Review: lightning-matrix 0.10.2+dfsg1-1
Package Information
| Description | Native Matrix desktop client Lightning is a desktop messenger for Matrix, the open network for secure, decentralised communication. It is written in C++ and Qt 6 and uses the official Matrix Rust SDK for networking and end-to-end encryption. Features include several accounts at once, Spaces, rooms and threads, end-to-end encrypted rooms with device verification and key backup, a local search index that never leaves the computer, and group voice calls and screen sharing built on GStreamer. |
|---|---|
| Maintainer | Erich Eickmeyer <eeickmeyer@ubuntu.com> |
| Changed By | Erich Eickmeyer <eeickmeyer@ubuntu.com> |
| Sponsor | tsimonq2@debian.org |
| Distribution | unstable |
| Architecture | amd64 arm64 |
| VCS | git: https://salsa.debian.org/eickmeyer-guest/lightning-matrix.git (browse) |
| Closes | #1152399 |
| Tracker | https://tracker.debian.org/pkg/lightning-matrix |
| Uploaded | 6 days ago |
New Package Report
.changes
| Architecture | source amd64 |
|---|---|
| Distribution | unstable |
| Date | Thu, 22 Oct 2026 15:09:55 -0700 |
| Source | lightning-matrix |
| Version | 0.10.2+dfsg1-1 |
| Changed-By | Erich Eickmeyer <eeickmeyer@ubuntu.com> |
Changelog
lightning-matrix (0.10.2+dfsg1-1) unstable; urgency=medium . * Initial release. (Closes: #1152399)
.dsc
| Component | main |
|---|---|
| Package-List | lightning-matrix deb net optional arch=amd64,arm64 |
| Section | net |
| Priority | optional |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Lightning
Source: https://github.com/Mizerd/lightning
Files-Excluded: third_party/deepfilternet third_party/rnnoise
Comment: Neither third_party tree is built
(-DLIGHTNING_ENABLE_DEEPFILTERNET=OFF, -DLIGHTNING_ENABLE_RNNOISE=OFF), and
neither upstream states a licence for its model weights (each tree's own
PROVENANCE.md: "Model weights: NOT explicitly licensed by upstream" for
DeepFilterNet; "Not stated by upstream" / "de-facto redistributable ...
NOT explicitly licensed" for RNNoise's generated data tables). Excluded
from the repacked (+dfsg) source rather than shipped under a licence they
do not carry; see debian/README.source.
.
The "vendor" component holds the Rust crates the archive cannot
provide, listed in debian/vendored-crates.txt and produced by
debian/vendor-crates. Every crate keeps its own licence files. The
vendor/* stanzas below are generated from each crate's Cargo.toml
"license" and "authors" fields (or, where those are absent, from the
crate's bundled licence file and repository); regenerate them with
debian/vendored-crates.txt after every debian/vendor-crates run.
Files: *
Copyright: 2026 Rokas Smetonis
License: GPL-3+
Files: packaging-ci/packaging/common/lightning.metainfo.xml
Copyright: 2026 Mizerd
License: CC0-1.0
Files: packaging-ci/packaging/common/licenses/gst-plugins-good-1.0/COPYING
Copyright: 1991, 1999 Free Software Foundation, Inc.
License: LGPL-2.1
Comment: The upstream gst-plugins-good licence text, carried for binaries
bundled from it; see PROVENANCE.txt beside it. Not Lightning's own code.
Files: data/sounds/*
Copyright: 2026 Rokas Smetonis
License: GPL-3+
Comment: Synthesised by scripts/generate-call-sounds.py; nothing is sampled.
Files: data/emoji-catalog.tsv
Copyright: The authors of the emojis crate
1991-2023 Unicode, Inc.
License: (MIT or Apache-2.0) and Unicode-3.0
Comment: Generated from the emojis crate 0.8.2, which carries Unicode-3.0
data; see data/README.md for the notice.
Files: data/fonts/IBM*
data/fonts/OFL-IBMPlexSans.txt
Copyright: 2017 IBM Corp.
License: OFL-1.1
Files: data/fonts/Inter*
data/fonts/OFL-Inter.txt
Copyright: 2020 The Inter Project Authors
License: OFL-1.1
Files: data/fonts/JetBrainsMono*
data/fonts/OFL-JetBrainsMono.txt
Copyright: 2020 The JetBrains Mono Project Authors
License: OFL-1.1
Files: data/fonts/Manrope*
data/fonts/OFL-Manrope.txt
Copyright: 2018 The Manrope Project Authors
License: OFL-1.1
Files: data/fonts/PlusJakartaSans*
data/fonts/OFL-PlusJakartaSans.txt
Copyright: 2020 The Plus Jakarta Sans Project Authors
License: OFL-1.1
Files: data/fonts/SourceSans3*
data/fonts/OFL-SourceSans3.txt
Copyright: 2010-2020 Adobe
License: OFL-1.1
Files: data/fonts/SpaceGrotesk*
data/fonts/OFL-SpaceGrotesk.txt
Copyright: 2020 The Space Grotesk Project Authors
License: OFL-1.1
Files: data/fonts/MaterialSymbolsRounded-subset.ttf
data/fonts/LICENSE-MaterialSymbols.txt
Copyright: Google LLC
License: Apache-2.0
Files: vendor/accessory-2.1.0/*
vendor/fancy_constructor-2.1.0/*
Copyright: Art <amolc@pm.me>
License: MIT or Apache-2.0
Files: vendor/anymap2-0.13.0/*
Copyright: Chris Morgan <me@chrismorgan.info>
Azriel Hoh <azriel91@gmail.com>
License: MIT or Apache-2.0
Files: vendor/aquamarine-0.6.0/*
Copyright: Mike Lubinets <git@mkl.dev>
Frank Rehberger <frehberg@gmail.com>
License: MIT
Files: vendor/aquamarine-0.6.0/doc/js/commonDb-41f8b4c5.js
Copyright: 2024 Cure53 and other contributors
License: Apache-2.0 or MPL-2.0
Comment: Bundles DOMPurify 2.4.5 (https://github.com/cure53/DOMPurify), under
its own dual Apache-2.0/MPL-2.0 licence, not aquamarine's own MIT.
