Review: libsoup 3.8.0-5
Package Information
| Description | HTTP library implementation in C -- Development files It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK+ applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the GTK+ programming model (a synchronous operation mode is also supported for those who want it). Features: * Both asynchronous (GMainLoop and callback-based) and synchronous APIs * Automatically caches connections * SSL Support using GnuTLS * Proxy support, including authentication and SSL tunneling * Client support for Digest, NTLM, and Basic authentication * Server support for Digest and Basic authentication * Basic client-side SOAP support This package contains the development files. |
|---|---|
| Maintainer | Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org> |
| Changed By | Jeremy Bícha <jbicha@ubuntu.com> |
| Sponsor | jbicha@debian.org |
| Distribution | unstable |
| Architecture | any all |
| VCS | git: https://salsa.debian.org/gnome-team/libsoup3.git (browse) |
| Tracker | https://tracker.debian.org/pkg/libsoup |
| Uploaded | 17 days ago |
New Package Report
.changes
| Source | libsoup |
|---|---|
| Version | 3.8.0-5 |
| Changed-By | Jeremy Bícha <jbicha@ubuntu.com> |
| Architecture | source amd64 |
| Distribution | unstable |
| Date | Wed, 21 Oct 2026 18:07:51 +0200 |
Changelog
libsoup (3.8.0-5) unstable; urgency=medium . * Rename source package and -dev package to remove version number * debian/watch: Convert to Version: 5 * Update debian/copyright * Update debian/copyright again per initial DFSG review
.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | gir1.2-soup-3.0 deb introspection optional arch=any libsoup-3.0-0 deb libs optional arch=any libsoup-3.0-common deb devel optional arch=all libsoup-3.0-dev deb oldlibs optional arch=all libsoup-3.0-doc deb doc optional arch=all libsoup-3.0-tests deb misc optional arch=any profile=!noinsttest profile:v1=!noinsttest libsoup-dev deb libdevel optional arch=any |
| Section | introspection |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Source: https://download.gnome.org/sources/libsoup/ Upstream-Name: libsoup License: LGPL-2.1+ Files: * Copyright: 1999-2003 Ximian, Inc. 2001-2007 Novell, Inc. 2007 OpenedHand Ltd. 2007-2016 Red Hat, Inc. 2008 Diego Escalante Urrelo 2009-2013 Guido Guenther 2009-2013 Gustavo Noronha Silva 2009-2015 Collabora Ltd. 2009-2022, 2025-2026 Igalia, S.L. 2012 Nokia Corporation 2012-2018 Canonical Ltd. 2012-2019 Free Software Foundation, Inc. 2015 GNOME i18n Project for Vietnamese 2017-2018 Metrological Group B.V. 2018 Rosetta Contributors 2018-2019 Simon McVittie License: LGPL-2+ Files: fuzzing/fuzz_headers_parse_request.c fuzzing/fuzz_headers_parse_response.c Copyright: 2025 Philip Withnall License: LGPL-2.1+ Files: get_apache_modules_dirs.py Copyright: 2017-2018 Tomas Popela License: Expat Files: libsoup/http2/soup-body-input-stream-http2.c Copyright: 2006-2007 Red Hat, Inc. 2021 Igalia S.L. License: LGPL-2.1+ Files: libsoup/websocket/soup-websocket-connection.* libsoup/websocket/soup-websocket.* tests/websocket-test.c Copyright: 2013-2014 Red Hat, Inc. License: LGPL-2.1+ Files: libsoup/websocket/soup-websocket-connection-private.h tests/ws-test-helper.c Copyright: 2024 Axis Communications AB, SWEDEN License: LGPL-2.1+ Files: po/* Copyright: 2012-2014, 2024 A S Alam <aalam@users.sf.net> 2022 Alexander Shopov 2012-2013, 2016 Free Software Foundation, Inc 2012-2013 libsoup 2026 libsoup's authors 2012 libsoup's to Swecha Telugu localisation Team <localization@swecha.net> 2018 Rosetta Contributors and Canonical Ltd 2018 License: LGPL-2.1+ Files: tests/mock-pkcs11.c Copyright: 2011-2016 The Pkcs11Interop Project 2019 Igalia S.L. License: Apache-2.0 Files: tests/pkcs11/* Copyright: 1994-1999 RSA Security Inc. Licence to copy this document License: MPL-2.0 or RSA-Other License: Apache-2.0 On Debian systems, the complete text of the Apache License version 2.0 can be found in the file `/usr/share/common-licenses/Apache-2.0'. License: Expat Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: . The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. . THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. License: LGPL-2+ This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. License: LGPL-2.1+ This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. . On Debian systems, the complete text of the GNU Lesser General Public License can be found in `/usr/share/common-licenses/LGPL-2.1'. License: MPL-2.0 This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/. Comment: On Debian systems a copy of the MPLv2.0 can be found in /usr/share/common-licenses/MPL-2.0 License: RSA-Other License to copy and use this software is granted provided that it is identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki)" in all material mentioning or referencing this software. . License is also granted to make and use derivative works provided that such works are identified as "derived from the RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki)" in all material mentioning or referencing the derived work. . RSA Security Inc. makes no representations concerning either the merchantability of this software or the suitability of this software for any particular purpose. It is provided "as is" without express or implied warranty of any kind.
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 17 days ago.
