DFSG NEW review for libsdsl version 2.4+dfsg-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 2 important, 0 minor
• debian/watch: version 5, refused by the checks made before uscan is run
• debian/copyright: machine-readable
• Scan before the review: 7 found

Licensing

The code is DFSG-free: virtually everything is GPL-3+ and the two exceptions (hyb_vector.hpp, MIT; qsufsort.hpp, a permissive notice) are also free and GPL-compatible, so the combined library is freely redistributable. However debian/copyright is inaccurate and incomplete: its single Files: * catch-all credits only 2007-2014 Simon Gog under GPL-3+, yet several files have other or additional copyright holders, and at least two files carry permissive licences (MIT, and N. Jesper Larsson's custom notice) whose notices must be reproduced and are not. debian/copyright therefore does not accurately describe the licensing of every file.

Packaging

Packaging is in good shape: machine-readable source format, debhelper-compat 14 with correct substvars, hardening=+all, sensible 64-bit build restriction via architecture-is-64-bit, d-shlibs/d-shlibmove for the shared/static library split, SONAME bumped to 4 with matching libsdsl4 runtime package, coherent Multi-Arch: same, and a smoke autopkgtest exercising both shared and static linkage. The three patches are clearly described with DEP-3 headers. Standards-Version 4.7.4 matches current Policy. No sponsor-blocking packaging problems found.

Issues

1. [blocker] [licensing] Files: * catch-all misstates the licence of hyb_vector.hpp (MIT) and qsufsort.hpp (permissive notice)

• Files: debian/copyright (Files: * stanza); include/sdsl/hyb_vector.hpp:2-31; include/sdsl/qsufsort.hpp:1-14
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright assigns Files: * + License: GPL-3+. But hyb_vector.hpp opens Copyright (c) 2014 Juha Karkkainen, Dominik Kempa and Simon J. Puglisi followed by Permission is hereby granted, free of charge ... THE SOFTWARE IS PROVIDED "AS IS" (the MIT licence), and qsufsort.hpp carries Copyright 1999, N. Jesper Larsson, all rights reserved with This software may be used freely for any purpose ... the copyright notice must be retained and any alterations in the code must be clearly marked.
• Problem: Two files are licensed under permissive terms with notices that must be reproduced in any distribution, but the GPL-3+ catch-all both misdescribes them and omits the required notice texts. This makes debian/copyright inaccurate: a MIT-licensed file is claimed to be GPL-3+ and its permission notice is not reproduced.
• Fix: Add a Files: stanza for include/sdsl/hyb_vector.hpp with Copyright: 2014 Juha Karkkainen, Dominik Kempa and Simon J. Puglisi and License: MIT plus a standalone MIT License: paragraph reproducing the notice, and a stanza for include/sdsl/qsufsort.hpp recording Copyright: 1999 N. Jesper Larsson (with the sdsl GPL-3+ header) and reproducing the permissive notice.

2. [important] [licensing] Several copyright holders named in file notices are missing from debian/copyright

• Files: debian/copyright (Files: * stanza); include/sdsl/k2_tree.hpp:2; sd_vector.hpp:3-4; construct_lcp.hpp:3; lib/construct_lcp.cpp:3; simple_sds.hpp:2; copy of holders in hyb_vector.hpp and qsufsort.hpp (blocker)
• Basis: checked, in the package or with a reference tool
• Evidence: The Files: * stanza names only Copyright: 2007-2014 Simon Gog. Grep of the tree shows files crediting Francisco Montoto (2016, k2_tree.hpp/k2_tree_helper.hpp), Timo Beller (2013, construct_lcp.hpp/cpp, nn_dict_dynamic.hpp, wt_hutu.hpp), Matthias Petri (2012, bit_vector_il.hpp, uint128_t.hpp), Markus Brenner (2013, wt_hutu.hpp), Genome Research Ltd (2015, sd_vector.hpp), Jouni Siren (2021, sd_vector.hpp, simple_sds.hpp, COPYING), Juha Karkkainen/Dominik Kempa/Simon J. Puglisi (2014, hyb_vector.hpp) and N. Jesper Larsson (1999, qsufsort.hpp).
• Problem: A debian/copyright Files: * paragraph that credits only one of several holders is inaccurate; holders named in file notices must be represented.
• Fix: Restate the Files: * holder range (e.g. 2007-2021 Simon Gog) and add the missing holders to the appropriate Files: stanzas, consistent with the licence fix above.

3. [important] [packaging] debian/watch was refused by the checks made before uscan is run

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: - it contains a "transport::address" style git URL
• Problem: These checks refuse what is not plausibly a watch file, and the values known to make uscan do something other than look at an upstream site. uscan was not run, so the file is untested.
• Fix: Read debian/watch and correct it. If uscan is run on it by hand, do that with caution.

Verified

• Scan archive test/test_cases/faust.txt.tar.gz and moby.int.tar.gz are gzip-compressed test inputs shipped by upstream (for populating larger test inputs), not built artefacts; their source form is the tarball itself. Not an issue.
• Scan binary files test/test_cases/abc_abc_abc.txt (12 B, repeating abc_abc_abc...), abc_abc_abc2.txt, all_symbols.txt (256 B) and keeper.int (504 B) are small text test fixtures not recognised by the scanner; they are test data, not built files. Not an issue.
• Scan PDF extras/cheatsheet/viz.pdf is a small (21.5 KB) documentation figure shipped intentionally by upstream (kept non-ignored in extras/cheatsheet/.gitignore as !viz.pdf) and embedded by sdsl-cheatsheet.tex:660. Not an issue.
• external/googletest/ is an empty unpopulated submodule directory; nothing is shipped from it.
• Files-Excluded: external/libdivsufsort*, external/d3* matches the repack; libdivsufsort is provided by Debian's libdivsufsort package and d3 by libjs-d3, both in Build-Depends/Depends.
• Licence across the rest of the tree is uniformly GPL-3+ (each header carries the GNU General Public License ... version 3 ... or any later version text); the only exceptions are hyb_vector.hpp (MIT) and qsufsort.hpp (permissive notice + GPL header), covered in the issues.
• COPYING (Jouni Siren 2021, Simon Gog 2007-2019, GPL-3-or-later) is GPL-3+, consistent with the package licence.
• All licences (GPL-3+, MIT, Larsson permissive) are DFSG-free and pairwise compatible for combination in one binary.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed

None.

Proposed changes

None.