Files: vendor/async-once-cell-0.5.4/*
Copyright: Daniel De Graaf <code@danieldg.net>
License: MIT or Apache-2.0
Files: vendor/async-rx-0.2.1/*
vendor/eyeball-0.8.8/*
vendor/eyeball-im-0.8.0/*
vendor/eyeball-im-util-0.10.0/*
vendor/readlock-0.1.11/*
vendor/readlock-tokio-0.1.6/*
Copyright: Jonas Platte <jplatte@posteo.de>
License: MPL-2.0
Files: vendor/async_cell-0.2.3/*
Copyright: Sam Sartor <me@samsartor.com>
License: MIT
Files: vendor/base64-0.21.7/*
Copyright: Alice Maz <alice@alicemaz.com>
Marshall Pierce <marshall@mpierce.org>
License: MIT or Apache-2.0
Files: vendor/bitmaps-3.2.1/*
Copyright: Bodil Stokke <bodil@bodil.org>
License: MPL-2.0
Files: vendor/chrono-0.4.45/*
Copyright: 2014-2026 Kang Seonghoon and contributors
2015 John Nagle
License: MIT or Apache-2.0
Files: vendor/ctor-0.2.9/*
Copyright: Matt Mastracci <matthew@mastracci.com>
License: Apache-2.0 or MIT
Files: vendor/date_header-1.0.5/*
Copyright: Jayshua Nelson <me@jayshuanelson.com>
2016 Pyfisch
License: MIT or Apache-2.0
Files: vendor/deadpool-sync-0.2.0/*
Copyright: Michael P. Jung <michael.jung@terreon.de>
License: MIT or Apache-2.0
Files: vendor/decancer-3.3.3/*
Copyright: null (https://github.com/null8626)
License: MIT
Files: vendor/delegate-display-3.0.0/*
vendor/impartial-ord-1.0.6/*
vendor/matrix_indexed_db_futures_macros_internal-1.0.0/*
vendor/wasm_evt_listener-0.1.0/*
Copyright: Alorel <amolc@pm.me>
License: MIT
Files: vendor/emojis-0.8.2/*
Copyright: Ross MacArthur <ross@macarthur.io>
License: (MIT or Apache-2.0) and Unicode-3.0
Files: vendor/foldhash-0.1.5/*
Copyright: 2024 Orson Peters <orsonpeters@gmail.com>
License: Zlib
Files: vendor/getrandom-0.2.17/*
vendor/rand_xoshiro-0.7.0/*
Copyright: The Rand Project Developers
License: MIT or Apache-2.0
Files: vendor/gloo-utils-0.2.0/*
Copyright: Rust and WebAssembly Working Group
License: MIT or Apache-2.0
Files: vendor/growable-bloom-filter-2.1.1/*
Copyright: David Briggs <david@dpbriggs.ca>
Arthur Silva <arthurprs@gmail.com>
License: MIT
Files: vendor/hashbrown-0.15.5/*
Copyright: 2016 Amanieu d'Antras <amanieu@gmail.com>
License: MIT or Apache-2.0
Files: vendor/hashlink-0.10.0/*
Copyright: kyren <kerriganw@gmail.com>
2015 The Rust Project Developers
License: MIT or Apache-2.0
Files: vendor/heck-0.4.1/*
Copyright: Without Boats <woboats@gmail.com>
License: MIT or Apache-2.0
Files: vendor/html5ever-0.39.0/*
vendor/markup5ever-0.39.0/*
vendor/web_atoms-0.2.5/*
Copyright: The html5ever Project Developers
License: MIT or Apache-2.0
Files: vendor/imbl-6.1.0/*
Copyright: Bodil Stokke <bodil@bodil.org>
Joe Neeman <joeneeman@gmail.com>
Arthur Silva <arthurprs@gmail.com>
License: MPL-2.0
Files: vendor/imbl-sized-chunks-0.1.3/*
Copyright: Bodil Stokke <bodil@bodil.org>
Joe Neeman <joeneeman@gmail.com>
License: MPL-2.0
Files: vendor/itertools-0.10.5/*
vendor/itertools-0.11.0/*
Copyright: bluss
License: MIT or Apache-2.0
Files: vendor/libsqlite3-sys-0.35.0/*
vendor/rusqlite-0.37.0/*
Copyright: The rusqlite developers
License: MIT
Comment: libsqlite3-sys normally bundles the SQLite and SQLCipher sources;
debian/vendor-crates drops them (sqlcipher/, sqlite3/sqlite3.[ch],
sqlite3/sqlite3ext.h, sqlite3/wasm32-wasi-vfs.c) because this package links
the system libsqlite3. Only the generated bindings remain.
