DFSG NEW review for lomiri-audiorecorder-app version 1.2.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 2 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The licensing is DFSG-compliant: every source file is GPL-3+ (the Files: * catch-all), except qml/ui/SharePage.qml which is GPL-3 (no "or later") and is given its own stanza, and the LICENSE (GPL-3) that both standalone License paragraphs match. No non-free terms, no built/preferred-form-missing files, no unresolved provenance: the PNG/SVG assets are source data of the app itself. However debian/copyright is inaccurate: the po/ translation files (de, eo, es, fi, fr, hu, it, pl, pt, ru) carry a copyright line for Rosetta Contributors and Canonical Ltd, which is not named anywhere in debian/copyright under any stanza (the catch-all names only Lukas Baubkus and DawnDIY). The license assigned (GPL-3+) is correct (the PO headers state they are distributed under the same licence as the package), but the holder attribution is missing.

Packaging

Packaging is clean and well-integrated with the Debian Qt/UBports stack: compat 13 (debhelper-compat (= 13)), dh $@ with hardening=+all, CMake builds in non-click mode (-DCLICK_MODE=OFF), correct binary split (single any package), sensible Depends covering every QML import used (QtGraphicalEffects is delivered transitively via qml-module-lomiri-components), Standards-Version 4.7.4.1 matches current Policy, and Vcs-* / upstream/metadata / salsa-ci are all in place. The 2010 rebranaming patch correctly renames the binary, desktop file and icon. The only nit is that the DEP-3 patch headers omit the recommended Description: (and Origin:) fields in the 1010-, 1020-, 1030- patches.

Issues

1. [important] [licensing] debian/copyright omits the copyright holder of the po/ translations (Rosetta Contributors and Canonical Ltd)

• Files: po/de.po, po/eo.po, po/es.po, po/fi.po, po/fr.po, po/hu.po, po/it.po, po/pl.po, po/pt.po, po/ru.po (line 2 of each); debian/copyright Files: * stanza
• Basis: checked, in the package or with a reference tool
• Evidence: Each file line 2: "# Copyright (c) 2016 Rosetta Contributors and Canonical Ltd 2016" (2017 in es/fi/hu/pt/ru). debian/copyright Files: * lists only "2018-2026 Lukas Baubkus / 2016-2017 DawnDIY" and has no stanza naming Rosetta/Canonical.
• Problem: The machine-readable copyright file must represent every copyright holder in the source. The translations' actual holder is Canonical Ltd / Rosetta Contributors, distinct from the app authors named in the catch-all. The license (GPL-3+) is already correctly given by the catch-all, so only the attribution is wrong/omitted.
• Fix: Add a Files: stanza for the po/ files naming 2016, 2017 Rosetta Contributors and Canonical Ltd under License: GPL-3+ (matching the prescan's generated stanza), e.g. Files: po/de.po po/eo.po ... / Copyright: 2016-2017 Rosetta Contributors and Canonical Ltd / License: GPL-3+.

2. [minor] [packaging] DEP-3 patch headers lack Description and Origin fields

• Files: debian/patches/1010-non-click-packaging.patch, 1020-lomiri-imports.patch, 1030-desktop-file-metadata.patch
• Basis: checked, in the package or with a reference tool
• Evidence: Headers contain From/Date/Subject/Forwarded but no Description: or Origin: line (the 2010- rebrand patch likewise has no Description).
• Problem: DEP-3 recommends Description: and Origin: on each patch; the current Omit-From are understandable from Subject alone, but a sponsor conventionally asks for the recommended fields.
• Fix: Add Origin: (e.g. Origin: vendor, Debian) and a one-line Description: summarizing each patch. Low priority; not blocking.

3. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Every file listed by the prescan was checked: the po/*.po Rosetta/Canonical holders (reported above), README.md 'Copyright (C) 2016 DawnDIY' and qml/ui/AboutPage.qml '(C) 2016 DawnDIY, 2026 Luksus' — both holders are already named in the Files: * stanza.
• All C++/QML sources carry GPL-3+ headers (plugins/AudioRecorder, qml/*, main.cpp, plugin.cpp/h have no header but are covered by LICENSE + the catch-all stanza, which is acceptable for a single-license tree).
• qml/ui/SharePage.qml is GPL-3 (no later-version clause) and debian/copyright gives it an accurate separate stanza (License: GPL-3).
• LICENSE in the tree is GPL-3; both standalone License paragraphs in debian/copyright match it ('or any later version' vs 'version 3') and correctly point to /usr/share/common-licenses/GPL-3.
• Source tree contains no built/minified/bytecode/firmware artifacts; assets/ (PNG, sorting.svg) and screenshots/ are the app's own data/art and carry no separate licence notices.
• Every package named in Depends exists in the archive (qml-module-lomiri-content, qml-module-qtsysteminfo, qml-module-qt-labs-settings, etc.) per apt-cache; QtGraphicalEffects (imported by Main/Home/About/IntroPage) is provided transitively by qml-module-lomiri-components.
• CMake installs the binary to /usr/bin, desktop to /usr/share/applications with matching Exec/Icon names after the 2010 patch; translations install as lomiri-audiorecorder-app.mo matching the domain.
• Format: URL in debian/copyright is the exact 1.0 machine-readable URL.
• No maintainer scripts, install/links/docs/dirs files, tests/control, or *.maintscript are present — none are required here.
• Sampled rather than exhaustively read: LICENSE read to line 300; the full po/ files were not read past the headers, but all po headers were inspected via grep.
• uscan found the packaged version as the newest upstream release (upstream 1.2.0, packaged 1.2.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed

None.