Paten <benedictpaten@gmail.com>
Source: https://github.com/benedictpaten/pinchesAndCacti

Files: *
Copyright: 2009-2024 Benedict Paten <benedictpaten@gmail.com>
License: MIT


Files: externalTools/threeEdgeConnected/*
Copyright: 2011 Yung H Tsin and Nima Norouzi
License: MIT

Files: debian/*
Copyright: 2026 Andreas Tille <tille@debian.org>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 2 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 12 days ago.

Report◂

DFSG NEW review for libpinchesandcacti version 0.0~git20240507.67138b5-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: No
  • Issues: 2 blocker, 0 important, 2 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

The tree contains non-free code: externalTools/threeEdgeConnected/impl/3_Absorb3edge2x.c and inc/3_Absorb3edge2x.h state that the authors permit distribution only within this product and require any further incorporation or copying to be requested, so the MIT/BSD terms do not apply to them; that file is compiled into libpinchesandcacti (stCactusGraphs.c includes 3_Absorb3edge2x.h), so both binaries carry it. debian/copyright also misdescribes that directory: it declares externalTools/threeEdgeConnected/* MIT and attributes its whole contents to Tsin and Norouzi, while most files there are Benedict Paten's and the two 3_Absorb3edge2x files are not MIT at all.

Packaging

Mostly correct and modern packaging (compat 14, DEP-5 copyright, autopkgtest, Vcs-*, hardening flags, dangling-substvar handling fine at compat 14). Two things a sponsor would raise: debian/rules carries a stale comment about *.install files that do not exist, and the shipped libpinchesandcacti.so is built with undefined sonLib symbols and must be linked with the static libsonlib.a, so it cannot be linked against or dlopen'd on its own.

