Review: libvgio 0.0~git20261016.54490c2-1
Package Information
| Description | library for reading and writing vg file formats libvgio implements reading and writing of the file formats used by the vg toolkit for sequence variation graphs and read alignments, including protobuf-encoded and BGZF-compressed streams. This package contains the shared library. |
|---|---|
| Maintainer | Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org> |
| Changed By | Andreas Tille <tille@debian.org> |
| Sponsor | tille@debian.org |
| Distribution | unstable |
| Architecture | any |
| VCS | git: https://salsa.debian.org/med-team/libvgio.git (browse) |
| Closes | #1152536 |
| Tracker | https://tracker.debian.org/pkg/libvgio |
| Uploaded | 4 hours ago |
New Package Report
.changes
| Version | 0.0~git20261016.54490c2-1 |
|---|---|
| Changed-By | Andreas Tille <tille@debian.org> |
| Architecture | source amd64 |
| Distribution | unstable |
| Date | Fri, 30 Oct 2026 12:09:18 +0100 |
| Source | libvgio |
Changelog
libvgio (0.0~git20261016.54490c2-1) unstable; urgency=medium . * Initial release (Closes: #1152536).
.dsc
| Component | main |
|---|---|
| Package-List | libvgio-dev deb libdevel optional arch=any libvgio0 deb libs optional arch=any |
| Section | libdevel |
| Priority | optional |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: libvgio
Source: https://github.com/vgteam/libvgio
Files: *
Copyright: 2014 Erik Garrison
vg contributors
License: LGPL-3+
Files: src/json2pb.cpp
src/bin2ascii.h
include/vg/io/json2pb.h
Copyright: 2013 Pavel Shramov <shramov@mexmat.net>
2009-2014 Petri Lehtinen <petri@digip.org>
License: MIT
Files: include/vg/io/fdstream.hpp
Copyright: 2001 Nicolai M. Josuttis
License: NTP
Permission to copy, use, modify, sell and distribute this software
is granted provided this copyright notice appears in all copies.
This software is provided "as is" without express or implied
warranty, and with no claim as to its suitability for any purpose.
Files: debian/*
Copyright: 2026 Andreas Tille <tille@debian.org>
License: LGPL-3+
License: LGPL-3+
This program is free software: you can redistribute it and/or modify it
under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation, either version 3 of the License, or (at
your option) any later version.
.
On Debian systems, the complete text of the GNU Lesser General Public
License version 3 can be found in "/usr/share/common-licenses/LGPL-3".
License: MIT
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
.
The above copyright notice and this permission notice shall be included
in all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
DFSG Assistant LLM REVIEW 1 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 3 hours ago.
Report
DFSG NEW review for libvgio version 0.0~git20261016.54490c2-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 1 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
The tree is free and all four licence families present (LGPL, MIT/Expat, NTP/HPND) are DFSG-compliant and mutually compatible, and the file-level notices for json2pb/bin2ascii, fdstream.hpp and the Petri Lehtinen macro are all covered by matching stanzas. debian/copyright is DEP-5 and mostly accurate, but it declares LGPL-3+ for the package while upstream's LICENSE grants LGPL version 3 only, with no 'or any later version' permission; the '+' and the corresponding sentence in the stand-alone stanza overstate the grant. Fixing that licence short name makes the file accurate.
Packaging
Standard debhelper 14 CMake packaging with a single DEP-3 patch, d-shlibs-based library/dev split, correct Multi-Arch and ${binary:Version} dependency, working autopkgtest that compiles and runs the shipped example, current Standards-Version, and Vcs-*/Homepage/upstream metadata present. All Build-Depends resolve to existing packages; no packaging faults worth reporting.
Issues
blocker licensing 1. debian/copyright declares LGPL-3+ but upstream LICENSE grants LGPL-3 only ◂
- Files:
debian/copyright:8,debian/copyright:29,debian/copyright:31-36,LICENSE:1 - Basis: checked, in the package or with a reference tool
- Evidence: LICENSE:1
libvgio is licensed to you under the GNU LGPL version 3, given below.versus debian/copyrightLicense: LGPL-3+andunder the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. - Problem: copyright-format 7.1: the
+suffix is only for a grant that permits using the terms of any later version; upstream specifies version 3 and grants no such permission (verified by grepping the whole tree for 'later version' — it appears only inside the quoted LGPL text). The stand-aloneLicense: LGPL-3+stanza therefore asserts a permission the copyright holders never gave and misstates the licence version, which is exactly what copyright-format 6.7/7.1 require to be represented accurately. - Fix: Change the two
License: LGPL-3+fields toLGPL-3and reword the stand-alone stanza to the plain LGPL-3 grant (This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3.), keeping the /usr/share/common-licenses/LGPL-3 pointer.