Files: vendor/livekit-protocol-0.7.12/*
Copyright: 2025 LiveKit, Inc.
License: Apache-2.0
Files: vendor/livekit-protocol-0.7.12/protocol/utils/protojson/protojson.go
Copyright: 2019 The Go Authors
License: BSD-3-Clause
Comment: Go standard library code (encoding/protojson), used under its
BSD-style licence (https://go.dev/LICENSE), not livekit-protocol's own
Apache-2.0.
Files: vendor/livekit-protocol-0.7.12/protocol/logger/zaputil/sampler.go
Copyright: 2016-2022 Uber Technologies, Inc.
License: MIT
Comment: Adapted from Uber's zap logger, under its own MIT licence, not
livekit-protocol's own Apache-2.0.
Files: vendor/macroific-2.0.0/*
vendor/macroific_attr_parse-2.0.0/*
vendor/macroific_core-2.0.0/*
vendor/macroific_macro-2.0.0/*
Copyright: Art <amolc@pm.me>
License: Apache-2.0
Files: vendor/matrix-sdk-0.18.0/*
vendor/matrix-sdk-base-0.18.0/*
vendor/matrix-sdk-common-0.18.0/*
vendor/matrix-sdk-crypto-0.18.0/*
vendor/matrix-sdk-indexeddb-0.18.0/*
vendor/matrix-sdk-qrcode-0.18.0/*
vendor/matrix-sdk-sqlite-0.18.0/*
vendor/matrix-sdk-store-encryption-0.18.0/*
vendor/matrix-sdk-test-0.18.0/*
vendor/matrix-sdk-ui-0.18.0/*
Copyright: The Matrix.org Foundation C.I.C.
Damir Jelić <poljar@termina.org.uk>
License: Apache-2.0
Files: vendor/matrix-sdk-test-macros-0.18.0/*
Copyright: stoically <stoically@protonmail.com>
License: Apache-2.0
Files: vendor/matrix_indexed_db_futures-0.7.0/*
Copyright: Arturas Molcanovas <amolc@pm.me>
Ivan Enderlin <ivan@mnt.io>
License: MIT
Files: vendor/mime2ext-0.1.54/*
Copyright: Jan Verbeek <jan.verbeek@posteo.nl>
2014 Jonathan Ong <me@jongleberry.com>
2015-2022 Douglas Christopher Wilson <doug@somethingdoug.com>
License: MIT
Files: vendor/oauth2-reqwest-0.1.0-alpha.3/*
Copyright: David A. Ramos <ramos@cs.stanford.edu>
License: MIT
Files: vendor/pbjson-0.6.0/*
vendor/pbjson-build-0.6.2/*
vendor/pbjson-types-0.6.0/*
Copyright: Raphael Taylor-Davies <r.taylordavies@googlemail.com>
License: MIT
Files: vendor/phf-0.13.1/*
vendor/phf_codegen-0.13.1/*
vendor/phf_generator-0.13.1/*
vendor/phf_shared-0.13.1/*
Copyright: Steven Fackler <sfackler@gmail.com>
License: MIT
Files: vendor/rand_core-0.9.5/*
Copyright: The Rand Project Developers
The Rust Project Developers
License: MIT or Apache-2.0
Files: vendor/ruma-0.16.0/*
vendor/ruma-client-api-0.24.0/*
vendor/ruma-common-0.19.0/*
vendor/ruma-events-0.34.0/*
vendor/ruma-html-0.8.0/*
vendor/ruma-identifiers-validation-0.12.1/*
vendor/ruma-macros-0.19.0/*
Copyright: The ruma contributors
License: MIT
Files: vendor/sealed-0.6.0/*
Copyright: José Duarte <jmg.duarte@campus.fct.unl.pt>
License: MIT or Apache-2.0
Files: vendor/serde_html_form-0.4.1/*
Copyright: Jonas Platte <jplatte@posteo.de>
2021 Stephen M. Coakley
License: MIT
Files: vendor/string_cache-0.9.0/*
vendor/string_cache_codegen-0.6.1/*
Copyright: The Servo Project Developers
License: MIT or Apache-2.0
Files: vendor/tokio-tungstenite-0.24.0/*
Copyright: Daniel Abramov <dabramov@snapview.de>
Alexey Galakhov <agalakhov@snapview.de>
License: MIT
Files: vendor/tungstenite-0.24.0/*
Copyright: Alexey Galakhov
Daniel Abramov
2016 Jason Housley
License: MIT or Apache-2.0
Files: vendor/vodozemac-0.10.0/*
Copyright: The Matrix.org Foundation C.I.C.
Damir Jelić <poljar@termina.org.uk>
Denis Kasak <dkasak@termina.org.uk>
License: Apache-2.0
Files: vendor/vodozemac-0.10.0/src/utilities/mod.rs
Copyright: 2016 Google Inc. (lewinb@google.com)
2018-2020 Lewin Bormann (lbo@spheniscida.de)
License: MIT
Comment: Integer-encoding logic taken from the integer-encoding crate
(https://github.com/dermesser/integer-encoding-rs), under its own MIT
licence, not the rest of vodozemac's Apache-2.0.