Report
DFSG NEW review for libsoup version 3.8.0-5
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 10 found
Licensing
debian/copyright is in DEP-5 machine-readable format and accurately describes the tree. The catch-all Files: * stanza (LGPL-2+) covers the bulk of libsoup, whose files carry LGPL-2.0-or-later SPDX headers (COPYING is the LGPL-2.0 text); an LGPL-2+ label is the correct union for a tree of LGPL-2.0+ and LGPL-2.1+ files. The genuinely LGPL-2.1+ files (websocket, http2 body-stream, fuzzers) and the Apache-2.0/Expat/MPL+RSA files each have a dedicated stanza with the right holders and versions, confirmed against the actual headers. All licences are DFSG-free and combinable. The whole-tree scan found no unlicensed, non-free, or built-without-source files.
Packaging
Well-maintained GNOME-team packaging, compat 14 with plain dh $@, hardening=+all and explicit LDFLAGS, correct Build-Profiles and nocheck/noinsttest marking on build-test dependencies, a sane package split with correct Multi-Arch, lockstep shlibs.local, a symbols file, proper transitional/Replaces handling for the -dev rename, and meaningful autopkgtests. Standards-Version 4.7.4 matches current Policy 4.7.4.1. Patches all have clear purpose and provenance. No policy violations or upgrade risks found.
Issues
None.
Verified ◂
- debian/copyright is DEP-5 (Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/); every Files stanza, holder and License short name checked against headers.
- Main libsoup sources carry LGPL-2.0-or-later SPDX (e.g. soup-uri-utils.c, soup-brotli-decompressor.c, soup-zstd-decompressor.c, tests/*); COPYING is the LGPL-2.0 text; catch-all
Files: *= LGPL-2+ is correct. - websocket (soup-websocket-connection.c, soup-websocket.c), http2 (soup-body-input-stream-http2.c), tests/websocket-test.c and fuzzing/*.c all carry LGPL-2.1+ headers and match their dedicated LGPL-2.1+ stanzas; soup-websocket-connection-private.h is 2024 Axis Communications AB as declared.
- tests/mock-pkcs11.c header matches the Apache-2.0 stanza (Copyright 2011-2016 The Pkcs11Interop Project, 2019 Igalia).
- tests/pkcs11/pkcs11.h/pkcs11t.h carry the dual MPL-2.0 + RSA Security Inc. notice; the 'MPL-2.0 or RSA-Other' stanza and reproduced RSA-Other text match. Both licences are free.
- get_apache_modules_dirs.py is Expat (MATCH) as the copyright stanza says.
- tests/compressed-data/compressed.zst and tests/resources/mbox.gz are compressed test fixtures (zstd/gzip), listed in tests/meson.build and tests/soup-tests.gresource.xml and fed to the decompressor tests; not built artefacts, source kept upstream in git; not an issue.
- tests/compressed-data/compressed.br (brotli) and tests/compressed-data/corrupt.br (deliberately corrupted brotli input for the error path) are decoder-test fixtures referenced by tests/meson.build; not an issue.
- tests/resources/mbox.raw is a raw mbox file used by the gunzip/mime sniffing tests (tests/soup-tests.gresource.xml); test data, not an issue.
- tests/resources/mbox.zlib is a zlib-compressed mbox used by decompression tests (tests/soup-tests.gresource.xml); test data, not an issue.
- tests/resources/test.aiff (audio/aiff) and tests/resources/test.webm (video/webm) are media files referenced by the sniffing tests (tests/sniffing-test.c:536,542, tests/soup-tests.gresource.xml); test data, not an issue.
- Prescan 'You may not modify' hits in libsoup/soup-message-headers.c:829,931 are API documentation about not mutating headers during iteration, not licence terms.
- Whole-tree grep for Copyright/licence found only the holders already named in debian/copyright (dfsg-author-check: 400 files scanned, every holder named).
- Read debian/control, rules, changelog (all entries), copyright, patches/series and all 7 patches, tests/{control,build,installed-tests,flaky,libsoup-3.0-dev}, source/format, upstream/metadata, gbp.conf, shlibs.local, and all .install/.links/.docs/.doc-base/.examples/lintian-overrides.
- Build-Depends mark test-only deps (apache2, ca-certificates, curl, php, libapache2-mod-php) as <!nocheck> <!noinsttest>; at compat 13+ dh skips the override_dh_auto_test-arch under nocheck, so this is correct.
- Compat 14: relationship substvars absent from debian/control (${shlibs:Depends}, ${gir:Depends}) are supplied automatically by dh_gencontrol, so libsoup-3.0-0's listed Depends is not missing dependencies (the installed libsoup-3.0-0 report shows the shlibs deps).
- Patches have clear purpose and provenance (From/Subject/Bug), e.g. skip-tls_interaction-test, Record-Apache-error-log, tests-remove-syntax-no-longer-accepted-with-Apache-2.4.69, Revert-logger-test-change; none obsolete.
- libsoup-3.0-0 already in the archive; new libsoup-dev is a rename (libsoup-dev in NEW, Breaks/Replaces libsoup-3.0-dev << 3.8.0-4~) with libsoup-3.0-dev kept as transitional.
- debhelper-compat (= 14), hardening=+all, -Wl,-O1 -Wl,-z,defs, DPKG_GENSYMBOLS_CHECK_LEVEL=4 set in rules.
- Standards-Version 4.7.4 equals current Policy 4.7.4.1 (first two components 4.7), so not an issue.
- uscan found the packaged version as the newest upstream release (upstream
3.8.0, packaged3.8.0). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0,LGPL-2.1,MPL-2.0).
Not confirmed ◂
None.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader was emailed about the review 17 days ago.
Review Information
accepted — allocated to awm 15 days ago, started 15 days ago, completed 15 days ago.
Final Comment
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 3.8.0-4 | e6d6be31… | 2026-10-21 16:09 | 2026-10-21 16:09 | dfsg-uploader | rejected | VIEW |