Review: libsoup 3.8.0-4
Package Information
| Description | HTTP library implementation in C -- Development files It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK+ applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the GTK+ programming model (a synchronous operation mode is also supported for those who want it). Features: * Both asynchronous (GMainLoop and callback-based) and synchronous APIs * Automatically caches connections * SSL Support using GnuTLS * Proxy support, including authentication and SSL tunneling * Client support for Digest, NTLM, and Basic authentication * Server support for Digest and Basic authentication * Basic client-side SOAP support This package contains the development files. |
|---|---|
| Maintainer | Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org> |
| Changed By | Jeremy Bícha <jbicha@ubuntu.com> |
| Sponsor | jbicha@debian.org |
| Distribution | unstable |
| Architecture | any all |
| VCS | git: https://salsa.debian.org/gnome-team/libsoup3.git (browse) |
| Tracker | https://tracker.debian.org/pkg/libsoup |
| Uploaded | 5 hours ago |
New Package Report
.changes
| Date | Wed, 21 Oct 2026 13:02:07 +0200 |
|---|---|
| Source | libsoup |
| Version | 3.8.0-4 |
| Changed-By | Jeremy Bícha <jbicha@ubuntu.com> |
| Architecture | source amd64 |
| Distribution | unstable |
Changelog
libsoup (3.8.0-4) unstable; urgency=medium . * Rename source package and -dev package to remove version number * debian/watch: Convert to Version: 5 * Update debian/copyright
.dsc
| Package-List | gir1.2-soup-3.0 deb introspection optional arch=any libsoup-3.0-0 deb libs optional arch=any libsoup-3.0-common deb devel optional arch=all libsoup-3.0-dev deb oldlibs optional arch=all libsoup-3.0-doc deb doc optional arch=all libsoup-3.0-tests deb misc optional arch=any profile=!noinsttest profile:v1=!noinsttest libsoup-dev deb libdevel optional arch=any |
|---|---|
| Section | introspection |
| Priority | optional |
| Component | main |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://download.gnome.org/sources/libsoup/
Upstream-Name: libsoup
License: LGPL-2.1+
Files: *
Copyright:
1999-2003 Ximian, Inc.
2001-2007 Novell, Inc.
2007 OpenedHand Ltd.
2007-2016 Red Hat, Inc.
2008 Diego Escalante Urrelo
2009-2013 Guido Guenther
2009-2013 Gustavo Noronha Silva
2009-2015 Collabora Ltd.
2009-2019 Igalia, S.L.
2012 Nokia Corporation
2012-2018 Canonical Ltd.
2012-2019 Free Software Foundation, Inc.
2015 GNOME i18n Project for Vietnamese
2017-2018 Metrological Group B.V.
2018 Rosetta Contributors
2018-2019 Simon McVittie
License: LGPL-2+
Files: fuzzing/fuzz_headers_parse_request.c
fuzzing/fuzz_headers_parse_response.c
Copyright: 2025 Philip Withnall
License: LGPL-2.1+
Files: libsoup/http2/soup-body-input-stream-http2.c
Copyright: 2006-2007 Red Hat, Inc.
2021 Igalia S.L.
License: LGPL-2.1+
Files: libsoup/websocket/soup-websocket-connection.*
libsoup/websocket/soup-websocket.*
tests/websocket-test.c
Copyright: 2013-2014 Red Hat, Inc.
License: LGPL-2.1+
Files: po/*
Copyright: 2012-2014, 2024 A S Alam <aalam@users.sf.net>
2022 Alexander Shopov
2012-2013, 2016 Free Software Foundation, Inc
2012-2013 libsoup
2026 libsoup's authors
2012 libsoup's to Swecha Telugu localisation Team <localization@swecha.net>
2018 Rosetta Contributors and Canonical Ltd 2018
License: LGPL-2.1+
Files: tests/pkcs11/*
Copyright: 1994-1999 RSA Security Inc. Licence to copy this document
License: MPL-2.0 or RSA-Other
Files: libsoup/websocket/soup-websocket-connection-private.h
tests/ws-test-helper.c
Copyright: 2024 Axis Communications AB, SWEDEN
License: LGPL-2.1+
Files: get_apache_modules_dirs.py
Copyright:
2017-2018 Tomas Popela
License: Expat
License: Expat
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
.
The above copyright notice and this permission notice shall be included
in all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
License: LGPL-2+
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2 of the License, or (at your option) any later version.
License: LGPL-2.1+
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
.
On Debian systems, the complete text of the GNU Lesser General
Public License can be found in `/usr/share/common-licenses/LGPL-2.1'.
License: MPL-2.0
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.
Comment:
On Debian systems a copy of the MPLv2.0 can be found in
/usr/share/common-licenses/MPL-2.0
License: RSA-Other
License to copy and use this software is granted provided that it is
identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
(Cryptoki)" in all material mentioning or referencing this software.
.
License is also granted to make and use derivative works provided that
such works are identified as "derived from the RSA Security Inc. PKCS #11
Cryptographic Token Interface (Cryptoki)" in all material mentioning or
referencing the derived work.
.
RSA Security Inc. makes no representations concerning either the
merchantability of this software or the suitability of this software for
any particular purpose. It is provided "as is" without express or implied
warranty of any kind.
