DFSG NEW review for lomiri-keepassrx-app version 1.0.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 4 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 6 found

Licensing

Everything in the tree is free: the application is AGPL-3.0-or-later, with GPL-3-only Main.qml, Expat (zxcvvn, build.rs, qmeta-async, the icons8 and KeePassXC icons) and CC0 (paomedia, Simple Icons) parts, and these combine into one AGPLv3 work under GPLv3 section 13, as upstream's COPYING states. debian/copyright is DEP-5 with full licence texts and correct common-licenses pointers, but it is not fully accurate: it gives keepass-rx/assets/icons/C64_Apple.svg as CC0-1.0/Simple Icons while the package's own assets/COPYING calls it GPL-2+ (and ships assets/LICENSE.GPL-2), it attributes the keepass-rs test databases to projectmoon alone, and keepass-rx/src/zxcvbn/dict-src.h is a generated table whose generator input is not shipped.

Packaging

The packaging is mostly sound: compat 13 with dh and the cargo buildsystem, hardening by default, DEP-3 headers on the patches, a correct changelog for an initial upload, Vcs-* and a current Standards-Version. Two real problems remain. The binary package does not depend on the QML modules the application imports (Lomiri.Components, Lomiri.Content, QtQuick.Controls, Qt.labs.settings), so it starts and immediately fails to load Main.qml; and the gettext lookup is done relative to the current working directory, so the 15 translations the build generates into /usr/share/locale are never used when the app is launched from the desktop.

Issues

1. [important] [packaging] Depends omits the QML modules the app imports (Lomiri.Components, Lomiri.Content, QtQuick.Controls, Qt.labs.settings)

• Files: debian/control, keepass-rx/qml/Main.qml:18-22, keepass-rx/qml/pages/AttachmentPage.qml:1-6, keepass-rx/qml/pages/DBList.qml:1-7, keepass-rx/qml/components/EntryItem.qml:1-6
• Basis: checked, in the package or with a reference tool
• Evidence: import Lomiri.Components 1.3, import Lomiri.Content 1.3, import QtQuick.Controls 2.12, import Qt.labs.settings 1.0; debian/control has only Depends: ${misc:Depends}, ${shlibs:Depends}.
• Problem: QML modules are loaded at run time from the Qt import path and are not recorded by dh_shlibdeps, so ${shlibs:Depends} names the Qt libraries only. Nothing in the dependency chain pulls in qml-module-lomiri-components (the apt-cache entry for it shows it brings qml-module-qtquick2, -layouts, -graphicaleffects and -window2, but it is not a dependency of anything here), qml-module-lomiri-content, qml-module-qtquick-controls2 or qml-module-qt-labs-settings. Policy 3.5 requires the dependencies needed for the package to work; the installed app dies with "module "Lomiri.Components" is not installed" and view.set_source("qrc:/qml/Main.qml") never succeeds.
• Fix: Add qml-module-lomiri-components, qml-module-lomiri-content, qml-module-qtquick-controls2, qml-module-qt-labs-settings (and, explicitly, qml-module-qtquick2 and qml-module-qtquick-layouts if you do not want to rely on the lomiri-components chain) to the binary package's Depends.

2. [minor] [licensing] keepass-rx/assets/icons/C64_Apple.svg is documented as CC0-1.0 but the package's own assets/COPYING calls it GPL-2+

• Files: debian/copyright:134-136, keepass-rx/assets/COPYING:87-90, keepass-rx/assets/LICENSE.GPL-2
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: Copyright: Simple Icons / License: CC0-1.0; keepass-rx/assets/COPYING: Files: assets/icons/C64_Apple.svg / Copyright: GPL-2+ (with no License field), and the tarball ships keepass-rx/assets/LICENSE.GPL-2 for it.
• Problem: Two statements in the same source package disagree about the licence of one file, and debian/copyright asserts that nobody holds copyright on it. Both licences are free, so the DFSG is not at risk, but the copyright file is not an accurate description of the file as the package itself documents it, and a licence reviewer or downstream reuser cannot tell which applies.
• Fix: Establish which licence KeePassXC/the Simple Icons repo actually applies to that icon and make the single stanza in debian/copyright (and, ideally, assets/COPYING upstream) say the same thing; if it is GPL-2+, name the holder and use License: GPL-2+.

