DFSG NEW review for lightning-matrix version 0.10.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 2 blocker, 4 important, 3 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 13 found

Licensing

The project's own code is GPL-3+ and all licences in the tree are free and GPL-compatible, but the source package ships two third-party model blobs with no licence grant (DeepFilterNet ONNX weights and RNNoise's generated model tables) while debian/copyright attributes both to MIT/Apache-2.0 and BSD-3-Clause. The DEP-5 file is well structured but inaccurate in several places: it omits the upstream holder Rokas Smetonis, carries no copy of the OFL-1.1 text, lists only five of the rnnoise holders, and its vendor/* stanzas, generated from Cargo.toml metadata, misstate the licences and holders of code bundled inside the crates (notably 8.9 MB of SQLCipher amalgamation claimed as MIT, and DOMPurify under MIT).

Packaging

The packaging is competent: DEP-5 copyright, three DEP-3 patches applied by quilt, correct and satisfiable Build-Depends, Rules-Requires-Root: no, hardening enabled, an autopkgtest, a clean changelog and Vcs-* fields; the binary's relations and every QML import were checked against the archive and are covered. Only minor quality points remain: the ~400-file upstream C++ test suite is switched off and nothing but startup is tested, and SQLite is compiled in from the vendored crate rather than taken from libsqlite3.

Issues

1. [blocker] [licensing] DeepFilterNet ONNX model weights are unlicensed but shipped in the source tarball and attributed to MIT/Apache-2.0

• Files: third_party/deepfilternet/models/DeepFilterNet3_onnx.tar.gz, third_party/deepfilternet/PROVENANCE.md, debian/copyright:73-77
• Basis: checked, in the package or with a reference tool
• Evidence: PROVENANCE.md: **Model weights: NOT explicitly licensed by upstream. Read this before shipping.** and The README's grant names "all code in this repository". The models/ directory carries no licence file. debian/copyright stanza: Files: third_party/deepfilternet/* / License: MIT or Apache-2.0 / Comment: ... The model weights under models/ have no licence of their own upstream.
• Problem: The 7.6 MB archive of ONNX checkpoints is binary data for which upstream has granted nothing; MIT/Apache-2.0 cover the repository's code only. Redistributing it without permission fails DFSG 1, and the Files stanza claims a licence the file does not have. That the tree is not built (-DLIGHTNING_ENABLE_DEEPFILTERNET=OFF) does not make the source package acceptable: the source tarball is what is distributed and reviewed.
• Fix: Remove third_party/deepfilternet from the source tarball (it is dead weight after debian/patches/0002-rust-drop-deepfilternet.patch): repack the orig tarball, add Files-Excluded: third_party/deepfilternet to debian/copyright and note the repack in README.source; or obtain and record upstream's written licence for the weights. Do not claim MIT/Apache for models/ unless a grant is obtained.

2. [blocker] [licensing] RNNoise's generated model tables (27.9 MB rnnoise_data.c/.h) come from an unlicensed tarball but are listed as BSD-3-Clause

• Files: third_party/rnnoise/src/rnnoise_data.c, third_party/rnnoise/src/rnnoise_data.h, third_party/rnnoise/PROVENANCE.md:45-80, debian/copyright:64-70
• Basis: checked, in the package or with a reference tool
• Evidence: PROVENANCE.md: ### Licence of the weights: finding / **Not stated by upstream.** / neither README, COPYING, datasets.txt nor the model tarball (5 members: two .c, two .h, one .pth) carries any licence text / **Verdict: de-facto redistributable together with the library, NOT explicitly licensed.** debian/copyright: Files: third_party/rnnoise/* / License: BSD-3-Clause, whose only licence text is COPYING (code holders only).
• Problem: rnnoise_data.c is generated from rnnoise_data-0b50c45.tar.gz, fetched by upstream from media.xiph.org and not part of the BSD-licensed repository; no licence accompanies that data and upstream's issue about it is open. Shipping it without a grant fails DFSG 1, and the stanza's BSD-3-Clause claim is not supported for these two files.
• Fix: Drop third_party/rnnoise from the source tarball (the code is only built with -DLIGHTNING_ENABLE_RNNOISE=ON, which debian/rules does not set) and exclude it in debian/copyright, or record an explicit upstream licence for the weights before shipping them; do not list the weights as BSD-3-Clause in the meantime.

