DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: libsoup 3.8.0-5

Package Information

DescriptionHTTP library implementation in C -- Development files

It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

libsoup uses the Glib main loop and is designed to work well with GTK+ applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the GTK+ programming model (a synchronous operation mode is also supported for those who want it).

Features: * Both asynchronous (GMainLoop and callback-based) and synchronous APIs * Automatically caches connections * SSL Support using GnuTLS * Proxy support, including authentication and SSL tunneling * Client support for Digest, NTLM, and Basic authentication * Server support for Digest and Basic authentication * Basic client-side SOAP support

This package contains the development files.

MaintainerDebian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed ByJeremy Bícha <jbicha@ubuntu.com>
Sponsorjbicha@debian.org
Distributionunstable
Architectureany all
VCSgit: https://salsa.debian.org/gnome-team/libsoup3.git (browse)
Trackerhttps://tracker.debian.org/pkg/libsoup
Uploaded17 days ago

New Package Report

.changes◂
Sourcelibsoup
Version3.8.0-5
Changed-ByJeremy Bícha <jbicha@ubuntu.com>
Architecturesource amd64
Distributionunstable
DateWed, 21 Oct 2026 18:07:51 +0200
Changelog◂
libsoup (3.8.0-5) unstable; urgency=medium
 .
   * Rename source package and -dev package to remove version number
   * debian/watch: Convert to Version: 5
   * Update debian/copyright
   * Update debian/copyright again per initial DFSG review
.dsc◂
Priorityoptional
Componentmain
Package-Listgir1.2-soup-3.0 deb introspection optional arch=any
libsoup-3.0-0 deb libs optional arch=any
libsoup-3.0-common deb devel optional arch=all
libsoup-3.0-dev deb oldlibs optional arch=all
libsoup-3.0-doc deb doc optional arch=all
libsoup-3.0-tests deb misc optional arch=any profile=!noinsttest profile:v1=!noinsttest
libsoup-dev deb libdevel optional arch=any
Sectionintrospection
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://download.gnome.org/sources/libsoup/
Upstream-Name: libsoup
License: LGPL-2.1+

Files: *
Copyright:
 1999-2003 Ximian, Inc.
 2001-2007 Novell, Inc.
 2007 OpenedHand Ltd.
 2007-2016 Red Hat, Inc.
 2008 Diego Escalante Urrelo
 2009-2013 Guido Guenther
 2009-2013 Gustavo Noronha Silva
 2009-2015 Collabora Ltd.
 2009-2022, 2025-2026 Igalia, S.L.
 2012 Nokia Corporation
 2012-2018 Canonical Ltd.
 2012-2019 Free Software Foundation, Inc.
 2015 GNOME i18n Project for Vietnamese
 2017-2018 Metrological Group B.V.
 2018 Rosetta Contributors
 2018-2019 Simon McVittie
License: LGPL-2+

Files: fuzzing/fuzz_headers_parse_request.c
 fuzzing/fuzz_headers_parse_response.c
Copyright: 2025 Philip Withnall
License: LGPL-2.1+

Files: get_apache_modules_dirs.py
Copyright:
 2017-2018 Tomas Popela
License: Expat

Files: libsoup/http2/soup-body-input-stream-http2.c
Copyright: 2006-2007 Red Hat, Inc.
 2021 Igalia S.L.
License: LGPL-2.1+

Files: libsoup/websocket/soup-websocket-connection.*
 libsoup/websocket/soup-websocket.*
 tests/websocket-test.c
Copyright: 2013-2014 Red Hat, Inc.
License: LGPL-2.1+

Files: libsoup/websocket/soup-websocket-connection-private.h
 tests/ws-test-helper.c
Copyright: 2024 Axis Communications AB, SWEDEN
License: LGPL-2.1+

Files: po/*
Copyright: 2012-2014, 2024 A S Alam <aalam@users.sf.net>
 2022 Alexander Shopov
 2012-2013, 2016 Free Software Foundation, Inc
 2012-2013 libsoup
 2026 libsoup's authors
 2012 libsoup's to Swecha Telugu localisation Team <localization@swecha.net>
 2018 Rosetta Contributors and Canonical Ltd 2018
License: LGPL-2.1+

