DFSG NEW review for libsonlib version 1.1+git20220915.5cbc158+dfsg-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The licensing is DFSG-compliant: every file is under a free licence (MIT for the sonlib and most bundled code, Zlib for externalTools/cutest, BSD-2-Clause for lz4, GPL-2+ for avl.c/avl.h), with no non-free terms, no binary or unbuildable files, and Files-Excluded correctly removing the quicktree copy and .git/.swp files. However, debian/copyright is not fully accurate: the Files: * stanza attributes everything to 2009-2017 Benedict Paten, but several files carry copyright held by Glenn Hickey and Joel Armstrong that no stanza names, so the copyright description is incomplete.

Packaging

Packaging is of good quality: debhelper compat 14 with correct dependency substvars, hardening=+all, sane two-package split (libsonlib1 shared/Multi-Arch same + libsonlib-dev) with proper symlink chain for soname libsonlib.so.1, a real C autopkgtest that exercises both shared and static linking, an updated Standards-Version (4.7.4), correct Vcs/Homepage fields, a CHANGELOG closure for the initial release, and well-purposed DEP-3 patches. The shared library intentionally leaves quicktree symbols unresolved (documented in README.Debian and the add_shared_library.patch) and consumers link -lquicktree, which is a deliberate, workable design.

Issues

1. [important] [licensing] debian/copyright does not name every copyright holder

• Files: debian/copyright, C/impl/sonLibKVDatabase_BigRecordFile.c:2, nxnewick.py:3, nxtree.py:3, nxnewickTest.py:3, nxtreeTest.py:3, C/inc/stPhylogeny.h:2
• Basis: checked, in the package or with a reference tool
• Evidence: Files: * says Copyright: 2009-2017 by Benedict Paten <benedictpaten@gmail.com>, but real headers state Copyright (C) 2006-2012 by Glenn Hickey (sonLibKVDatabase_BigRecordFile.c, nxnewick.py, nxtree.py, nxnewickTest.py, nxtreeTest.py) and Copyright (C) 2006-2014 by Joel Armstrong & Benedict Paten (C/inc/stPhylogeny.h).
• Problem: debian/copyright (DEP-5 5.2) must name the copyright holders of each file; the Files: * stanza naming only Benedict Paten omits Glenn Hickey (five files) and Joel Armstrong (the phylogeny header) entirely, so the copyright field is inaccurate/incomplete even though the MIT licence assignment of all these files is correct.
• Fix: Add a Files: stanza (or extend the relevant ones) naming Glenn Hickey and Joel Armstrong as copyright holders for these files, e.g. Files: C/impl/sonLibKVDatabase_BigRecordFile.c nxnewick.py nxtree.py nxnewickTest.py nxtreeTest.py © 2006-2012 Glenn Hickey and C/inc/stPhylogeny.h © 2006-2014 Joel Armstrong & Benedict Paten, License: MIT.

Verified

• Read debian/copyright fully (DEP-5 format, correct Format: URL); its Files: stanzas: * (MIT, 2009-2017 Benedict Paten), externalTools/cutest/* (Zlib, Asim Jalis), avl.c/avl.h (GPL-2+), C/impl/lz4* (BSD-2-Clause), sonLib_daemonize.py (MIT, Glenn Hickey 2011 + Chad Schroeder 2005), hashTableC* (MIT, Christopher Clark), sonLibSet.* (MIT, Dent Earl), jsmn.* (MIT, Serge Zaitsev), debian/* (MIT, Andreas Tille).
• Every licenced third-party block matches its evidence: cutest licence.txt is the Zlib text reproduced in the stanza; avl.c/avl.h carry the FSF GPL-2 header matching the GPL-2+ stanza; lz4.c/h/lz4hc.c/h carry Yann Collet's BSD-2-Clause matching the stanza.
• No DFSG problems: no non-free terms found (grep for non-commercial/no-modification/NCC terms returned nothing); no minified, bytecode, archive, JAR/class/so, or other built-only files anywhere in the tree; all .c/.h/.py/.cpp sources are present in preferred form.
• Files-Excluded (externalTools/quicktree*, */*.swp, */.git*) matches the tree: no quicktree dir and no .git/.swp files remain.
• All source files carry Released under the MIT license, see LICENSE.txt; LICENSE.txt at the tree root is the MIT text and matches the License: MIT paragraph in debian/copyright.
• README.md:4 (c) 2006 - 2012 The Author(s) (flagged by the prescan) is the project's collective attribution line; the README's own Author section identifies Benedict Paten, and the file is MIT via LICENSE.txt and the Files: * stanza. Not a distinct missing holder.
• sonLibMath.h:2 and stJson.h:2 by Benedict Paten (a) gmail com (prescan 'possibly named') are the same holder (email obfuscated) and are correctly covered by the Files: * stanza.
• sonLibSet.c/sonLibSet.h/sonLibSetTest.c by Dent Earl are covered by the dedicated Files: C/impl/sonLibSet.c C/inc/sonLibSet.h C/tests/sonLibSetTest.c MIT stanza.
• Packaging: debhelper-compat (= 14) with no relationship substvars needed from compat 14; libsonlib1 and libsonlib-dev both Multi-Arch: same with proper Depends (dev depends on libsonlib1 = ${binary:Version} and libquicktree-dev); hardening=+all exported; override_dh_auto_test correctly skipped by dh on nocheck (compat 13+); autopkgtest tests/compile-link really compiles and runs a consumer against both the shared and static libs and depends on all needed -dev packages.
• Standards-Version 4.7.4 matches current Policy (4.7.x); Vcs-Git/Vcs-Browser/Homepage correct; changelog is a valid initial release closing #963598; the two Debian-added patches carry Forwarded: no with full DEP-3 headers.
• uscan found the packaged version as the newest upstream release (upstream 1.1+git20220915.5cbc158, packaged 1.1+git20220915.5cbc158+dfsg).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed

• Could not build the package or run its tests in this read-only review; no cause for a build failure is visible from the sources (deps present, cutest still shipped and built, all headers/libs referenced by rules exist), so no build/test failure is reported.

Proposed changes

None.