3. [important] [licensing] Files: * names "the Lightning contributors" instead of the copyright holder Rokas Smetonis

• Files: debian/copyright:12-14, debian/copyright:20-22, README.md:136-139, packaging-ci/packaging/common/copyright:6
• Basis: checked, in the package or with a reference tool
• Evidence: README.md: Copyright © 2026 Rokas Smetonis. Lightning is free software licensed under the GNU General Public License v3.0 **or later**; scripts/generate-call-sounds.py:3 # Copyright (C) 2026 Rokas Smetonis. debian/copyright: Files: * / Copyright: 2026 Lightning contributors (repeated for data/sounds).
• Problem: Apart from one script no source file carries a copyright header, so README.md is the project's only copyright statement and it names an individual. "Lightning contributors" is not a person or legal entity and leaves the holder unnamed, so the catch-all stanza is inaccurate (DEP-5 section 3, Policy 12.5).
• Fix: Write Copyright: 2026 Rokas Smetonis (adding any other holders where files name them) in the Files: * and data/sounds stanzas, and the same in packaging-ci/packaging/common/copyright.

4. [important] [licensing] debian/copyright contains no copy of the OFL-1.1 text, only a pointer to the source tree

• Files: debian/copyright:369-372, data/fonts/OFL-IBMPlexSans.txt
• Basis: checked, in the package or with a reference tool
• Evidence: License: OFL-1.1 / This Font Software is licensed under the SIL Open Font License, Version 1.1. The full text is installed with the upstream sources in data/fonts/OFL-*.txt and is available at https://openfontlicense.org.
• Problem: Policy 12.5 requires a verbatim copy of every distribution licence in /usr/share/doc/lightning-matrix/copyright. OFL-1.1 is not among /usr/share/common-licenses, and the referenced .txt files are not installed by the binary package (the seven OFL fonts are compiled into the binary), so the installed copyright carries no OFL text at all; DEP-5 section 5.3 likewise expects the full text in the stand-alone stanza.
• Fix: Copy the full OFL-1.1 text (as in data/fonts/OFL-*.txt) into the License: OFL-1.1 paragraph.

5. [important] [licensing] vendor/* stanzas, generated from Cargo.toml, misstate the licences and holders of code bundled inside the crates

• Files: debian/copyright:196-200, debian/copyright:227-231, debian/copyright:88-92, debian/copyright:283-287, debian/copyright:200-204, debian/copyright:116-122, debian/copyright:124-130, debian/copyright:274-278, vendor/libsqlite3-sys-0.35.0/sqlcipher/LICENSE, vendor/libsqlite3-sys-0.35.0/sqlite3/sqlite3.c:35, vendor/mime2ext-0.1.54/mime-db/LICENSE, vendor/aquamarine-0.6.0/doc/js/commonDb-41f8b4c5.js:1979, vendor/vodozemac-0.10.0/src/utilities/mod.rs:96-103, vendor/livekit-protocol-0.7.12/protocol/utils/protojson/protojson.go:1, vendor/livekit-protocol-0.7.12/protocol/logger/zaputil/sampler.go:1, vendor/tungstenite-0.24.0/LICENSE-MIT:1-2, vendor/date_header-1.0.5/LICENSE-MIT:1, vendor/chrono-0.4.45/src/format/parse.rs:2, vendor/serde_html_form-0.4.1/src/de/utils.rs:15
• Basis: checked, in the package or with a reference tool
• Evidence: Files: vendor/libsqlite3-sys-0.35.0/* vendor/rusqlite-0.37.0/* / License: MIT, but sqlcipher/LICENSE: Copyright (c) 2008-2020 Zetetic LLC BSD-3-Clause (8.9 MB of sqlcipher/sqlite3.c) and sqlite3/sqlite3.c:35 The author disclaims copyright to this source code (public domain). vendor/mime2ext-0.1.54/mime-db/LICENSE: Copyright (c) 2014 Jonathan Ong, Copyright (c) 2015-2022 Douglas Christopher Wilson, while the stanza names only Jan Verbeek. doc/js/commonDb-41f8b4c5.js:1979: @license DOMPurify 2.4.5 | (c) Cure53 ... Released under the Apache license 2.0 and Mozilla Public License 2.0, while the aquamarine stanza says MIT. vodozemac/src/utilities/mod.rs:96-103: integer-encoding code under the MIT license, Copyright (c) 2016 Google Inc. / 2018-2020 Lewin Bormann. livekit-protocol/protocol/utils/protojson/protojson.go:1: Copyright 2019 The Go Authors. All rights reserved. ... BSD-style; logger/zaputil/sampler.go:1: (c) 2016-2022 Uber Technologies, Inc. MIT. Holders named in the crates' own licence files or headers are missing too: tungstenite LICENSE-MIT:1-2 (Jason Housley), date_header LICENSE-MIT:1 (Pyfisch), chrono src/format/parse.rs:2 (John Nagle), serde_html_form src/de/utils.rs:15 (Stephen M. Coakley).
• Problem: The copyright's own Comment says the vendor stanzas are generated from each crate's Cargo.toml license and authors. That misses what the crate tarballs bundle: the claimed MIT is wrong for SQLCipher (BSD-3-Clause, Zetetic) and for the public-domain SQLite amalgamation, wrong for Mermaid and its bundled DOMPurify (Apache-2.0/MPL-2.0) under aquamarine, wrong for the copied MIT code in vodozemac and the BSD/MIT Go files in livekit-protocol, and holders named in the crates' own LICENSE files and source headers are not represented. debian/copyright therefore does not accurately describe every file (DEP-5, Policy 12.5).
• Fix: Add stanzas for the bundled works (for example Files: vendor/libsqlite3-sys-0.35.0/sqlcipher/* with License: BSD-3-Clause and Copyright: 2008-2020 Zetetic LLC; Files: vendor/libsqlite3-sys-0.35.0/sqlite3/* public domain; the Mermaid/DOMPurify files under MIT/Apache-2.0), and add the holders named in each crate's LICENSE/COPYRIGHT files and copied-code notices. Basing the generation on more than Cargo.toml metadata would prevent the same gaps at the next update.

