DFSG NEW review for lomiri-audiorecorder-app version 1.2.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 1 blocker, 2 important, 2 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The package is entirely GPL-licensed and DFSG-compliant: the full GPL-3 text is in LICENSE, every C++/QML source carries a GPL-3-or-later notice, and the .po headers put the translations under the package's licence. debian/copyright is DEP-5 but incomplete and in one place wrong: the catch-all stanza claims GPL-3+ for every file, while qml/ui/SharePage.qml is GPL-3 only and copyright Stefano Verzegnassi, who is not named, and the translation files' copyright holders (Rosetta Contributors and Canonical Ltd) are not named either.

Packaging

The packaging is clean in structure (3.0 quilt, debhelper compat 13, current Standards-Version, four well-formed patches, no maintainer scripts, sensible control fields), but the binary package does not depend on the QML modules its own files import, so the app fails to start with stock dependency resolution. A minor user-visible defect in the QML resource paths is also noted.

Issues

1. [blocker] [licensing] debian/copyright misses Stefano Verzegnassi and misstates SharePage.qml as GPL-3+

• Files: debian/copyright:5-8, qml/ui/SharePage.qml:2-5
• Basis: checked, in the package or with a reference tool
• Evidence: qml/ui/SharePage.qml: Copyright (C) 2016 Stefano Verzegnassi / GNU General Public License 3 as published by (no "or any later version"). debian/copyright, Files: *: Copyright: 2018-2026 Lukas Baubkus / 2016-2017 DawnDIY / License: GPL-3+.
• Problem: The catch-all stanza claims every non-debian file is GPL-3+ and names only Baubkus and DawnDIY. SharePage.qml is GPL-3 only and its copyright holder is absent, so debian/copyright is both incomplete and inaccurate about the licence. GPL-3 is compatible with the GPL-3+ files combined with it, so this is a documentation fault, not a DFSG one.
• Fix: Add a stanza before/after the catch-all, e.g. Files: qml/ui/SharePage.qml / Copyright: 2016 Stefano Verzegnassi / License: GPL-3, plus a stand-alone License: GPL-3 paragraph pointing at /usr/share/common-licenses/GPL-3.

2. [important] [licensing] Translation copyright holders are not named in debian/copyright

• Files: debian/copyright:5-8, po/de.po:2, po/eo.po:2, po/es.po:2, po/fi.po:2, po/fr.po:2, po/hu.po:2, po/it.po:2, po/pl.po:2, po/pt.po:2, po/ru.po:2, po/zh_TW.po:2
• Basis: checked, in the package or with a reference tool
• Evidence: # Copyright (c) 2016 Rosetta Contributors and Canonical Ltd 2016 (de, eo, fr, it, pl) and # Copyright (c) 2017 Rosetta Contributors and Canonical Ltd 2017 (es, fi, hu, pt, ru); each also says This file is distributed under the same license as the recorder package. ca.po, nl.po, zh_CN.po and zh_TW.po carry the template Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER; zh_TW.po credits Cheng Lu dawndiy.dev@gmail.com (the DawnDIY author) as translator.
• Problem: The named holders of the translation files are not represented in debian/copyright, which therefore does not describe the copyright of every file. The licensing terms themselves (GPL-3+, same as the package) are correctly implied by the headers.
• Fix: Add a stanza, e.g. Files: po/* / Copyright: 2016, 2017 Rosetta Contributors and Canonical Ltd / License: GPL-3+, optionally noting the Launchpad/Rosetta origin in a Comment.

3. [important] [packaging] Binary package lacks Depends on QML modules the application imports

• Files: debian/control:22-27, qml/Main.qml:21-23, qml/ui/HomePage.qml:21-24, qml/ui/RecordsPage.qml:21-24, qml/ui/SharePage.qml:19
• Basis: checked, in the package or with a reference tool
• Evidence: Imports: import QtSystemInfo 5.0, import QtMultimedia 5.5, import Qt.labs.folderlistmodel 2.1, import Lomiri.Content 1.3. Depends lists only qml-module-lomiri-components and qml-module-qt-labs-settings besides substvars.
• Problem: A QML import of an uninstalled module makes the component fail to load, so Main.qml and the pages using Lomiri.Content/QtMultimedia/folderlistmodel cannot be created. apt-cache shows qml-module-lomiri-components depends on qtgraphicaleffects/qtquick2/layouts/window2 but not on qml-module-lomiri-content, qml-module-qtmultimedia, qml-module-qtsysteminfo or qml-module-qt-labs-folderlistmodel, so nothing pulls them in. A default install therefore gives a recorder that cannot start or record.
• Fix: Add to Depends: qml-module-lomiri-content, qml-module-qtmultimedia, qml-module-qtsysteminfo, qml-module-qt-labs-folderlistmodel (keep qml-module-lomiri-components and qml-module-qt-labs-settings).