Issues

blocker licensing 1. Non-free files 3_Absorb3edge2x.c and 3_Absorb3edge2x.h, compiled into the library, restrict further copying to "by request only" while debian/copyright calls them MIT ◂
  • Files: externalTools/threeEdgeConnected/impl/3_Absorb3edge2x.c:1-7, externalTools/threeEdgeConnected/inc/3_Absorb3edge2x.h:1-8, debian/copyright
  • Basis: checked, in the package or with a reference tool
  • Evidence: 3_Absorb3edge2x.h:2-7: Copyright (C) 2011 by Yung H Tsin and Nima Norouzi / the authors ... require that any further incorporation or copying be permitted by request only, hence the BSD/MIT license ... does not apply to this file. debian/copyright says Files: externalTools/threeEdgeConnected/* ... License: MIT.
  • Problem: A licence that allows distribution only within this product and requires the authors' permission for any further incorporation or copying forbids redistribution and modification, violating DFSG 1 and DFSG 3, so the files are not free. impl/stCactusGraphs.c:8 includes 3_Absorb3edge2x.h and debian/rules:9 compiles 3_Absorb3edge2x.c into libpinchesandcacti, so both binary packages contain the non-free code and cannot be in main. The same restriction is echoed tree-wide by externalTools/LICENSE.txt: third party contributors who reserve all rights over the code. Any further distribution of their code requires their permission unless otherwise stated.
  • Fix: Either drop 3_Absorb3edge2x.c/.h (and the code in stCactusGraphs.c that uses computeThreeEdgeConnectedComponents) or obtain from Yung H Tsin and Nima Norouzi an unambiguous free licence permitting redistribution and modification; then correct the externalTools/threeEdgeConnected/* stanza in debian/copyright accordingly. Until that is resolved the package must not be uploaded.
blocker licensing 2. debian/copyright's Files: externalTools/threeEdgeConnected/* stanza names the wrong holder and the wrong licence for most files it covers ◂
  • Files: debian/copyright:11-13, externalTools/threeEdgeConnected/Makefile, externalTools/threeEdgeConnected/__init__.py:3, externalTools/threeEdgeConnected/threeEdgeTests.py:3, externalTools/threeEdgeConnected/tests/3_Absorb3edge2xTest.c:2, externalTools/threeEdgeConnected/tests/allTests.c:2
  • Basis: checked, in the package or with a reference tool
  • Evidence: Stanza: Files: externalTools/threeEdgeConnected/* / Copyright: 2011 Yung H Tsin and Nima Norouzi / License: MIT. But Makefile, __init__.py, threeEdgeTests.py and tests/*.c carry Copyright (C) 2009-2011 by Benedict Paten (benedictpaten@gmail.com) ... Released under the MIT license, see LICENSE.txt, and the two 3_Absorb3edge2x files are not MIT (see the separate blocker). Only those two files belong to Tsin and Norouzi.
  • Problem: An inaccurate debian/copyright is itself a fault: the stanza attributes Benedict Paten's files to a different holder and declares an MIT licence over two files whose own notices exclude MIT, so it misdescribes the copyright and licensing of the files it matches (copyright-format 1.0 section 6.7, Debian Policy 12.5).
  • Fix: Attribute each file to its real holder and licence: one stanza for externalTools/threeEdgeConnected/impl/3_Absorb3edge2x.c and externalTools/threeEdgeConnected/inc/3_Absorb3edge2x.h (only once their licence is settled), and let the Benedict Paten files fall under Files: * or a stanza naming him.
minor packaging 3. debian/rules comment refers to *.install files that are not in the tree ◂
  • Files: debian/rules:8-10
  • Basis: checked, in the package or with a reference tool
  • Evidence: # Its DPkg::Buildsystem is therefore disabled and the *.install files take the / # build products. — but debian/ has no *.install file; the products are staged by the d-shlibmove call in execute_after_dh_install.
  • Problem: The comment describes a mechanism the package does not use, so a reader (or a later maintainer) is misled about where the built library and headers come from. Not a policy violation; a documentation defect only.
  • Fix: Delete or correct the comment to describe the d-shlibmove call that actually stages the files.
minor packaging 4. libpinchesandcacti.so is shipped with undefined sonLib symbols and cannot be linked against or loaded without the static libsonlib.a ◂
  • Files: debian/rules:12-20, debian/rules:44-46, debian/control:37-44
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/rules: LIBS = -l:libsonlib.a -lm -lpthread and # libsonlib.so.1 ... cannot be loaded at all. Do not link the shared library against it: the sonLib symbols stay undefined there and the consumer supplies them from the static archive; the shared library is linked with -shared -Wl,-z,now -Wl,-soname,$(SONAME) ... -lm -lpthread, i.e. without sonLib.
  • Problem: A shared library with undefined symbols that is not linked against the library providing them is not usable the normal way: a program linking -lpinchesandcacti alone gets unresolved references unless it also links libsonlib.a, and libpinchesandcacti.so.0 cannot be dlopen'd by itself. This defeats the purpose of splitting the shared library into libpinchesandcacti0, and the undefined symbols are not recorded as a dependency anywhere.
  • Fix: Fix the underlying sonLib problem so the shared library can link against libsonlib.so (report it against the sonlib package if its shared library is unloadable), or, if the workaround must stay, say so in the package documentation and do not advertise the shared library as an ordinary linkable one.
Verified ◂
  • Read every file in the (small) tree: the top-level LICENSE, README, Makefile, include.mk, .travis.yml, __init__.py, all of impl/, inc/, tests/, all of externalTools/ including LICENSE.txt and every file under threeEdgeConnected/, and all of debian/.
  • No built artefacts (no .so/.a/.o, no .jar/.class, no minified JS/CSS, no PDFs or firmware) are present in the tree; the only content is C sources, headers, Makefiles and a few Python scripts, all with MIT notices.
  • debian/copyright is DEP-5 with the exact Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ URL and reproduces the MIT text in full, so no replacement file is needed.
  • The prescan's author check reported that every copyright holder it found is named in debian/copyright; that is true, but it does not detect the misattribution and the non-free terms reported above.
  • Standards-Version: 4.7.4 against Policy 4.7.4.1 is current enough (Policy 4.7.4.1).
  • debhelper compat 14: relationship substvars are added by dh_gencontrol itself, so their absence from debian/control is not a fault.
  • Read /usr/bin/dh_missing: with no --sourcedir it inspects only debian/tmp and exits 0 if that directory is absent, so the missing *.install files do not fail the build.
  • The Maintainer address debian-med-packaging@lists.alioth.debian.org still matches current Debian Med packages (checked bwa in the archive), so it is not reported.
  • debian/tests/control (Tests: run-unit-test, Depends: @, build-essential) is consistent with Testsuite: autopkgtest / Testsuite-Triggers: build-essential in the .dsc, and debian/tests/run-unit-test exercises both the static and shared library with consumer.c.
  • uscan found the packaged version as the newest upstream release (upstream 0.0~git20240507.67138b5, packaged 0.0~git20240507.67138b5).
Not confirmed ◂
  • libsonlib-dev is not in the reviewing system's package lists nor in ftp-master's NEW list; I could not confirm that it ships libsonlib.a and the sonLib headers that debian/rules and the tests need.
  • d-shlibs is not installed on the reviewing system, so I could not check d-shlibmove's behaviour — in particular whether the static libpinchesandcacti.a (used by the autopkgtest and promised in the libpinchesandcacti-dev description) and the headers are actually staged into the -dev package.
  • The claim in debian/rules that Debian's libsonlib.so.1 cannot be loaded (leaving quicktree symbols undefined) could not be verified without building or inspecting that package.
Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader hasn't responded yet, and is welcome to at any time. The 24-hour hold has ended, so the package is now open for review as usual.

Review Information

accepted — allocated to awm 11 days ago, started 11 days ago, completed 11 days ago.

Final Comment

Superseded by review of later version

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
0.0~git20240507.67138b5+dfsg-1 b10c787b… 2026-10-27 23:35 2026-10-27 23:35 awm accepted VIEW
0.0~git20240507.67138b5-1 93f320f6… 2026-10-26 10:30 2026-10-26 10:30 dfsg-uploader rejected VIEW

Back to Dashboard | View all reviews for this package