6. [important] [licensing] third_party/rnnoise stanza omits the holders in its own file headers: Cisco, CSIRO, David Rowe, Gregor Richards, Octasic, Parrot

• Files: debian/copyright:64-70, third_party/rnnoise/src/x86/x86cpu.c:1, third_party/rnnoise/src/arch.h:2, third_party/rnnoise/src/rnn.c:1, third_party/rnnoise/src/cpu_support.h:2, third_party/rnnoise/src/vec_neon.h:1, third_party/rnnoise/src/denoise.c:2
• Basis: checked, in the package or with a reference tool
• Evidence: x86cpu.c: /* Copyright (c) 2014, Cisco Systems, INC; arch.h: Copyright (c) 2007-2008 CSIRO; rnn.c: Copyright (c) 2008-2011 Octasic Inc.; cpu_support.h: Copyright (c) 2013 Parrot; vec_neon.h: Copyright (c) 2018 David Rowe; denoise.c: Copyright (c) 2018 Gregor Richards. The stanza lists only Jean-Marc Valin, Amazon, Mozilla, Xiph.Org and Mark Borgerding.
• Problem: These six holders appear in the shipped files under the same BSD-3-Clause text but are absent from debian/copyright, so the copyright information is incomplete (DEP-5 section 3, Policy 12.5).
• Fix: Add the six holders to the third_party/rnnoise stanza, or remove the stanza if the unused tree is dropped per the RNNoise model issue.

7. [minor] [licensing] Font and packaging licence texts match no stanza and fall under Files: * as GPL-3+ Lightning code

• Files: debian/copyright:12-14, debian/copyright:32-62, data/fonts/OFL-IBMPlexSans.txt, data/fonts/OFL-Inter.txt, data/fonts/LICENSE-MaterialSymbols.txt, packaging-ci/packaging/common/licenses/gst-plugins-good-1.0/COPYING
• Basis: checked, in the package or with a reference tool
• Evidence: The font stanzas match data/fonts/IBM*, data/fonts/Inter*, ... and the single path data/fonts/MaterialSymbolsRounded-subset.ttf; data/fonts/OFL-*.txt and data/fonts/LICENSE-MaterialSymbols.txt match none of them. packaging-ci/packaging/common/licenses/gst-plugins-good-1.0/COPYING is the LGPL-2.1 text.
• Problem: These are the OFL-1.1, Apache-2.0 and LGPL-2.1 licence texts, not Lightning's GPL-3+ work; falling through to Files: * / Copyright: 2026 Lightning contributors / License: GPL-3+ is inaccurate.
• Fix: Extend the font patterns to cover the .txt files (e.g. add data/fonts/OFL-*.txt, or use Files: data/fonts/* with per-font Copyright and the licence exception for MaterialSymbols) and add a stanza for the gst COPYING.

