DFSG NEW review for libstructures version 0.0~git20260612.391e4f7-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every source file in the tree (13 .cpp/.hpp sources plus CMakeLists.txt, Makefile, README, LICENSE, debian/*) is licensed under Apache-2.0, carried either by the Apache boilerplate header in each source file or by the top-level LICENSE file (full Apache-2.0 text). No DFSG problems: no non-commercial/no-modification/field-of-use terms, no unlicensed files, no built/minified/binary artifacts, no embedded third-party code, no fonts/images/data of unclear provenance. debian/copyright is DEP-5 machine-readable (Format URL correct), with a catch-all Files: * stanza and a debian/* stanza, referencing /usr/share/common-licenses/Apache-2.0. The prescan's author check confirmed every holder found in the tree (Jordan Eizenga, Adam Novak, the structures contributors) is named in debian/copyright. I sampled all source files and read every one's header and the LICENSE in full.

Packaging

Clean, conventional packaging for a small C++ shared library. compat 14, hardening=+all, dh with the cmake build system, multiarch libdir, soname patch (SOVERSION 1 → libstructures1) and no-install-rpath patch both well-formed DEP-3 patches. d-shlibmove in execute_after_dh_install correctly separates runtime library from -dev (headers, dev symlink, static lib). No .install files is intentional under the Debian Med d-shlibmove recipe (dh_install leaves debian/tmp alone for multi-binary packages with no install files, and d-shlibmove claims the files). libstructures1/libstructures-dev split is correct with Multi-Arch: same and the dev→runtime (= ${binary:Version}) dependency. override_dh_auto_test runs the upstream test binary from the correct build dir and gates on nocheck (redundant at compat 14 but harmless). autopkgtest (debian/tests/smoke) is a real compile-and-link smoke test. Standards-Version 4.7.4 is current (4.7.x). Vcs-*, salsa-ci.yml, changelog with bug closure all present. No issues.

Issues

None.

Verified

• All 13 source files (src/.cpp and src/include/structures/.hpp) carry the Apache-2.0 ASF boilerplate header; top-level LICENSE is the full Apache-2.0 text.
• debian/copyright is DEP-5; Files: * (Apache-2.0, holders Eizenga/Novak/contributors) and Files: debian/* (Tille) both covered; License paragraph references /usr/share/common-licenses/Apache-2.0 correctly.
• Prescan author check: every holder found in the tree is named in debian/copyright; no built files and no non-free/licence wording flagged by the prescan to account for.
• Package is pure source (headers, .cpp/.c… .cpp/.cpp, CMake, Makefile, README, LICENSE, debian/*); no binaries, images, fonts, or vendored code anywhere in the tree (excluding .pc/).
• soname.patch adds VERSION 1.0.0/SOVERSION 1 → libstructures.so.1 matches package name libstructures1; no-install-rpath.patch removes the shared-lib INSTALL_RPATH (test executable's own INSTALL_RPATH left, harmless as it is not installed).
• debian/rules: correct ./obj-$(DEB_HOST_GNU_TYPE)/test build-dir path for the cmake buildsystem; d-shlibmove recipe is the standard Debian Med pattern.
• Build-Depends (debhelper-compat 14, cmake, d-shlibs) and package dependencies are appropriate; substvars present in both binary packages.
• d-shlibmove's exact handling of the static .a into the -dev package could not be inspected (no manual/source on the reviewing system), but it is the standard, widely-used Debian Med recipe for this C++ split.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20260612.391e4f7, packaged 0.0~git20260612.391e4f7).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Whether the upstream test binary actually passes at build time (cannot build/run here); it exercises the packaged shared library via override_dh_auto_test.
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: read: "libstructures-0.0~git20260612.391e4f7/.pc/../../CMakeLists.txt" is not a file of the package or of the reviewing system.

Proposed changes

None.