3. [minor] [licensing] Files: * names projectmoon as the copyright holder of the keepass-rs test databases

• Files: debian/copyright:5-7, keepass-rx/tests/fixtures/README.md, keepass-rx/tests/fixtures/test_db_kdb_with_password.kdb, keepass-rx/tests/fixtures/test_db_with_password.kdbx, keepass-rx/tests/fixtures/test_db_kdbx4_with_password_argon2.kdbx, keepass-rx/tests/fixtures/test_db_kdbx41_with_password_aes.kdbx
• Basis: checked, in the package or with a reference tool
• Evidence: keepass-rx/tests/fixtures/README.md: These four files were copied from the locally cached keepass-rs test resources at commit 0e924b43...; debian/copyright's Files: * stanza says Copyright: 2025 projectmoon.
• Problem: The four test databases are not projectmoon's work; they come from the keepass-rs project, whose authors hold the copyright on them. No stanza names that holder, so the statement in Files: * is wrong for those files. They are test data and are not installed, but debian/copyright must still describe them accurately (Policy 12.5, copyright-format 1.0 section 5).
• Fix: Add a Files: keepass-rx/tests/fixtures/test_db_kdb* stanza naming the keepass-rs authors (with the upstream URL), or ask upstream to drop them from the tarball if they are only needed by the ignored test.

4. [minor] [licensing] keepass-rx/src/zxcvbn/dict-src.h is a generated dictionary table with neither generator nor input shipped

• Files: keepass-rx/src/zxcvbn/dict-src.h:1-6, keepass-rx/src/zxcvbn/zxcvbn.c
• Basis: inferred from what was read, not seen directly
• Evidence: The file is 24,868 lines of packed integer arrays (static const unsigned int DictNodes[84251], EndCountSml[84251]) ending in static const char CharSet[60], with no comment, no licence and no readable word list; zxcvbn.c includes it and has no way to regenerate it.
• Problem: This is generated data (the zxcvbn word-frequency trie) rather than a form a programmer would edit, so it is not the preferred form for modification; nothing in the package produces it or says where it came from, which is the source-completeness question DFSG section 2 and Policy 2.2.1 raise for generated files. It carries no licence notice of its own either.
• Fix: Ship the dictionary generator and word lists from zxcvbn-c (or point at a stable URL for them), and record the file's provenance and licence in the debian/copyright stanza for keepass-rx/src/zxcvbn/.

5. [minor] [packaging] gettext bindtextdomain uses the current working directory, so the installed translations are never found

• Files: keepass-rx/src/main.rs:235-247, keepass-rx/src/build.rs
• Basis: checked, in the package or with a reference tool
• Evidence: let mut app_dir_path = env::current_dir().expect("Failed to get the app working directory"); if !app_dir_path.is_absolute() { app_dir_path = PathBuf::from("/usr"); } let path = app_dir_path.join("share/locale");
• Problem: env::current_dir() always returns an absolute path, so the /usr fallback is dead code and the locale directory is always $PWD/share/locale. build.rs (update_language_files()) writes the 15 compiled .mo files to $INSTALL_DIR/share/locale, i.e. /usr/share/locale in the package, where this code never looks when the app is started from Lomiri or any other session (cwd is the user's home). All the work in po/ is shipped but unused.
• Fix: Patch init_gettext() to bind /usr/share/locale (or the install prefix derived at build time), and forward the patch upstream.