8. [minor] [packaging] The upstream C++/QML test suite is switched off; autopkgtest only checks that the binary starts

• Files: debian/rules:48, debian/rules:64-67, debian/tests/control
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules: -DBUILD_TESTING=OFF; override_dh_auto_test runs only $(BUILDDIR)/lightning-matrix --version and --build-info. debian/tests/control has two Test-Commands, lightning-matrix --version and --build-info.
• Problem: tests/ holds several hundred C++/QML test sources which are never compiled in the Debian build, and the archive's only regression check is that the executable starts. Nothing in the package would catch a runtime regression before it reaches testing.
• Fix: Configure with BUILD_TESTING=ON and run at least a representative subset of ctest offscreen in override_dh_auto_test (the existing nocheck guard covers nocheck builds), or add autopkgtest cases that exercise more than --version.

9. [minor] [packaging] SQLite is compiled into the binary from the vendored libsqlite3-sys instead of using Debian's libsqlite3

• Files: rust/Cargo.toml:38, vendor/matrix-sdk-sqlite-0.18.0/Cargo.toml:32, vendor/libsqlite3-sys-0.35.0/sqlite3/sqlite3.c
• Basis: checked, in the package or with a reference tool
• Evidence: matrix-sdk = { ..., features = [..., "bundled-sqlite", ...] } -> bundled = ["rusqlite/bundled"] -> libsqlite3-sys compiles sqlite3/sqlite3.c (8.9 MB, SQLite 3.50.2). Debian ships libsqlite3-0.
• Problem: The package carries a private copy of SQLite, one of the most frequently CVE-affected libraries in Debian; fixes in libsqlite3 reach users only when this package is rebuilt with a newer vendored crate. Embedded copies of libraries Debian ships are a maintenance and security concern, even though the amalgamation is public-domain and free.
• Fix: If Debian's libsqlite3 build provides the FTS5 support the comment in rust/Cargo.toml relies on, use the system library (drop bundled-sqlite, Build-Depend on libsqlite3-dev, or use the archive's librust-rusqlite/matrix-sdk-sqlite). Otherwise record the embedded SQLite and the policy for following its security fixes in README.source.