Files: vendor/wasi-0.11.1+wasi-snapshot-preview1/*
Copyright: The Cranelift Project Developers
License: Apache-2.0 or MIT
Files: vendor/webpki-roots-0.26.11/*
vendor/webpki-roots-1.0.8/*
Copyright: The rustls Project Developers
License: CDLA-Permissive-2.0
Files: vendor/windows-link-0.2.1/*
Copyright: Microsoft Corporation
License: MIT or Apache-2.0
Files: debian/*
Copyright: 2026 Erich Eickmeyer <eeickmeyer@ubuntu.com>
License: GPL-3+
License: GPL-3+
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free Software
Foundation, either version 3 of the License, or (at your option) any later
version.
.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
.
On Debian systems, the complete text of the GNU General Public License
version 3 can be found in /usr/share/common-licenses/GPL-3.
License: LGPL-2.1
On Debian systems, the complete text of the GNU Lesser General Public
License version 2.1 can be found in /usr/share/common-licenses/LGPL-2.1.
License: CC0-1.0
On Debian systems, the complete text of the CC0 1.0 Universal licence can be
found in /usr/share/common-licenses/CC0-1.0.
License: Apache-2.0
Licensed under the Apache License, Version 2.0. On Debian systems, the
complete text can be found in /usr/share/common-licenses/Apache-2.0.
License: MIT
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
License: BSD-3-Clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: OFL-1.1
-----------------------------------------------------------
SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
-----------------------------------------------------------
.
PREAMBLE
The goals of the Open Font License (OFL) are to stimulate worldwide
development of collaborative font projects, to support the font creation
efforts of academic and linguistic communities, and to provide a free and
open framework in which fonts may be shared and improved in partnership
with others.
.
The OFL allows the licensed fonts to be used, studied, modified and
redistributed freely as long as they are not sold by themselves. The
fonts, including any derivative works, can be bundled, embedded,
redistributed and/or sold with any software provided that any reserved
names are not used by derivative works. The fonts and derivatives,
however, cannot be released under any other type of license. The
requirement for fonts to remain under this license does not apply
to any document created using the fonts or their derivatives.
.
DEFINITIONS
"Font Software" refers to the set of files released by the Copyright
Holder(s) under this license and clearly marked as such. This may
include source files, build scripts and documentation.
.
"Reserved Font Name" refers to any names specified as such after the
copyright statement(s).
.
"Original Version" refers to the collection of Font Software components as
distributed by the Copyright Holder(s).
.
"Modified Version" refers to any derivative made by adding to, deleting,
or substituting -- in part or in whole -- any of the components of the
Original Version, by changing formats or by porting the Font Software to a
new environment.
.
"Author" refers to any designer, engineer, programmer, technical
writer or other person who contributed to the Font Software.
.
PERMISSION & CONDITIONS
Permission is hereby granted, free of charge, to any person obtaining
a copy of the Font Software, to use, study, copy, merge, embed, modify,
redistribute, and sell modified and unmodified copies of the Font
Software, subject to the following conditions:
.
1) Neither the Font Software nor any of its individual components,
in Original or Modified Versions, may be sold by itself.
.
2) Original or Modified Versions of the Font Software may be bundled,
redistributed and/or sold with any software, provided that each copy
contains the above copyright notice and this license. These can be
included either as stand-alone text files, human-readable headers or
in the appropriate machine-readable metadata fields within text or
binary files as long as those fields can be easily viewed by the user.
.
3) No Modified Version of the Font Software may use the Reserved Font
Name(s) unless explicit written permission is granted by the corresponding
Copyright Holder. This restriction only applies to the primary font name as
presented to the users.
.
4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
Software shall not be used to promote, endorse or advertise any
Modified Version, except to acknowledge the contribution(s) of the
Copyright Holder(s) and the Author(s) or with their explicit written
permission.
.
5) The Font Software, modified or unmodified, in part or in whole,
must be distributed entirely under this license, and must not be
distributed under any other license. The requirement for fonts to
remain under this license does not apply to any document created
using the Font Software.
.
TERMINATION
This license becomes null and void if any of the above conditions are
not met.
.
DISCLAIMER
THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
OTHER DEALINGS IN THE FONT SOFTWARE.
License: MPL-2.0
On Debian systems, the complete text of the Mozilla Public License version
2.0 can be found in /usr/share/common-licenses/MPL-2.0.
License: CDLA-Permissive-2.0
# Community Data License Agreement - Permissive - Version 2.0
.
This is the Community Data License Agreement - Permissive, Version
2.0 (the "agreement"). Data Provider(s) and Data Recipient(s) agree
as follows:
.
## 1. Provision of the Data
.
1.1. A Data Recipient may use, modify, and share the Data made
available by Data Provider(s) under this agreement if that Data
Recipient follows the terms of this agreement.
.
1.2. This agreement does not impose any restriction on a Data
Recipient's use, modification, or sharing of any portions of the
Data that are in the public domain or that may be used, modified,
or shared under any other legal exception or limitation.
.
## 2. Conditions for Sharing Data
.
2.1. A Data Recipient may share Data, with or without modifications, so
long as the Data Recipient makes available the text of this agreement
with the shared Data.
.
## 3. No Restrictions on Results
.
3.1. This agreement does not impose any restriction or obligations
with respect to the use, modification, or sharing of Results.
.
## 4. No Warranty; Limitation of Liability
.
4.1. All Data Recipients receive the Data subject to the following
terms:
.
THE DATA IS PROVIDED ON AN "AS IS" BASIS, WITHOUT REPRESENTATIONS,
WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED
INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
.
