DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: libsoup 3.8.0-4

Package Information

DescriptionHTTP library implementation in C -- Development files

It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

libsoup uses the Glib main loop and is designed to work well with GTK+ applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the GTK+ programming model (a synchronous operation mode is also supported for those who want it).

Features: * Both asynchronous (GMainLoop and callback-based) and synchronous APIs * Automatically caches connections * SSL Support using GnuTLS * Proxy support, including authentication and SSL tunneling * Client support for Digest, NTLM, and Basic authentication * Server support for Digest and Basic authentication * Basic client-side SOAP support

This package contains the development files.

MaintainerDebian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed ByJeremy Bícha <jbicha@ubuntu.com>
Sponsorjbicha@debian.org
Distributionunstable
Architectureany all
VCSgit: https://salsa.debian.org/gnome-team/libsoup3.git (browse)
Trackerhttps://tracker.debian.org/pkg/libsoup
Uploaded5 hours ago

New Package Report

.changes◂
DateWed, 21 Oct 2026 13:02:07 +0200
Sourcelibsoup
Version3.8.0-4
Changed-ByJeremy Bícha <jbicha@ubuntu.com>
Architecturesource amd64
Distributionunstable
Changelog◂
libsoup (3.8.0-4) unstable; urgency=medium
 .
   * Rename source package and -dev package to remove version number
   * debian/watch: Convert to Version: 5
   * Update debian/copyright
.dsc◂
Package-Listgir1.2-soup-3.0 deb introspection optional arch=any
libsoup-3.0-0 deb libs optional arch=any
libsoup-3.0-common deb devel optional arch=all
libsoup-3.0-dev deb oldlibs optional arch=all
libsoup-3.0-doc deb doc optional arch=all
libsoup-3.0-tests deb misc optional arch=any profile=!noinsttest profile:v1=!noinsttest
libsoup-dev deb libdevel optional arch=any
Sectionintrospection
Priorityoptional
Componentmain
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://download.gnome.org/sources/libsoup/
Upstream-Name: libsoup
License: LGPL-2.1+

Files: *
Copyright:
    1999-2003 Ximian, Inc.
    2001-2007 Novell, Inc.
    2007 OpenedHand Ltd.
    2007-2016 Red Hat, Inc.
    2008 Diego Escalante Urrelo
    2009-2013 Guido Guenther
    2009-2013 Gustavo Noronha Silva
    2009-2015 Collabora Ltd.
    2009-2019 Igalia, S.L.
    2012 Nokia Corporation
    2012-2018 Canonical Ltd.
    2012-2019 Free Software Foundation, Inc.
    2015 GNOME i18n Project for Vietnamese
    2017-2018 Metrological Group B.V.
    2018 Rosetta Contributors
    2018-2019 Simon McVittie
License: LGPL-2+

Files: fuzzing/fuzz_headers_parse_request.c
       fuzzing/fuzz_headers_parse_response.c
Copyright: 2025 Philip Withnall
License: LGPL-2.1+

Files: libsoup/http2/soup-body-input-stream-http2.c
Copyright: 2006-2007 Red Hat, Inc.
           2021 Igalia S.L.
License: LGPL-2.1+

Files: libsoup/websocket/soup-websocket-connection.*
       libsoup/websocket/soup-websocket.*
       tests/websocket-test.c
Copyright: 2013-2014 Red Hat, Inc.
License: LGPL-2.1+

Files: po/*
Copyright: 2012-2014, 2024 A S Alam <aalam@users.sf.net>
           2022 Alexander Shopov
           2012-2013, 2016 Free Software Foundation, Inc
           2012-2013 libsoup
           2026 libsoup's authors
           2012 libsoup's to Swecha Telugu localisation Team <localization@swecha.net>
           2018 Rosetta Contributors and Canonical Ltd 2018
License: LGPL-2.1+

Files: tests/pkcs11/*
Copyright: 1994-1999 RSA Security Inc. Licence to copy this document
License: MPL-2.0 or RSA-Other

Files: libsoup/websocket/soup-websocket-connection-private.h
       tests/ws-test-helper.c
Copyright: 2024 Axis Communications AB, SWEDEN
License: LGPL-2.1+

Files: get_apache_modules_dirs.py
Copyright:
 2017-2018 Tomas Popela
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
 "Software"), to deal in the Software without restriction, including
 without limitation the rights to use, copy, modify, merge, publish,
 distribute, sublicense, and/or sell copies of the Software, and to
 permit persons to whom the Software is furnished to do so, subject to
 the following conditions:
 .
 The above copyright notice and this permission notice shall be included
 in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

License: LGPL-2+
 This library is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 2 of the License, or (at your option) any later version.

License: LGPL-2.1+
 This library is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 2.1 of the License, or (at your option) any later version.
 .
 On Debian systems, the complete text of the GNU Lesser General
 Public License can be found in `/usr/share/common-licenses/LGPL-2.1'.

License: MPL-2.0
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
 file, You can obtain one at http://mozilla.org/MPL/2.0/.
Comment:
 On Debian systems a copy of the MPLv2.0 can be found in
 /usr/share/common-licenses/MPL-2.0

License: RSA-Other
 License to copy and use this software is granted provided that it is
 identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
 (Cryptoki)" in all material mentioning or referencing this software.
 .
 License is also granted to make and use derivative works provided that
 such works are identified as "derived from the RSA Security Inc. PKCS #11
 Cryptographic Token Interface (Cryptoki)" in all material mentioning or
 referencing the derived work.
 .
 RSA Security Inc. makes no representations concerning either the
 merchantability of this software or the suitability of this software for
 any particular purpose. It is provided "as is" without express or implied
 warranty of any kind.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 3 hours ago.