Files: tests/mock-pkcs11.c
Copyright: 2011-2016 The Pkcs11Interop Project
 2019 Igalia S.L.
License: Apache-2.0

Files: tests/pkcs11/*
Copyright: 1994-1999 RSA Security Inc. Licence to copy this document
License: MPL-2.0 or RSA-Other

License: Apache-2.0
 On Debian systems, the complete text of the Apache License version
 2.0 can be found in the file `/usr/share/common-licenses/Apache-2.0'.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
 "Software"), to deal in the Software without restriction, including
 without limitation the rights to use, copy, modify, merge, publish,
 distribute, sublicense, and/or sell copies of the Software, and to
 permit persons to whom the Software is furnished to do so, subject to
 the following conditions:
 .
 The above copyright notice and this permission notice shall be included
 in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

License: LGPL-2+
 This library is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 2 of the License, or (at your option) any later version.

License: LGPL-2.1+
 This library is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 2.1 of the License, or (at your option) any later version.
 .
 On Debian systems, the complete text of the GNU Lesser General
 Public License can be found in `/usr/share/common-licenses/LGPL-2.1'.

License: MPL-2.0
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
 file, You can obtain one at http://mozilla.org/MPL/2.0/.
Comment:
 On Debian systems a copy of the MPLv2.0 can be found in
 /usr/share/common-licenses/MPL-2.0

License: RSA-Other
 License to copy and use this software is granted provided that it is
 identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
 (Cryptoki)" in all material mentioning or referencing this software.
 .
 License is also granted to make and use derivative works provided that
 such works are identified as "derived from the RSA Security Inc. PKCS #11
 Cryptographic Token Interface (Cryptoki)" in all material mentioning or
 referencing the derived work.
 .
 RSA Security Inc. makes no representations concerning either the
 merchantability of this software or the suitability of this software for
 any particular purpose. It is provided "as is" without express or implied
 warranty of any kind.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 17 days ago.

Report◂

DFSG NEW review for libsoup version 3.8.0-5

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 0 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 10 found

Licensing

debian/copyright is in DEP-5 machine-readable format and accurately describes the tree. The catch-all Files: * stanza (LGPL-2+) covers the bulk of libsoup, whose files carry LGPL-2.0-or-later SPDX headers (COPYING is the LGPL-2.0 text); an LGPL-2+ label is the correct union for a tree of LGPL-2.0+ and LGPL-2.1+ files. The genuinely LGPL-2.1+ files (websocket, http2 body-stream, fuzzers) and the Apache-2.0/Expat/MPL+RSA files each have a dedicated stanza with the right holders and versions, confirmed against the actual headers. All licences are DFSG-free and combinable. The whole-tree scan found no unlicensed, non-free, or built-without-source files.

Packaging

Well-maintained GNOME-team packaging, compat 14 with plain dh $@, hardening=+all and explicit LDFLAGS, correct Build-Profiles and nocheck/noinsttest marking on build-test dependencies, a sane package split with correct Multi-Arch, lockstep shlibs.local, a symbols file, proper transitional/Replaces handling for the -dev rename, and meaningful autopkgtests. Standards-Version 4.7.4 matches current Policy 4.7.4.1. Patches all have clear purpose and provenance. No policy violations or upgrade risks found.

Issues

None.