NO DATA PROVIDER SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING
WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE DATA OR RESULTS,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
.
## 5. Definitions
.
5.1. "Data" means the material received by a Data Recipient under
this agreement.
.
5.2. "Data Provider" means any person who is the source of Data
provided under this agreement and in reliance on a Data Recipient's
agreement to its terms.
.
5.3. "Data Recipient" means any person who receives Data directly
or indirectly from a Data Provider and agrees to the terms of this
agreement.
.
5.4. "Results" means any outcome obtained by computational analysis
of Data, including for example machine learning models and models'
insights.
License: Unicode-3.0
UNICODE LICENSE V3
.
COPYRIGHT AND PERMISSION NOTICE
.
Copyright © 1991-2023 Unicode, Inc.
.
NOTICE TO USER: Carefully read the following legal agreement. BY
DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR
SOFTWARE, YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT
DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
.
Permission is hereby granted, free of charge, to any person obtaining a
copy of data files and any associated documentation (the "Data Files") or
software and any associated documentation (the "Software") to deal in the
Data Files or Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, and/or sell
copies of the Data Files or Software, and to permit persons to whom the
Data Files or Software are furnished to do so, provided that either (a)
this copyright and permission notice appear with all copies of the Data
Files or Software, or (b) this copyright and permission notice appear in
associated Documentation.
.
THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
THIRD PARTY RIGHTS.
.
IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE
BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES,
OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA
FILES OR SOFTWARE.
.
Except as contained in this notice, the name of a copyright holder shall
not be used in advertising or otherwise to promote the sale, use or other
dealings in these Data Files or Software without prior written
authorization of the copyright holder.
License: Zlib
This software is provided 'as-is', without any express or implied warranty.
In no event will the authors be held liable for any damages arising from the
use of this software.
.
Permission is granted to anyone to use this software for any purpose,
including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:
.
1. The origin of this software must not be misrepresented; you must not
claim that you wrote the original software. If you use this software in
a product, an acknowledgment in the product documentation would be
appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be
misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.
DFSG Assistant LLM REVIEW 2 blocker, 0 important, 5 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 6 days ago.
Report
DFSG NEW review for lightning-matrix version 0.10.2+dfsg1-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 2 blocker, 0 important, 5 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 11 found
Licensing
The code is free throughout: Lightning is GPL-3.0-or-later, the 86 vendored crates are MIT / Apache-2.0 / MPL-2.0 / Zlib / BSD-3-Clause / CDLA-Permissive-2.0 / Unicode-3.0, and the bundled fonts are OFL-1.1 or Apache-2.0, all compatible with GPL-3. Excluding third_party/deepfilternet and third_party/rnnoise is a defensible and well-documented response to model weights that upstream never licensed, and both trees are genuinely absent and switched off. debian/copyright is valid DEP-5 and has a stanza for every vendored crate and for every asset with a different licence, but the vendor stanzas were generated from Cargo.toml authors and therefore omit holders that the crates' own files name (Famedly GmbH, Kévin Commaille, OpenMarket Ltd, Yuki Okushi, Mozilla Foundation, the Rust Project Developers), and three matrix-sdk-crypto files that grant MIT are declared Apache-2.0; aquamarine's bundled documentation JavaScript is attributed to aquamarine alone.
Packaging
Unusually careful packaging for a first upload: debhelper compat 13 with a short rules file, six DEP-3 patches that each explain why they are needed and say Forwarded: not-needed, Built-Using and Static-Built-Using computed by dh-cargo-built-using (with a hard failure if the Rust crates are not found), no maintainer scripts, Standards-Version 4.7.4 (current), Vcs-* and Homepage set, an autopkgtest, and README.source that documents the repack, the vendored crates and every deliberate difference from upstream. Two minor gaps: the Qt SQLite driver package the cache store needs is not depended on, and GIPHY/KLIPY API keys are hard-coded in debian/rules and compiled into every binary.
Issues
blocker licensing 1. matrix-sdk*/vodozemac stanzas omit holders named in the files (Famedly GmbH, Kévin Commaille, Benjamin Kampmann, Hanadi Tamimi, Mauro Romito, Devin Ragotzy, Timo Kösters, Karl Linderhed, OpenMarket Ltd) and call MIT files Apache-2.0 ◂
- Files:
debian/copyright:254-265,debian/copyright:340-345,vendor/matrix-sdk-0.18.0/src/client/mod.rs:3,vendor/matrix-sdk-0.18.0/src/account.rs:3,vendor/matrix-sdk-0.18.0/src/pusher.rs:2,vendor/matrix-sdk-0.18.0/src/sliding_sync/mod.rs:1,vendor/matrix-sdk-0.18.0/src/room_directory_search.rs:1,vendor/matrix-sdk-crypto-0.18.0/src/types/cross_signing/common.rs:1-4,vendor/matrix-sdk-crypto-0.18.0/src/types/device_keys.rs:1-3,vendor/vodozemac-0.10.0/src/megolm/ratchet.rs:1 - Basis: checked, in the package or with a reference tool
- Evidence:
Copyright: The Matrix.org Foundation C.I.C./Damir Jelić <poljar@termina.org.uk>/License: Apache-2.0for the ten matrix-sdk crates, while the files say// Copyright 2022 Famedly GmbH(client/mod.rs:3),// Copyright 2022 Kévin Commaille(account.rs:3),// Copyright 2024 Hanadi Tamimi(pusher.rs:2),// Copyright 2022-2023 Benjamin Kampmann(sliding_sync/mod.rs:1),// Copyright 2024 Mauro Romito(room_directory_search.rs:1),// Copyright 2020 Karl Linderhed.followed by the MIT permission text (device_keys.rs:1-3),// Copyright 2021 Devin Ragotzy./// Copyright 2021 Timo Kösters.followed by the MIT text (cross_signing/common.rs:1-4), and vodozemac's// Copyright 2016 OpenMarket Ltd(megolm/ratchet.rs:1). - Problem: debian/copyright is inaccurate for compiled code: named copyright holders are dropped, and three files that grant only the MIT licence (cross_signing/common.rs, cross_signing/mod.rs, device_keys.rs) are described as Apache-2.0, so the Apache-2.0 short name the stanza gives them is wrong. MIT additionally requires its copyright notice to travel with binary copies, and /usr/share/doc/lightning-matrix/copyright is the only place these notices reach the binary.