Verified ◂
- Read all of debian/ (changelog, control, copyright, rules, patches/series, install-paths-and-soname.patch, source/format, tests/control, tests/run-unit-test, libvgio-dev.examples, upstream/metadata, salsa-ci.yml) except debian/watch.
- Inventoried all 44 upstream files; grepped the whole tree (gitignore false) for Copyright/(C)/©/SPDX/Licensed under/Permission is hereby granted/GNU General Public/Lesser/Apache/Mozilla/public domain/All rights reserved and for 'later version'.
- LICENSE is LGPL-3 text plus the vg-project MIT (Expat) grant (Copyright (c) 2014 Erik Garrison) and the Nicolai M. Josuttis fdstream grant; both are reproduced in debian/copyright, and the NTP text there matches include/vg/io/fdstream.hpp:14-19.
- src/json2pb.cpp:13 — the prescan's Petri Lehtinen holder: the line is
// Copyright (c) 2009-2014 Petri Lehtinen <petri@digip.org>, distributed under // the MIT licensefor a jansson backport macro; debian/copyright'sFiles: src/json2pb.cpp src/bin2ascii.h include/vg/io/json2pb.hstanza names both Pavel Shramov and Petri Lehtinen under MIT. Not an issue. - include/vg/io/json2pb.h:2, src/bin2ascii.h:2, src/json2pb.cpp:2 — MIT headers match the MIT stanza; include/vg/io/fdstream.hpp matches the NTP stanza.
- deps/libhandlegraph/ is an empty git submodule directory (only .gitmodules entry); debian/rules builds with -DUSE_INSTALLED_LIBHANDLEGRAPH_ONLY=ON, so no submodule source is used and nothing unlicensed is shipped.
- deps/vg.proto is the only proto input; vg.pb.h/vg.pb.cc are generated by protoc at build time from it, so no generated code ships without its input. No built, minified, binary or PDF files in the tree.
- Checked Build-Depends against the archive: libhandlegraph-dev 20261019.3d8c3c9-1, libhts-dev 1.24-3 (pulling libdeflate-dev, libbz2-dev, liblzma-dev), libhtscodecs-dev 1.6.7-1 and d-shlibs 0.111 all exist.
- Standards-Version 4.7.4 against Policy 4.7.4.1: first two components equal, current.
- rules: debhelper-compat 14, hardening=+all, cmake buildsystem; override_dh_auto_test builds and runs test_libvgio (dh 13+ skips it under nocheck, no in-target check needed); test binary path obj-$(DEB_HOST_GNU_TYPE) matches dh's cmake build directory.
- d-shlibmove --commit/--multiarch/--devunversioned with the SOVERSION 0 added by the patch yields libvgio.so.0 in libvgio0 and the unversioned symlink, static lib, headers and CMake config in libvgio-dev; libvgio-dev depends on libvgio0 (= ${binary:Version}) and on the libraries its public headers and CMake config need.
- autopkgtest: debian/tests/control (Depends: @, build-essential; allow-stderr) plus run-unit-test compiling the shipped test.cpp against libvgio-dev cover the binary end to end.
- uscan found the packaged version as the newest upstream release (upstream
0.0~git20261016.54490c2, packaged0.0~git20261016.54490c2). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (LGPL-3).
Not confirmed ◂
- Could not run d-shlibmove (no man page installed) to confirm it moves the static libvgio.a; the build is assumed to succeed as stated.
- Did not compare the unpacked tree with the .dsc/orig tarball file by file.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader rejected this upload in response to the review.
Review Information
rejected — allocated to dfsg-uploader 2 hours ago, started 2 hours ago, completed 2 hours ago.
Final Comment
The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.
The uploader said:
Will fix the license statement