DFSG NEW review for libsparsepp version 1.23-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The licences combined here (BSD-3-clause, BSL-1.0 and MIT/Expat) are all DFSG-free, and no restrictive or non-free wording appears anywhere in the tree. debian/copyright is DEP-5 and matches every file except sparsepp/spp_utils.h, which states that part of its code is derived from Boost and reproduces the Boost Software License, yet is recorded only under the Files: * BSD-3-clause stanza; the BSL-1.0 terms applying to that file are missing. Everything else (spp.h, spp_config.h, spp_timer.h, spp_test.cc, the notice-less examples/tests/build files, the public-domain dlmalloc adaptation) is described correctly.

Packaging

The packaging is clean and current: debhelper compat 14 with the single-binary addon explicitly named via dh-sequence-single-binary, a correct Architecture: all / Multi-Arch: foreign header package, a DEP-3 patch, an autopkgtest that builds and runs the shipped examples against the installed headers, and a build-time test loop that skips only the two documented exceptions. Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1. No policy violation, missing dependency or upgrade problem found.

Issues

1. [blocker] [licensing] Files: * gives only BSD-3-clause for sparsepp/spp_utils.h, whose Boost-derived code is under BSL-1.0

• Files: sparsepp/spp_utils.h:1-56, debian/copyright:5-8
• Basis: checked, in the package or with a reference tool
• Evidence: sparsepp/spp_utils.h:5-6: // Code derived derived from Boost libraries. / // Boost software licence reproduced below., followed by the BSL text at :36 // Boost Software License - Version 1.0 - August 17th, 2003. debian/copyright has only Files: * ... License: BSD-3-clause, while Files: sparsepp/spp_config.h is given License: BSL-1.0 for exactly the same situation.
• Problem: The file carries two grants: the 3-clause BSD grant for Steven Gregory Popovitch's code and the Boost Software License for the portions derived from Boost. Policy 12.5 requires the copyright file to carry the distribution licence(s) of the package and to describe each file's terms; BSL-1.0 is not recorded for this file, so debian/copyright is inaccurate and incomplete for it (and inconsistent with its own treatment of spp_config.h).
• Fix: Add a stanza for the file, e.g. Files: sparsepp/spp_utils.h with Copyright: 2016 Steven Gregory Popovitch <greg7mdp@gmail.com> and License: BSD-3-clause and BSL-1.0 pointing at /usr/share/common-licenses/BSL-1.0, or make the Files: * licence BSD-3-clause and BSL-1.0.

Verified

• Read all of debian/ in full (control, rules, changelog, copyright, *.install/docs/examples, source/format, tests/control, tests/run-unit-test, patches/series and the patch, README.test, salsa-ci.yml, lrc.config) and every upstream text file; the tree contains no binaries, fonts, images, generated code or minified files.
• Prescan finding accounted for: the holder in sparsepp/spp_utils.h:2, Steven Gregory Popovitch - greg7mdp@gmail.com, is the same person as Gregory Popovitch <greg7mdp@gmail.com> in debian/copyright:6 (identical address), so no additional holder needs naming.
• sparsepp/spp_dlalloc.h:4 is a C++ allocator created from Doug Lea's dlmalloc (Version 2.8.6 ...). dlmalloc is released to the public domain and imposes no notice, so the file's description as BSD-3-clause (LICENSE plus Files: *) is not a DFSG problem and needs no separate stanza; a Comment crediting dlmalloc would only be an improvement.
• Other notices match debian/copyright: LICENSE and sparsepp/spp.h (© 2016 Popovitch, © 2005 Google, BSD-3), tests/spp_test.cc (© 2016 Popovitch, © 2010 Google — year drift only), sparsepp/spp_config.h (BSL-1.0 text; the pointer /usr/share/common-licenses/BSL-1.0 was verified to exist), sparsepp/spp_timer.h (Expat, text matches the stanza).
• No non-free or restrictive terms: a case-insensitive grep for GPL, non-commercial, no-modification, field-of-use, research-only, public-domain and SPDX wording across the upstream tree returned nothing restrictive.
• Files with no notice at all (examples/.cc, tests/spp_alloc_test.cc, tests/perftest1.cc, tests/spp_relative_include_test.cc, both makefiles, README.md, bench.md, CHANGELOG.md, spp.natvis, conanfile.py, test_package/, .travis.yml, .github/FUNDING.yml, docs/.gitignore, the vsprojects project files) are part of the upstream work and covered by its LICENSE, which the Files: * stanza describes.
• tests/spp_bitset_test.cc includes <sparsepp/spp_bitset.h>, which is genuinely absent from libsparsepp_1.23.orig.tar.gz (tarball listing checked), as README.test states; the test is also excluded from the installed examples by the -X spp_bitset_test in debian/rules.
• The orig tarball is a git snapshot (greg7mdp-sparsepp-0d0b7a4) whose content is exactly the unpacked upstream tree; nothing was removed, so no Files-Excluded is required.
• Packaging facts checked: dh-sequence-single-binary is a virtual package provided by debhelper 14.5 (apt-cache), which is the explicit way to keep the single-binary addon at compat 15; Standards-Version 4.7.4 has the same first two components as Policy 4.7.4.1; Multi-Arch: foreign on an arch:all header package matches the existing libsparsehash-dev; the Debian Med maintainer address is the one other Debian Med packages use (apt-cache python3-biopython).
• The patch has DEP-3 headers (Description, Author, Forwarded, Last-Update) and touches only two example files, making them match examples/makefile's -std=c++11; nothing else is patched.
• debian/rules' override_dh_auto_test compiles and runs every shipped example and test except tests/perftest1.cc and tests/spp_bitset_test.cc, both explained in README.test; at compat 13+ dh itself skips that override under DEB_BUILD_OPTIONS=nocheck, so no in-target check is needed.
• dh_installexamples with -X keeps tests as a subdirectory (the cp --parents path in /usr/bin/dh_installexamples), which is the layout debian/tests/run-unit-test expects; the autopkgtest builds from /usr/share/doc/libsparsepp-dev/examples, using /usr/include for <sparsepp/spp.h> and the symlink for the ../sparsepp/spp.h relative include.
• debian/lrc.config (single line sparsepp/spp_utils.h) is an unused licence-review helper configuration: debian/rules does not reference it and it is not installed in any package, so it has no effect on the build or binary; it could be dropped as dead weight.
• Coverage: debian/ read exhaustively; all nine sparsepp/ headers read at their head and grepped whole; LICENSE, README.md, CHANGELOG.md, conanfile.py, .travis.yml, spp.natvis, both makefiles and the patch read; bench.md grepped only; the vsprojects XML files were not read (no licence-bearing content expected).
• uscan found the packaged version as the newest upstream release (upstream 1.23, packaged 1.23).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (BSL-1.0).

Not confirmed

• The package was not built and its tests were not run (read-only review); the build-time test loop and the autopkgtest were read, not executed.
• Could not check the bug closure in the changelog (#1152280) without network access.

Proposed changes

None.