- Fix: Add the missing holders to the matrix-sdk and vodozemac stanzas (or list them per file), and put the MIT-licensed matrix-sdk-crypto files in a stanza of their own with
License: MIT.
blocker licensing 2. Other vendor stanzas are built from Cargo.toml authors and omit holders named in the crates' own LICENSE files (Yuki Okushi, Mozilla Foundation, the Rust Project Developers, the Teepee project developers) ◂
- Files:
debian/copyright:17-20,debian/copyright:93-96,debian/copyright:172-175,debian/copyright:195-197,debian/copyright:293-297,debian/copyright:324-327,vendor/phf-0.13.1/LICENSE:3,vendor/string_cache-0.9.0/LICENSE-MIT:1,vendor/string_cache_codegen-0.6.1/LICENSE-MIT:1,vendor/getrandom-0.2.17/LICENSE-MIT:1-2,vendor/heck-0.4.1/LICENSE-MIT:1,vendor/anymap2-0.13.0/COPYRIGHT:3 - Basis: checked, in the package or with a reference tool
- Evidence:
Copyright (c) 2014-2022 Steven Fackler, Yuki Okushi(phf*/LICENSE:3) againstCopyright: Steven Fackler <sfackler@gmail.com>;Copyright (c) 2012-2013 Mozilla Foundation(string_cache*/LICENSE-MIT:1) againstCopyright: The Servo Project Developers;Copyright (c) 2015 The Rust Project Developers(heck/LICENSE-MIT:1) againstCopyright: Without Boats <woboats@gmail.com>;Copyright (c) 2018-2024 The rust-random Project Developers(getrandom/LICENSE-MIT:1) againstThe Rand Project Developers;Copyright (c) 2014 Chris Morgan and the Teepee project developers(anymap2/COPYRIGHT:3) against only Chris Morgan and Azriel Hoh. - Problem: The header comment of debian/copyright itself says the vendor stanzas are generated from each crate's Cargo.toml
licenseandauthorsfields, and Cargo'sauthorsis not the copyright statement; the crates' bundled licence files name further holders that are compiled into the binary and whose notices MIT requires to be reproduced. - Fix: Regenerate the stanzas from the crates' licence files as well as Cargo.toml (or add the missing names to the existing stanzas), and make debian/update-vendored-crates emit them so they do not drift again.
minor licensing 3. aquamarine's bundled documentation JavaScript is attributed to aquamarine only: mermaid and js-yaml hold the copyright, and a second DOMPurify copy is declared MIT ◂
- Files:
debian/copyright:98-107,vendor/aquamarine-0.6.0/doc/js/mermaid.esm.mjs,vendor/aquamarine-0.6.0/doc/js/mermaid.esm.min.mjs,vendor/aquamarine-0.6.0/doc/js/utils-8ea37061.js:791,vendor/aquamarine-0.6.0/doc/js/commonDb-89160e91.js:2484,vendor/aquamarine-0.6.0/doc/js/mindmap-definition-57c198db.js:6079 - Basis: checked, in the package or with a reference tool
- Evidence:
Files: vendor/aquamarine-0.6.0/*withCopyright: Mike Lubinets/Frank RehbergerandLicense: MIT; the directory holds mermaid's whole rolled-up bundle (mermaid.esm.mjs, no notice),/*! js-yaml 4.1.0 ... @license MIT */(utils-8ea37061.js:791),/*! @license DOMPurify 2.4.5 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 */(commonDb-89160e91.js:2484), andCopyright (c) 2013-2014 Ralf S. Engelschall(mindmap-definition-57c198db.js:6079). The DOMPurify stanza at debian/copyright:103 covers only commonDb-41f8b4c5.js. - Problem: Bundled third-party code whose holders are not named, and one file (commonDb-89160e91.js) that is Apache-2.0/MPL-2.0 by its own header but falls under the MIT aquamarine stanza. All licences are free and compatible, which is why this is not blocking, but the copyright record is wrong for a large body of distributed JavaScript (documentation assets, not compiled or installed).