Verified

• Read debian/copyright in full (497 lines) and every file in debian/ (control, rules, changelog, source/format, source/options, tests/control, README.source, docs, lightning-matrix.docs, all three patches and series, assemble-cargo-registry, vendored-crates.txt); the copyright is DEP-5 with the correct Format URL, so no replacement file is proposed.
• Inventoried the whole tree directory by directory: top level, src/, qml/, rust/, tests/, docs/, i18n/, data/, resources/, scripts/, tools/, nix/, .copr/, packaging-ci/, third_party/, and all 86 vendor/ crates; .pc/ and .cargo-checksum.json were skipped as instructed.
• All 86 vendored crate directories match a Files stanza, and every crate's Cargo.toml license field agrees with its stanza's short name (allowing the MIT/Apache and MPL-2.0+ spellings); the licences used (MIT, Apache-2.0, MPL-2.0, Zlib, BSD-3-Clause, CDLA-Permissive-2.0, Unicode-3.0, OFL-1.1, CC0-1.0, GPL-3+) are DFSG-free and compatible with GPL-3+.
• Prescan: packaging-ci/flathub/pycache/update-cargo-sources.cpython-313.pyc is bytecode of the adjacent update-cargo-sources.py, not installed, same GPL-3+ work. vendor/aquamarine-0.6.0/doc/js/mermaid.esm.min.mjs is upstream's minified documentation asset (mermaid.esm.mjs beside it), not built or installed; its bundled third-party licences are the aquamarine part of the vendor issue.
• Prescan: third_party/deepfilternet/models/DeepFilterNet3_onnx.tar.gz is the unlicensed model archive reported as a blocker.
• Prescan: vendor/decancer-3.3.3/bin/bidi.bin and vendor/decancer-3.3.3/bin/codepoints.bin are the crate's compiled Unicode tables, loaded with include_bytes! (src/bidi/mod.rs:6, src/codepoints.rs:10), crate data not built here; vendor/pbjson-types-0.6.0/descriptors.bin is the crate's generated FileDescriptorSet, crate data loaded at build time.
• Prescan, the six certificate files: vendor/webpki-roots-0.26.11/tests/data/tubitak/inter.der, vendor/webpki-roots-0.26.11/tests/data/tubitak/root.der and vendor/webpki-roots-0.26.11/tests/data/tubitak/subj.der, and vendor/webpki-roots-1.0.8/tests/data/tubitak/inter.der, vendor/webpki-roots-1.0.8/tests/data/tubitak/root.der and vendor/webpki-roots-1.0.8/tests/data/tubitak/subj.der are TUBITAK test certificates used by the crates' tests, not built or installed; both crates are covered by the webpki-roots CDLA-Permissive-2.0 stanza.
• Prescan wording: third_party/rnnoise/PROVENANCE.md:67 ("none non-commercial") describes the licences of the training datasets, not a restriction on the code or the weights; the actual problem is that the weights have no licence at all, reported separately.
• Own-source inventory: src/, qml/, rust/, tests/, docs/, i18n/*.ts, scripts/, tools/, data/ (icons, sounds, fonts, emoji catalogue), resources/screenshot-demo, nix/, .copr/, .gitlab-ci.yml, CLAUDE.md and cargo-sources.json carry no third-party notices beyond project-wide GPL-3+; the i18n .ts files have none.
• Generator inputs are present for the generated data: data/sounds by scripts/generate-call-sounds.py (GPL-3+, Rokas Smetonis), icons by scripts/generate-icons.sh from data/icons/lightning-source.png, data/emoji-catalog.tsv by rust/src/bin/generate_emoji_catalog.rs, screenshot-demo avatars by scripts/generate-demo-avatars.py (drawn, not photographed); the fonts are the unmodified upstream OFL/Apache releases.
• Prescan holders accounted for beyond the issues: the remaining names are Apache-2.0 file-header contributors inside matrix-sdk*/vodozemac (Famedly GmbH, Kevin Commaille, Hanadi Tamimi, Benjamin Kampmann, Mauro Romito, Devin Ragotzy, Karl Linderhed, Timo Koesters, OpenMarket Ltd), and "The Linux Foundation" appears only in a CONTRIBUTING.md CLA sentence; neither is a separate work with its own licence. "Rokas Smetonis. GPL-3.0-or-later" and "Rokas Smetonis. Lightning is free software" (test and CI strings) are licence statements, not restrictions.
• Packaging checks: patches 0001-0003 carry DEP-3 headers (Description, Author, Forwarded, Last-Update) and are applied by quilt; debhelper compat 13 with dh and cmake+ninja; Rules-Requires-Root: no; hardening=+all; autopkgtest declared; changelog 0.10.2-1 to unstable closing #1152399; Homepage and Vcs-* present; Standards-Version 4.7.2 matches the current Policy 4.7.x.
• Dependency checks against apt-cache: cargo/rustc 1.97.1 (1.98.1 in experimental) satisfy cargo (>= 1.93) and rustc (>= 1.93); qt6-base-dev 6.11.2 satisfies qt6-base-dev (>= 6.10); librust-blake3-dev, librust-js-int-dev, librust-archery-dev and librust-matrix-pickle-dev exist; every binary Depends/Recommends named (gstreamer1.0-pipewire, gstreamer1.0-nice, kimageformat6-plugins, qml6-module-qtquick-effects, ...) exists.
• Runtime wiring: every QML import (QtQuick, QtQuick.Controls(.Basic, .impl), Layouts, Effects, Window, Multimedia, Dialogs, Shapes) maps to a declared qml6-module package; enchant is dlopened (src/text/SpellBackend.cpp:298) so Recommends: libenchant-2-2 is right; the QSQLITE use in src/storage/CacheStore.cpp is reached only from CppHttpMatrixClient.cpp:122, whose backend is removed from the shipped binary by LIGHTNING_RUST_ONLY, so no libqt6sql6-sqlite dependency is needed.
• The GIPHY/KLIPY values in debian/rules:20-21 are public client keys already published in upstream's Flathub manifest (README.source describes them); they are not secrets or private credentials.
• uscan found the packaged version as the newest upstream release (upstream 0.10.2, packaged 0.10.2).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, CC0-1.0, GPL-3, MPL-2.0).

Not confirmed

• Replaces: lightning (<< 1.0) and Breaks: lightning (<< 1.0) (debian/control:194-195) name a binary package that is in neither the Debian package lists nor the NEW queue; it is presumably Ubuntu's former name for this app. Harmless in Debian (no file overlap declared) but the rename cannot be verified from here.
• The package was not built and its autopkgtests were not run; debian/README.source itself states that a full package build had not been run by the maintainer.
• Three files exceed the 4 MiB scan limit (the two sqlite3.c amalgamations and third_party/rnnoise/src/rnnoise_data.c); their headers, licence files and first lines were read, the rest was not.
• Only four of the roughly 150 librust-*-dev Build-Depends were spot-checked with apt-cache; the rest are assumed to exist, as the autogenerated list and README.source suggest.

Proposed changes

None.