4. [minor] [packaging] QML image references point at a non-existent qrc:/image/ path

• Files: qml/ui/DonatePage.qml:45, qml/ui/DonatePage.qml:48, qml/ui/DonatePage.qml:75, qml/ui/DonatePage.qml:110, qml/ui/DonatePage.qml:145, qml/ui/RecordsPage.qml:115, assets/assets.qrc:2-11
• Basis: inferred from what was read, not seen directly
• Evidence: qrCodeImage.source = Qt.resolvedUrl("../image/alipay_qrcode.png"), iconSource: "../image/sorting.svg"; assets.qrc registers the files at the resource root (<qresource prefix="/"> <file>alipay.png</file> ...), and no qml/image directory exists.
• Problem: Relative to qrc:/ui/DonatePage.qml, ../image/... resolves to qrc:/image/..., which does not exist (the assets are at qrc:/alipay.png etc.), so the donation logos, QR codes and the RecordsPage sort icon do not load. The tree is installed at /usr/share/lomiri-audiorecorder-app/{qml,assets}, where ../image/ is equally absent. This is inherited from upstream rather than introduced by a Debian patch.
• Fix: Change the references to the actual resource paths (../alipay.png, ../wechat.png, ../paypal.png, ../alipay_qrcode.png, ../wechat_qrcode.png, ../sorting.svg) or add aliases in assets.qrc; forward the fix upstream.

5. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Prescan holder 'Rosetta Contributors and Canonical Ltd 2016/2017': confirmed in the po/*.po headers and reported as a missing holder in debian/copyright.
• Prescan holder 'Stefano Verzegnassi': confirmed as the copyright holder of qml/ui/SharePage.qml and reported, together with the GPL-3-only licence mismatch.
• Prescan holder 'DawnDIY' (README.md:33, qml/ui/AboutPage.qml:164): README.md has the GPL-3+ notice of the original author; AboutPage.qml:164 (C) 2016 DawnDIY, 2026 Luksus is a display string, not a licence notice; the holder is named in debian/copyright's Files: * stanza.
• Read debian/copyright in full: DEP-5 format with correct Format URL, Files: * and debian/* stanzas, GPL-3+ stand-alone paragraph; the referenced /usr/share/common-licenses/GPL-3 exists.
• LICENSE is the unmodified 674-line GPL version 3 text; all C++ (main.cpp, plugins/AudioRecorder/*) and QML sources carry GPL-3-or-later headers, mostly DawnDIY 2016.
• Grepped the whole tree (excluding .pc) for Copyright/C)/©/SPDX/licence phrases: no non-free wording, no additional licence, no third-party code with its own licence found.
• Read debian/control, rules, changelog, source/format, all four patches and series, salsa-ci.yml, upstream/metadata, and confirmed no maintainer scripts, no gbp.conf, no debian/tests.
• Standards-Version 4.7.4.1 matches the reviewing system's Policy version 4.7.4.1.
• Scanned for built artifacts (.jar/.class/.so/.dll/.exe/.pyc/.a/.o/.mo and minified JS/CSS): none present; PNGs and screenshots are the only binary files and were not opened, as instructed.
• Checked dependency availability with apt-cache: qml-module-lomiri-components, qml-module-lomiri-content, qml-module-qtmultimedia, qml-module-qtsysteminfo, qml-module-qt-labs-folderlistmodel and intltool (which depends on gettext) all exist in the archive; libqt5multimedia5 Recommends libqt5multimedia5-plugins, so recording plugins come in by default.
• Patches 1010/1020/1030 carry From/Date/Subject and Forwarded headers; 2010 is Debian-only (2xxx series), as its series README says.
• uscan found the packaged version as the newest upstream release (upstream 1.2.0, packaged 1.2.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed

• The package was not built or run; build success and runtime behaviour are not observed.
• The images (assets/.png, screenshots/.png) were not opened; their content, dimensions and provenance are judged only from file names and usage.