Verified ◂
  • debian/copyright is DEP-5 (Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/); every Files stanza, holder and License short name checked against headers.
  • Main libsoup sources carry LGPL-2.0-or-later SPDX (e.g. soup-uri-utils.c, soup-brotli-decompressor.c, soup-zstd-decompressor.c, tests/*); COPYING is the LGPL-2.0 text; catch-all Files: * = LGPL-2+ is correct.
  • websocket (soup-websocket-connection.c, soup-websocket.c), http2 (soup-body-input-stream-http2.c), tests/websocket-test.c and fuzzing/*.c all carry LGPL-2.1+ headers and match their dedicated LGPL-2.1+ stanzas; soup-websocket-connection-private.h is 2024 Axis Communications AB as declared.
  • tests/mock-pkcs11.c header matches the Apache-2.0 stanza (Copyright 2011-2016 The Pkcs11Interop Project, 2019 Igalia).
  • tests/pkcs11/pkcs11.h/pkcs11t.h carry the dual MPL-2.0 + RSA Security Inc. notice; the 'MPL-2.0 or RSA-Other' stanza and reproduced RSA-Other text match. Both licences are free.
  • get_apache_modules_dirs.py is Expat (MATCH) as the copyright stanza says.
  • tests/compressed-data/compressed.zst and tests/resources/mbox.gz are compressed test fixtures (zstd/gzip), listed in tests/meson.build and tests/soup-tests.gresource.xml and fed to the decompressor tests; not built artefacts, source kept upstream in git; not an issue.
  • tests/compressed-data/compressed.br (brotli) and tests/compressed-data/corrupt.br (deliberately corrupted brotli input for the error path) are decoder-test fixtures referenced by tests/meson.build; not an issue.
  • tests/resources/mbox.raw is a raw mbox file used by the gunzip/mime sniffing tests (tests/soup-tests.gresource.xml); test data, not an issue.
  • tests/resources/mbox.zlib is a zlib-compressed mbox used by decompression tests (tests/soup-tests.gresource.xml); test data, not an issue.
  • tests/resources/test.aiff (audio/aiff) and tests/resources/test.webm (video/webm) are media files referenced by the sniffing tests (tests/sniffing-test.c:536,542, tests/soup-tests.gresource.xml); test data, not an issue.
  • Prescan 'You may not modify' hits in libsoup/soup-message-headers.c:829,931 are API documentation about not mutating headers during iteration, not licence terms.
  • Whole-tree grep for Copyright/licence found only the holders already named in debian/copyright (dfsg-author-check: 400 files scanned, every holder named).
  • Read debian/control, rules, changelog (all entries), copyright, patches/series and all 7 patches, tests/{control,build,installed-tests,flaky,libsoup-3.0-dev}, source/format, upstream/metadata, gbp.conf, shlibs.local, and all .install/.links/.docs/.doc-base/.examples/lintian-overrides.
  • Build-Depends mark test-only deps (apache2, ca-certificates, curl, php, libapache2-mod-php) as <!nocheck> <!noinsttest>; at compat 13+ dh skips the override_dh_auto_test-arch under nocheck, so this is correct.
  • Compat 14: relationship substvars absent from debian/control (${shlibs:Depends}, ${gir:Depends}) are supplied automatically by dh_gencontrol, so libsoup-3.0-0's listed Depends is not missing dependencies (the installed libsoup-3.0-0 report shows the shlibs deps).
  • Patches have clear purpose and provenance (From/Subject/Bug), e.g. skip-tls_interaction-test, Record-Apache-error-log, tests-remove-syntax-no-longer-accepted-with-Apache-2.4.69, Revert-logger-test-change; none obsolete.
  • libsoup-3.0-0 already in the archive; new libsoup-dev is a rename (libsoup-dev in NEW, Breaks/Replaces libsoup-3.0-dev << 3.8.0-4~) with libsoup-3.0-dev kept as transitional.
  • debhelper-compat (= 14), hardening=+all, -Wl,-O1 -Wl,-z,defs, DPKG_GENSYMBOLS_CHECK_LEVEL=4 set in rules.
  • Standards-Version 4.7.4 equals current Policy 4.7.4.1 (first two components 4.7), so not an issue.
  • uscan found the packaged version as the newest upstream release (upstream 3.8.0, packaged 3.8.0).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, LGPL-2.1, MPL-2.0).
Not confirmed ◂

None.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 17 days ago.

Review Information

accepted — allocated to awm 15 days ago, started 15 days ago, completed 15 days ago.

Final Comment

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
3.8.0-4 e6d6be31… 2026-10-21 16:09 2026-10-21 16:09 dfsg-uploader rejected VIEW

Back to Dashboard | View all reviews for this package