- Fix: Add a comment or stanza for the doc/js bundles naming mermaid (MIT), js-yaml (MIT), Ralf S. Engelschall's thenable (MIT) and both DOMPurify copies, and extend the DOMPurify
Files:line to cover commonDb-89160e91.js.
minor packaging 4. Application uses the QSQLITE driver but does not depend on libqt6sql6-sqlite; the driver only arrives through libqt6sql6's Recommends ◂
- Files:
debian/control:213-236,src/storage/CacheStore.cpp:85 - Basis: checked, in the package or with a reference tool
- Evidence:
QSqlDatabase db = QSqlDatabase::addDatabase(QStringLiteral("QSQLITE"), m_connectionName);in src/storage/CacheStore.cpp:85, whileDepends:lists the Qt QML modules, GStreamer and qt6-image-formats-plugins but no SQL driver; libqt6sql6 Recommendslibqt6sql6-sqlite | libqt6sql6-mysql | libqt6sql6-odbc | ...(apt-cache). - Problem: On a system installed with --no-install-recommends, or where apt satisfied the Recommends with a different driver, CacheStore::open() fails and the local cache/search store silently does not work, although it is advertised in the package description. A program must depend on the packages it needs (Policy 7.2).
- Fix: Add
libqt6sql6-sqliteto Depends.
minor packaging 5. GIPHY and KLIPY application keys are hard-coded in debian/rules and compiled into every binary ◂
- Files:
debian/rules:26-27,debian/README.source:96-102 - Basis: checked, in the package or with a reference tool
- Evidence:
export LIGHTNING_BUILD_GIPHY_API_KEY = cAOuVhjN4BI5vtH3iYuWpgKewsME80MFandexport LIGHTNING_BUILD_KLIPY_API_KEY = sYbUpgwUKt4tAZj8LFPoUPEDVzJxYtqO2PA4LcF1kO7pFYELZD60OvdkcxstuPxa(the same values as org.lightning_matrix.Lightning.yaml:280-281). - Problem: Debian would distribute a third-party service credential it does not control: every user's GIF requests are attributed to upstream's key, the key can be revoked or rate-limited at any time, and the value is visible to everyone who reads the source. README.source documents the choice, but it is not Debian's key to ship.
- Fix: Ship the build without keys (LIGHTNING_REQUIRE_GIF_KEYS=OFF) and either expose a setting or environment variable for a user-supplied key, or drop the GIF picker; at minimum raise it with upstream and on debian-devel before upload.
minor packaging 6. Files-Excluded is set but debian/watch sets no repack suffix ◂
- Files:
debian/copyright,debian/watch - Basis: found by the review tooling's own checks
- Evidence:
0.10.2+dfsg1-1 - Problem:
debian/copyrighthasFiles-Excluded, so uscan repacks the upstream tarball, butdebian/watchneither names the suffix the repacked version gets nor mangles the version. - Fix: Set
Repacksuffixindebian/watchto the suffix the version carries.
minor packaging 7. The repack suffix is not removed before versions are compared ◂
- Files:
debian/watch - Basis: found by the review tooling's own checks
- Evidence: uscan compares
0.10.2+dfsg1with upstream's0.10.3(status:newer package available) - Problem: The packaged version carries a repack suffix that
debian/watchdoes not remove before comparing, so uscan compares it as it is with upstream's version and never finds them equal. - Fix: Remove the suffix for the comparison, with
Dversion-Mangle: auto(version 5) ordversionmangle=auto(version 4).
Verified ◂
- Inventory: every file of debian/ was read in full; upstream was walked directory by directory (src/, qml/, rust/, tests/, cmake/, data/, i18n/, docs/, scripts/, tools/, nix/, packaging-ci/, resources/, .copr/, CMakeLists.txt) and vendor/ crate by crate.
- All 86 directories listed in debian/vendored-crates.txt have a
Files: vendor/<crate>/*stanza, and all 86 Cargo.tomllicensefields agree with the stanza's short name (includingMPL-2.0+for bitmaps/imbl,(MIT OR Apache-2.0) AND Unicode-3.0for emojis,CDLA-Permissive-2.0for both webpki-roots, andApache-2.0 WITH LLVM-exception OR Apache-2.0 OR MITfor wasi, for which Apache-2.0 or MIT is a valid choice). Files-Excluded: third_party/deepfilternet third_party/rnnoiseis accurate: third_party/ is empty in the repacked tree, debian/rules passes both -DLIGHTNING_ENABLE_DEEPFILTERNET=OFF and -DLIGHTNING_ENABLE_RNNOISE=OFF, and both features are genuinely guarded in cmake/ThirdPartyDeepFilterNet.cmake:28-36 and cmake/ThirdPartyRnnoise.cmake:20. Debian's own rnnoise source is 0.2+ds (repacked), so excluding these trees is in line with existing practice.- The holders the scan missed from docs/third-party-notices.md (Xiph.Org Foundation, Mozilla, Amazon, Jean-Marc Valin, Mark Borgerding, Hendrik Schröter) are notice-table entries for RNNoise, DeepFilterNet and GStreamer/Qt binaries that this source package does not contain, so they need no stanza. The one Ralf S. Engelschall hit that does matter is in aquamarine's bundled doc/js, reported separately.