Report◂

DFSG NEW review for libsoup version 3.8.0-4

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 1 blocker, 0 important, 0 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 10 found

Licensing

All licences present are DFSG-free (LGPL-2+/LGPL-2.1+, Expat for get_apache_modules_dirs.py, MPL-2.0/RSA-Other for tests/pkcs11/*, Apache-2.0 for tests/mock-pkcs11.c) and compatible, so compliance is fine. However debian/copyright does not describe every file accurately: tests/mock-pkcs11.c is licensed Apache-2.0 (with the Pkcs11Interop Project as a copyright holder) but falls under the Files: * catch-all, which declares it LGPL-2+. This must be given its own Files stanza.

Packaging

Packaging is solid: debhelper compat 14, hardening=+all, clean source package split with Multi-Arch, installed-tests with proper profile handling, DEP-3-headed patches that are sensible, good autopkgtests, and changelog with bug/CVE closures. The armhf/hppa || true swallow of test failures is an explicit, changelog-documented temporary measure, not an error here.

Issues

1. [blocker] [licensing] tests/mock-pkcs11.c declared LGPL-2+ but is Apache-2.0

  • Files: tests/mock-pkcs11.c, debian/copyright
  • Basis: checked, in the package or with a reference tool
  • Evidence: tests/mock-pkcs11.c:2-5: Copyright 2011-2016 The Pkcs11Interop Project / Copyright 2019 Igalia S.L. / Licensed under the Apache License, Version 2.0. debian/copyright has no stanza for this file, so it is covered by Files: * ... License: LGPL-2+, and 'The Pkcs11Interop Project' is not named as a holder.
  • Problem: debian/copyright must accurately state the licence and holders of every source file (Policy 12.5, copyright-format). The file is Apache-2.0, not LGPL-2+, and the Pkcs11Interop Project holder is missing. Apache-2.0 is DFSG-free, so this is an accuracy defect, not a compliance one.
  • Fix: Add a Files: tests/mock-pkcs11.c stanza with Copyright: 2011-2016 The Pkcs11Interop Project and 2019 Igalia S.L. and License: Apache-2.0, plus a stand-alone License: Apache-2.0 paragraph pointing at /usr/share/common-licenses/Apache-2.0.

Verified

  • tests/compressed-data/compressed.br, compressed.zst, corrupt.br are test payloads for the decompressor tests; the plain-text source (uncompressed.txt) is in the same directory, so preferred form exists.
  • tests/resources/mbox.gz, mbox.raw, mbox.zlib are gzip/zlib variants of the plain-text mbox fixture present alongside; content-sniffer/decompression test data.
  • tests/resources/test.aiff and test.webm are media fixtures for content-type sniffer tests (test.wav/test.ogg/test.mp4 analogous); no licence or provenance problem.
  • libsoup/soup-message-headers.c:829,931 'You may not modify the headers while iterating' are API documentation describing mutability rules for the iterator callback, not a licence restriction.
  • tests/pkcs11/pkcs11.h and pkcs11t.h carry the MPL-2.0 header plus the RSA-Other licence text, matching the tests/pkcs11/* stanza (MPL-2.0 or RSA-Other) in debian/copyright.
  • fuzzing/fuzz_headers_parse_request.c and fuzz_headers_parse_response.c (2025 Philip Withnall) carry SPDX-License-Identifier: LGPL-2.1-or-later, matching their Files: stanzas.
  • soup-websocket-extension.[ch] (2019 Igalia S.L., 'GNU Library General Public License ... version 2 ... any later version') are correctly LGPL-2+ under the catch-all.
  • get_apache_modules_dirs.py is Expat and matched by the Files: get_apache_modules_dirs.py stanza with a full stand-alone Expat License paragraph.
  • Sampled licence markers across libsoup/, fuzzing/, tests/, po/ (SPDX LGPL-2.0-or-later / LGPL-2.1-or-later, po 'same license as the libsoup package'): all consistent with the declared LGPL-2+/LGPL-2.1+ terms.
  • debian/copyright is DEP-5 machine-readable with a correct Format: line; all licences used have full text or common-licenses references except Apache-2.0, which is absent because mock-pkcs11.c is mis-stanza'd.
  • Packaging: compat 14, dh $@ with override_dh_auto_configure/test-arch/fixperms/gnome, Build-Depends correctly split with <!nocheck>/<!noinsttest> profiles, autopkgtests (installed-tests, flaky, libsoup-3.0-dev), all patches have DEP-3 headers, changelog version scheme and closures sane.
  • Standards-Version 4.7.4 matches current Policy 4.7.4.1 (first two components current).
  • Found no built artifacts whose source is absent from the tree; no embedded third-party library copies.
  • uscan found the packaged version as the newest upstream release (upstream 3.8.0, packaged 3.8.0).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (LGPL-2.1, MPL-2.0).

Not confirmed

  • Could not build or run the package to confirm test outcomes or symbol correctness; not attempted, as this is out of scope.

Proposed changes

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 2 hours ago, started 2 hours ago, completed 2 hours ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Back to Dashboard | View all reviews for this package