Verified

• The six files the scan listed are KeePass test databases, not built artefacts: keepass-rx/test.kdbx is the project's own fixture (patch 0001 copies it to tests/fixtures/test_saved_searches.kdbx), and keepass-rx/tests/fixtures/test_db_kdb_with_password.kdb, test_db_with_password.kdbx, test_db_kdbx4_with_password_argon2.kdbx, test_db_kdbx41_with_password_aes.kdbx and test_saved_searches.kdbx are the inputs of keepass-rx/tests/load_fixtures.rs. Provenance and passwords are in tests/fixtures/README.md; the only test using them is marked #[ignore = "broken in debian"] by patch 2004. None is installed in the binary package.
• All four holders the author check matched in README.md (projectmoon, Brenno Flávio de Almeida, David Ventura, Ruben De Smet with Markus Törnqvist) are named in debian/copyright; the check's suffix differences are its own matching artefacts.
• File headers agree with the stanzas: Main.qml GNU General Public License ... version 3 (GPL-3, no "or later") matches License: GPL-3; main.rs version 3 matches AGPL-3.0; actor/mod.rs and actor-macro/src/lib.rs carry the Whisperfish AGPL-3+ text with Ruben De Smet/Markus Törnqvist and projectmoon, matching their stanza; build.rs is Olivier Goffart's Expat notice (projectmoon's later additions are covered by Files: *); zxcvbn.c/.h are Tony Evans' Expat.
• All 69 keepass-rx/assets/icons/*.svg files (C00 to C68, no gaps; build.rs asserts the count) are matched by one of the four icon stanzas plus the catch-all: 51 icons8/Expat, 12 paomedia/CC0-1.0, 5 KeePassXC/Expat, C64_Apple/Simple Icons.
• debian/missing-sources/qmeta-async (Cargo.toml, LICENSE, src/, qmeta-async-macros/, tests/) is Ruben De Smet's MIT code, used through the path dependency patch 2001 puts in keepass-rx/Cargo.toml; its stanza and the Expat text in debian/copyright match its LICENSE.
• No non-free terms in the tree: the only mention of the non-free Good Boy License is debian/copyright's note that it was not chosen; deny.toml's allow-list and the licence texts present (AGPL-3, GPL-3, GPL-2, Expat, CC0) contain no field-of-use or no-modification clauses beyond upstream's own AGPL.
• debian/copyright is DEP-5 with the correct Format: URL, a stand-alone License paragraph for each short name it uses, and /usr/share/common-licenses pointers for AGPL-3.0 and GPL-3; it needs no replacement.
• The xgettext/msgmerge/msgfmt calls build.rs makes are covered without an explicit Build-Depends: debhelper depends on po-debconf, which depends on gettext (apt-cache).
• qtwebengine5-dev is needed: build.rs emits cargo:rustc-link-lib=Qt5WebEngine on every platform, not only in the macOS branch; qtchooser is present (66-2) and qmake comes with qtbase5-dev.
• override_dh_auto_test-arch / override_dh_auto_test-indep are valid targets (dh(1): "targets with names like override_dh_command-arch"); at compat 13 dh skips them under DEB_BUILD_OPTIONS=nocheck, so no nocheck check is needed in them.
• patch 0001 is a 102 KB backport of upstream's post-1.0.0 keepass-rs update (Origin: upstream, untagged 1.0.1) that also adds tests/load_fixtures.rs, the fixtures and the mirror_from_macro workspace crate; patches 1001/2001/2002/2004 carry DEP-3 headers, 2001 and 2004 without a Forwarded field, which is the only thing missing there.
• The empty override_dh_install and the duplicate cargo prepare-debian in execute_before_dh_auto_configure are unexplained but harmless: dh_install has nothing to move and dh-cargo's configure runs prepare-debian again.
• cargo-about is not in Debian, so build.rs's fallback (pub static LICENSES: &[License] = &[];) leaves the in-app Licenses page empty; not something the packager can fix here.
• I read all of debian/ and sampled the upstream tree directory by directory (Rust sources, all QML files, every licence and COPYING file, patches, Cargo.toml/lock); I did not read the .kdb/.kdbx or .png files, or all 24,868 lines of dict-src.h.
• uscan found the packaged version as the newest upstream release (upstream 1.0.0, packaged 1.0.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (AGPL-3.0, CC0-1.0, GPL-3).

Not confirmed

• Build-Depends names librust-libsodium-rs-0.2+default-dev (>= 0.2.1) (Cargo.lock pins libsodium-rs 0.2.4), but apt-cache finds neither that name nor librust-libsodium-rs-dev in the package lists or in the NEW queues. If it is genuinely not in the archive the build cannot start; it may have been accepted after the lists were downloaded.
• Whether the other keepass-rx/qml/pages/*.qml and components are derived from David Ventura's original Keepass app: upstream's COPYING says The code of the original UI is Copyright (C) 2021 David Ventura under the GNU GPLv3 (no later versions), but only Main.qml keeps his notice and debian/copyright names him for Main.qml only, so a GPL-3-only portion may be described as AGPL-3.0+.
• override_dh_auto_install duplicates dh-cargo's install but drops its dh-cargo-built-using call, and debian/control names neither Built-Using nor Static-Built-Using; option-ext 0.2.0 (MPL-2.0, via dirs-sys) is statically linked, which the Rust team's tooling would normally record in Built-Using.
• I could not verify the claim in debian/copyright that the icons8 flat-color-icons are dual-licensed under Expat and the non-free Good Boy License; the decision to ship them rests on that claim.

Proposed changes

None.