DFSG NEW review for libqoriq-rcw version 1.4.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree is under the BSD-3-Clause licence held by "Free Mobile - Vincent Jardin". debian/copyright is machine-readable, has one Files: * stanza matching every path (including debian/ and .github/), names that holder, and carries the full BSD-3-Clause text; the short name matches the LICENSE file and every SPDX header. No third-party code is vendored: mcpp is an external sharedlibrary dependency (libmcpp0, BSD-2-Clause) linked by meson, not copied into the source. The holder the prescan flagged is the one named in debian/copyright, differing only in the hyphen style.

Packaging

This is a well-formed new library package: debhelper compat 14 with dh and the meson buildsystem, hardening=+all, a correct runtime/-dev split with Multi-Arch: same, an exact-version dependency, symbols file matching the version script and header, pkg-config file and static library in -dev, man page installed in -dev, and an autopkgtest that compiles and runs against the installed library. Build-Depends match what meson.build looks for, the nocheck handling in rules is consistent with libcmocka-dev <!nocheck>, Standards-Version 4.7.4 is current against Policy 4.7.4.1, and the changelog is a sane initial 1.4.0-1 to unstable. No patches are needed, and none are shipped.

Issues

None.

Verified

• debian/copyright read in full: DEP-5 with the exact Format URL, Files: * with Copyright: 2026 Free Mobile -- Vincent Jardin and License: BSD-3-Clause, followed by a stand-alone License: BSD-3-Clause paragraph containing the complete three clauses and disclaimer - sufficient for a permissive licence not in /usr/share/common-licenses.
• The prescan's one possible holder, Free Mobile - Vincent Jardin (LICENSE:1, include/qoriq-rcw/rcw.h:3, src/libqoriq-rcw.map:3, and every src/ and tests/ file), is the entity named in debian/copyright; only - versus -- differs, so no holder is missing.
• All files carrying a per-file notice use SPDX-License-Identifier: BSD-3-Clause and the same holder. Files without a notice (README.md, meson.build, meson_options.txt, tests/meson.build, most debian/ files) are covered by Files: * and the top-level LICENSE, which states the same licence.
• The prescan found no built artifacts and no non-free wording; confirmed by reading the tree: no binaries, jars, minified JS/CSS, or generated code. The only build product is the man page, generated by pandoc at build time from man/libqoriq-rcw.3.md, which is shipped in the source.
• No third-party source is vendored. mcpp (BSD-2-Clause) is linked as an external library (cc.find_library('mcpp') in meson.build, provided by libmcpp0), so no mcpp stanza belongs in debian/copyright; the man page's "embedded copy of mcpp" wording describes in-process linking, and no mcpp code exists in the tree.
• tests/ data is synthetic (test_uboot.c uses generated 0001 0203 ... lines, test_pbl.c compiles source at test time, test_source.c uses an 8-byte write vector); no u-boot or vendor image is embedded and no extra licence applies to test data.
• All of debian/ read in full except watch (out of scope): control, rules, changelog, gbp.conf, both .install files, .symbols, source/format, tests/control, tests/build, upstream/metadata, salsa-ci.yml.
• Build machinery is consistent: compat 14, dh $@ --buildsystem=meson, export DEB_BUILD_MAINT_OPTIONS = hardening=+all, and -Dtests=$(TESTS) with tests disabled for nocheck in either DEB_BUILD_OPTIONS or DEB_BUILD_PROFILES, matching libcmocka-dev <!nocheck>; pandoc is in Build-Depends, so the man page the dev .install expects is always generated.
• Package split is correct: libqoriq-rcw1 holds libqoriq-rcw.so.1*; libqoriq-rcw-dev holds the header, .so link, static .a, pkg-config file and man page, and depends on the runtime with = ${binary:Version}; both are Multi-Arch: same. libmcpp-dev in the dev package's Depends is justified by the static library and the .pc Libs.private: -lmcpp.
• debian/libqoriq-rcw1.symbols names the right soname and package and lists exactly the 24 functions exported by src/libqoriq-rcw.map and declared in include/qoriq-rcw/rcw.h; tests/check_exports.sh enforces header-versus-map agreement at build time.
• debian/tests/build compiles a program against the installed library via pkgconf --cflags --libs libqoriq-rcw, links and runs it, and its Depends (build-essential, pkgconf, libqoriq-rcw-dev) cover what it uses.
• debian/control: Standards-Version 4.7.4 is current against Policy 4.7.4.1, Homepage and both Vcs fields are present and consistent, source format is 3.0 (quilt), changelog is 1.4.0-1 to unstable with Closes: #1152047, and the man page date/version match 1.4.0.
• apt-cache confirms libmcpp-dev/libmcpp0 (both Multi-Arch: same), libcmocka-dev and pandoc exist in the archive, so the build and binary dependencies are satisfiable.
• The .orig.tar.gz also contains a debian/ directory; dpkg-source erases it before extracting the debian tarball (Dpkg::Source::Package::V2 do_extract), so the shipped packaging is the one in libqoriq-rcw_1.4.0-1.debian.tar.xz and this is not a defect.
• Pre-Depends: ${misc:Pre-Depends} and the explicit ${misc:Depends}/${shlibs:Depends} fields are harmless at compat 14, where dh_gencontrol fills them itself.
• uscan found the packaged version as the newest upstream release (upstream 1.4.0, packaged 1.4.0).

Not confirmed

• No build or autopkgtest was run, and the mcpp 2.7.2 headers and library are not installed on the reviewing system, so the mcpp API used in src/rcw_preprocess.c (mcpp_lib_main, mcpp_use_mem_buffers, mcpp_get_mem_buffer) and the pandoc-generated man page were not exercised; a build would confirm them.
• A build would also confirm that the archive's cmocka 2.0.2 headers accept the cmocka calls in tests/, and that meson's dependency('cmocka') is found with the declared Build-Depends.
• File permissions - the executable bits of debian/rules, debian/tests/build and tests/check_exports.sh - are not visible in the read-only views used, so their executability was not checked.
• The ITP bug number in debian/changelog could not be verified, as no network access is available.

Proposed changes

None.