DFSG Assistant LLM REVIEW 1 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 3 hours ago.
Report
DFSG NEW review for libsoup version 3.8.0-4
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 1 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 10 found
Licensing
All licences present are DFSG-free (LGPL-2+/LGPL-2.1+, Expat for get_apache_modules_dirs.py, MPL-2.0/RSA-Other for tests/pkcs11/*, Apache-2.0 for tests/mock-pkcs11.c) and compatible, so compliance is fine. However debian/copyright does not describe every file accurately: tests/mock-pkcs11.c is licensed Apache-2.0 (with the Pkcs11Interop Project as a copyright holder) but falls under the Files: * catch-all, which declares it LGPL-2+. This must be given its own Files stanza.
Packaging
Packaging is solid: debhelper compat 14, hardening=+all, clean source package split with Multi-Arch, installed-tests with proper profile handling, DEP-3-headed patches that are sensible, good autopkgtests, and changelog with bug/CVE closures. The armhf/hppa || true swallow of test failures is an explicit, changelog-documented temporary measure, not an error here.
Issues
1. [blocker] [licensing] tests/mock-pkcs11.c declared LGPL-2+ but is Apache-2.0
- Files:
tests/mock-pkcs11.c,debian/copyright - Basis: checked, in the package or with a reference tool
- Evidence:
tests/mock-pkcs11.c:2-5:Copyright 2011-2016 The Pkcs11Interop Project/Copyright 2019 Igalia S.L./Licensed under the Apache License, Version 2.0. debian/copyright has no stanza for this file, so it is covered byFiles: *...License: LGPL-2+, and 'The Pkcs11Interop Project' is not named as a holder. - Problem: debian/copyright must accurately state the licence and holders of every source file (Policy 12.5, copyright-format). The file is Apache-2.0, not LGPL-2+, and the Pkcs11Interop Project holder is missing. Apache-2.0 is DFSG-free, so this is an accuracy defect, not a compliance one.
- Fix: Add a
Files: tests/mock-pkcs11.cstanza withCopyright: 2011-2016 The Pkcs11Interop Projectand2019 Igalia S.L.andLicense: Apache-2.0, plus a stand-aloneLicense: Apache-2.0paragraph pointing at /usr/share/common-licenses/Apache-2.0.
Verified
- tests/compressed-data/compressed.br, compressed.zst, corrupt.br are test payloads for the decompressor tests; the plain-text source (uncompressed.txt) is in the same directory, so preferred form exists.
- tests/resources/mbox.gz, mbox.raw, mbox.zlib are gzip/zlib variants of the plain-text
mboxfixture present alongside; content-sniffer/decompression test data. - tests/resources/test.aiff and test.webm are media fixtures for content-type sniffer tests (test.wav/test.ogg/test.mp4 analogous); no licence or provenance problem.
- libsoup/soup-message-headers.c:829,931 'You may not modify the headers while iterating' are API documentation describing mutability rules for the iterator callback, not a licence restriction.
- tests/pkcs11/pkcs11.h and pkcs11t.h carry the MPL-2.0 header plus the RSA-Other licence text, matching the
tests/pkcs11/*stanza (MPL-2.0 or RSA-Other) in debian/copyright. - fuzzing/fuzz_headers_parse_request.c and fuzz_headers_parse_response.c (2025 Philip Withnall) carry
SPDX-License-Identifier: LGPL-2.1-or-later, matching theirFiles:stanzas. - soup-websocket-extension.[ch] (2019 Igalia S.L., 'GNU Library General Public License ... version 2 ... any later version') are correctly LGPL-2+ under the catch-all.
- get_apache_modules_dirs.py is Expat and matched by the
Files: get_apache_modules_dirs.pystanza with a full stand-alone Expat License paragraph. - Sampled licence markers across libsoup/, fuzzing/, tests/, po/ (SPDX LGPL-2.0-or-later / LGPL-2.1-or-later, po 'same license as the libsoup package'): all consistent with the declared LGPL-2+/LGPL-2.1+ terms.
- debian/copyright is DEP-5 machine-readable with a correct Format: line; all licences used have full text or common-licenses references except Apache-2.0, which is absent because mock-pkcs11.c is mis-stanza'd.
- Packaging: compat 14,
dh $@with override_dh_auto_configure/test-arch/fixperms/gnome, Build-Depends correctly split with <!nocheck>/<!noinsttest> profiles, autopkgtests (installed-tests, flaky, libsoup-3.0-dev), all patches have DEP-3 headers, changelog version scheme and closures sane. - Standards-Version 4.7.4 matches current Policy 4.7.4.1 (first two components current).
- Found no built artifacts whose source is absent from the tree; no embedded third-party library copies.
- uscan found the packaged version as the newest upstream release (upstream
3.8.0, packaged3.8.0). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (LGPL-2.1,MPL-2.0).
Not confirmed
- Could not build or run the package to confirm test outcomes or symbol correctness; not attempted, as this is out of scope.
Proposed changes
None.
Uploader's response to the LLM review
The uploader rejected this upload in response to the review.
Review Information
rejected — allocated to dfsg-uploader 2 hours ago, started 2 hours ago, completed 2 hours ago.
Final Comment
The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.