- Scan items accounted for: vendor/decancer-3.3.3/bin/bidi.bin and vendor/decancer-3.3.3/bin/codepoints.bin are compile-time inputs of the decancer crate, read with
include_bytes!("../bin/codepoints.bin")(src/codepoints.rs:10) andinclude_bytes!("../../bin/bidi.bin")(src/bidi/mod.rs:6), not built files; vendor/pbjson-types-0.6.0/descriptors.bin is the FileDescriptorSet its build.rs reads (build.rs,skip_protoc_run()); vendor/webpki-roots-0.26.11/tests/data/tubitak/inter.der, vendor/webpki-roots-0.26.11/tests/data/tubitak/root.der, vendor/webpki-roots-0.26.11/tests/data/tubitak/subj.der, vendor/webpki-roots-1.0.8/tests/data/tubitak/inter.der, vendor/webpki-roots-1.0.8/tests/data/tubitak/root.der and vendor/webpki-roots-1.0.8/tests/data/tubitak/subj.der are test certificates of a CDLA-Permissive-2.0 crate, test data only, never installed. - vendor/aquamarine-0.6.0/doc/js/mermaid.esm.min.mjs is mermaid's own minified documentation bundle, with mermaid.esm.mjs beside it; neither is compiled, installed or referenced by CMake - only the attribution gap is reported.
- packaging-ci/flathub/pycache/update-cargo-sources.cpython-313.pyc is Python bytecode for the adjacent packaging-ci/flathub/update-cargo-sources.py; it is source-tree noise, not installed and not used by debian/rules, and its source is present.
- Fonts: seven OFL-1.1 fonts and MaterialSymbolsRounded-subset.ttf (Apache-2.0), each with its licence text in data/fonts/, all matched by the font stanzas; data/emoji-catalog.tsv is generated by rust/src/bin/generate_emoji_catalog.rs (present) from the emojis crate, whose Unicode-3.0 notice is reproduced in data/README.md and debian/copyright.
- First-party licensing is consistent: root LICENSE is GPL-3 text, README.md:133-135 and CONTRIBUTING.md:131-133 state GPL-3.0-or-later, scripts/generate-call-sounds.py:2 carries SPDX GPL-3.0-or-later, so
Files: *with GPL-3+ is right. Sounds, icons and demo media all have their generators in scripts/. - A tree-wide search (excluding .pc/) for NonCommercial, NoDerivatives,
Good, not Evil, UNLICENSED and proprietary wording found no non-free term; the only hits are the GPL text itself and Adobe's OFLAll Rights Reservedreservation in OFL-SourceSans3.txt. - The vendoring is justified where spot-checked: apt-cache gives librust-hashbrown-dev 0.16.1, getrandom 0.4.2, phf 0.11.3, itertools 0.14.0, string-cache 0.8.7 and base64 0.22.1, all semver-incompatible with the vendored 0.15.5 / 0.2.17 / 0.13.1 / 0.10.5+0.11.0 / 0.9.0 / 0.21.7, and there is no librust-webpki-roots-dev or librust-itertools-0.10-dev at all.
- vendor/libsqlite3-sys-0.35.0 matches its comment: the sqlite3/ and sqlcipher/ amalgamations are gone, only bindgen bindings and the crate's own build.rs remain, and debian/rules links the system libsqlite3 (LIGHTNING_RUST_SYSTEM_SQLITE=ON).
- Packaging checks:
--buildsystem=cmake+ninjais a real debhelper buildsystem (Buildsystem/Dh_Buildsystems.pm:30); all six patches are in debian/patches/series with Description/Author/Forwarded/Last-Update; no maintainer scripts, .maintscript or maintainer-script targets exist; Standards-Version 4.7.4 matches Policy 4.7.4.1 in its first two components; the desktop file'sExec=lightning-matrix --backend=rustand the metainfo idorg.lightning_matrix.Lightningmatch the installed binary and the name given in override_dh_install. - Build dependency spot-checks against the archive: rustc 1.97.1 and cargo 1.97.1 satisfy >= 1.93, qt6-base-dev 6.11.2 satisfies >= 6.10, dh-cargo 34 satisfies >= 32, and librust-js-int-dev, librust-js-option-dev, librust-serde-core-dev, librust-matrix-pickle-dev, librust-new-debug-unreachable-dev, librust-utf-8-dev, librust-proc-macro-error2-dev, librust-event-listener-dev, librust-deadpool-runtime-dev all exist.
- debian/tests/control runs the built binary's --version and --build-info offscreen; together with the identical override_dh_auto_test check this is all the testing the package has, which README.source explains (upstream's suite is 85 GB and needs hardware/D-Bus).
- uscan found upstream releases with
debian/watch; a newer upstream version is available (upstream0.10.3, packaged0.10.2+dfsg1), which is not a fault of the package. - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0,CC0-1.0,GPL-3,LGPL-2.1,MPL-2.0).
Not confirmed ◂
- No build or install was run; debian/README.source itself records that a complete source-and-binary sbuild with the current configuration has not been performed, so whether the emptied rust/Cargo.lock resolves, and whether cargo can satisfy every crate from the assembled registry, is untested here.
- About 120 of the librust-* Build-Depends were not each checked against the archive; the ten unusual ones checked all exist.
- Whether a binary package
lightningever existed:Replaces: lightning (<< 1.0)andBreaks: lightning (<< 1.0)name a package that nothing in the current lists provides, which is harmless today but cannot be confirmed either way from the package. - File modes cannot be read with the tools available, so the executable bits of debian/assemble-cargo-registry, debian/vendor-crates and debian/update-vendored-crates (the first is run directly from debian/rules) were not verified.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader rejected this upload in response to the review.
Review Information
rejected — allocated to dfsg-uploader 5 days ago, started 5 days ago, completed 5 days ago.
Final Comment
The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.