DFSG NEW review for libxg version 0.1.0+git20251103.8dd476d-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the exact Format URL, Files: * attributing the upstream code to Erik Garrison under Expat and Files: debian/* to Andreas Tille, with the full Expat/MIT text as a stand-alone paragraph. That matches the single upstream LICENSE (Copyright (c) 2019 Erik Garrison, MIT) and the Expat short name is the correct Debian name for it. The tree ships no third-party code (the eight deps/* submodule directories are empty), no file carries any other copyright or licence notice, no non-free terms appear, and Expat is compatible with the Expat/MIT-licensed libraries it links against.

Packaging

The packaging itself is careful: debhelper compat 14 with a plain dh $@, a SONAME-0 shared library moved to libxg0/libxg-dev by d-shlibmove with the multiarch libdir, two DEP-3 patches that replace the upstream ExternalProject downloads with system packages, a smoke autopkgtest that exercises both the tool and the library API, and a sane initial changelog closing the ITP. Standards-Version 4.7.4 is current against Policy 4.7.4.1. The one defect is a dependency that cannot be satisfied: libgfakluge-dev, named in Build-Depends and in libxg-dev's Depends, is in neither the archive nor NEW, while the patched build requires gfakluge.hpp and the library is built from it.

Issues

1. [minor] [packaging] Build-Depends and libxg-dev Depends name libgfakluge-dev, which exists in neither the archive nor NEW, but the build requires its header

• Files: debian/control:14, debian/control:67, CMakeLists.txt:33, src/xg.cpp:12-13
• Basis: checked, in the package or with a reference tool
• Evidence: debian/control:14 libgfakluge-dev, in Build-Depends and debian/control:67 libgfakluge-dev, in libxg-dev's Depends; CMakeLists.txt:33 find_path(GFAKLUGE_INCLUDE_DIR gfakluge.hpp REQUIRED); src/xg.cpp:12-13 #ifndef NO_GFAKLUGE / #include "gfakluge.hpp" (used at xg.cpp:750 gfak::GFAKluge gfa;). apt-cache: "There is no binary package named libgfakluge-dev in these lists, and nothing provides it. Nor is it a binary of this package or of any upload waiting in the NEW queues (the list on ftp-master.debian.org as of 2026-10-30T10:14:08Z)"; the other nine names in Build-Depends are found.
• Problem: No package in the archive provides gfakluge.hpp and no gfakluge upload is waiting in NEW. cmake configure therefore aborts at the REQUIRED find_path, so the source package cannot be built at all; independently, libxg-dev would be uninstallable because its Depends names the same nonexistent package. The empty deps/gfakluge directory shows no fallback copy is shipped.
• Fix: Have gfakluge (headers and its CMake/Taywee-style install) packaged and accepted first, then keep the dependency; or, if the code can do without it, guard the build with -DNO_GFAKLUGE and drop libgfakluge-dev from libxg-dev's Depends (note that this removes GFA input, i.e. from_gfa). Do not upload while the name resolves to no package.

Verified

• Read debian/copyright in full: DEP-5, exact Format URL, Files: * (2019 Erik Garrison, Expat), Files: debian/* (2026 Andreas Tille, Expat), stand-alone License: Expat with the complete MIT text; this matches LICENSE, which also states the dependencies carry their own licences.
• Tree inventory: CMakeLists.txt, .gitignore, .gitmodules, LICENSE, README.md, src/main.cpp, src/xg.cpp, src/xg.hpp, plus debian/. deps/BBHash, deps/args, deps/atomic_queue, deps/gfakluge, deps/ips4o, deps/libhandlegraph, deps/mmmulti and deps/sdsl-lite are empty directories (checked individually), so the eight projects named in .gitmodules are not shipped and need no copyright stanza.
• Searched src/, README.md, CMakeLists.txt and .gitignore for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Apache/MPL/public domain/All rights reserved: no statement beyond LICENSE, so Files: * naming only Erik Garrison is accurate (the README describes the code as a fork of vg's XG index, which is also his MIT code).
• No built artefacts, minified code, PDFs, images, fonts or generated sources exist in the tree; src/ is three hand-written files. The prescan's author check found every holder it saw named in debian/copyright.
• Both patches are DEP-3 (Description, Author, Last-Update) and applied in series order: the tree's CMakeLists.txt contains both the system-dependency rewrite and the static-library target, and it no longer references ExternalProject or the deps/ submodules.
• debian/control: debhelper-compat (= 14), whole dh $@, d-shlibmove run in execute_after_dh_install on debian/tmp/usr/lib/*/*.so with --multiarch --devunversioned, library with SONAME libxg.so.0 shipped in libxg0, both library packages Multi-Arch: same, libxg-dev depends on libxg0 (= ${binary:Version}); debian/xg.install ships only usr/bin/xg.
• All Build-Depends other than libgfakluge-dev resolve: libargs-dev 6.4.1-1, libatomic-queue-dev 1.9.4-1, libdivsufsort-dev 2.0.1-7+b1, libhandlegraph-dev 20261019.3d8c3c9-1, libips4o-dev 0.0+git20190618.2206938-2, libmio-dev 1.1.0~git20230303.8b6b7d8-1, libmmmulti-dev 0.1-5, libsdsl-dev 2.4+dfsg-1 (satisfies >= 2.4), d-shlibs 0.111; libxg-dev's >= 2024-11-22-2 on libhandlegraph-dev is satisfied by 20261019.3d8c3c9-1.
• Standards-Version 4.7.4 against Policy 4.7.4.1 matches in its first two components, so it is current; changelog is an initial unstable upload closing #1152520 with a valid date and version scheme; source format is 3.0 (quilt).
• debian/tests/control runs Tests: smoke with Depends: @, g++, libdivsufsort-dev and allow-stderr; the script compiles smoke.cpp against <xg/xg.hpp> and links -lxg, then exercises xg -g/-o and xg -i/-G; the API it uses (from_gfa, get_node_count, serialize/deserialize) exists in src/xg.hpp (from_gfa at line 221, serialize/deserialize inherited from SerializableHandleGraph).
• Ignored .pc/ as instructed; no debian/cargo-checksum.json present.
• uscan found the packaged version as the newest upstream release (upstream 0.1.0+git20251103.8dd476d, packaged 0.1.0+git20251103.8dd476d).

Not confirmed

• The premise of debian/patches/use-static-lib.patch, that d-shlibmove aborts with "static library is missing" unless a libxg.a exists next to libxg.so, could not be checked: d-shlibs is not installed on the reviewing system and there is no d-shlibmove manual page there, so the exact d-shlibmove behaviour (and hence whether the extra static library is necessary) is unverified; if it is not required, the -dev package ships an unneeded libxg.a.
• Whether libgfakluge-dev might have been accepted between the archive-list snapshot and today cannot be excluded from the tool's answer; if such a package exists, the issue above does not apply.

Proposed changes

None.