DFSG NEW review for lomiri-chatter-app version 35-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: 2 found

Licensing

debian/copyright is machine-readable DEP-5 with a correct Format URL. Every source file is GPL-3.0+: irc_client.{cpp,h}, main.cpp and all 15 qml files carry explicit 'or any later version' headers by Rúben Carneiro 2018, matching the Files: * stanza; the inline LICENSE is verbatim GPL-3; the po/*.po headers name Rosetta Contributors and Canonical Ltd 2016/2017 and state 'distributed under the same license as the chatter package', matching the po stanza, with correct dedicated stanzas for ca.po (Walter Garcia-Fontes) and es.po (advocatux). The two compiled .mo catalogs are regenerated at build from po/ca.po and po/es.po, both present in the tree, so their preferred form for modification is available. All copyright holders found by the scan are named. No non-free terms anywhere; the whole tree is uniformly GPL-3.0+, so licence compatibility is moot.

Packaging

Good-quality initial package. debhelper compat 13 with dh $@ and hardening=+all; sane Build-Depends (qtbase5-dev for Qt5Widgets is reached via qtdeclarative5-dev, which depends on it) and Runtime Depends that actually match the QML imports (Lomiri.Components, QtQuick.LocalStorage) and all exist in the archive. Six quilt patches all carry DEP-3 From/Date/Subject headers, each with a clear purpose (Clickable vs distribution install paths, DATA_DIR loading, SURU icon theme). po translations install correctly via the fixed CMAKE_INSTALL_LOCALEDIR. Changelog (35-1 unstable, initial release), Vcs-*, Homepage, gbp.conf, salsa-ci.yml and upstream/metadata are all consistent. Standards-Version 4.7.4 matches current Policy. No autopkgtest is present, which is acceptable for a new package. Nothing a sponsor would require fixing before upload.

Issues

1. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Read debian/copyright in full; DEP-5 format with Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/, Files:* / po/.po / po/ca.po / po/es.po / debian/ stanzas and a standalone GPL-3.0+ License paragraph plus common-licenses pointer.
• Read every source file's licence header: irc_client.cpp, irc_client.h, main.cpp, and all 15 files in qml/ carry Copyright (C) 2018 Rúben Carneiro with GPL-3.0 'or any later version'; matches the Files: * stanza holder.
• LICENSE is verbatim GPL-3 text; consistent with the GPL-3.0+ short name.
• po/*.po (de, el, fi, fr, hu, it, ku, nl, pt, ru, sr, zh_CN) headers say Copyright (c) <year> Rosetta Contributors and Canonical Ltd and distributed under the same license as the chatter package, matching the po stanza; individual Last-Translator names are translators, not holders, and need no separate stanza.
• po/ca.po (Last-Translator Walter Garcia-Fontes) and po/es.po (advocatux) have dedicated copyright stanzas.
• Scan-flagged built file share/locale/ca/LC_MESSAGES/chatter.ruben-carneiro.mo is a compiled gettext catalogue whose source po/ca.po is present in the tree; the build regenerates .mo from .po, so the committed copy is not a DFSG problem.
• Scan-flagged built file share/locale/es/LC_MESSAGES/chatter.ruben-carneiro.mo is a compiled gettext catalogue whose source po/es.po is present in the tree; the build regenerates .mo from .po, so the committed copy is not a DFSG problem.
• Scan's author check found every copyright holder it saw is named in debian/copyright.
• apt-cache confirms runtime deps qml-module-lomiri-components, qml-module-qtquick-localstorage and suru-icon-theme exist in the archive; Build-Depends cmake, intltool, qtdeclarative5-dev, qtquickcontrols2-5-dev exist (qtdeclarative5-dev Depends on qtbase5-dev, covering the Qt5Widgets cmake config the app links).
• QML imports are QtQuick 2.0, Lomiri.Components 1.3 (incl. ListItems), QtQuick.LocalStorage 2.0, chatter 1.0; all covered by declared Depends (qtquick2 and the rest pulled transitively by qml-module-lomiri-components).
• All six patches in debian/patches carry DEP-3 From/Date/Subject and a clear purpose; gbp.conf, salsa-ci.yml, upstream/metadata, Vcs-* and Homepage are consistent; Standards-Version 4.7.4 matches current Policy 4.7.x.
• uscan found the packaged version as the newest upstream release (upstream 35, packaged 35).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed

None.