DFSG NEW review for lomiri-wifiscanner-app version 0.6.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 4 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

DFSG-compliant. Every upstream file is GPL-3: the six app sources carry Copyright (C) 2015 - Michael Zanetti and the GPL version 3 grant, COPYING is the full GPL-3 text, and the remaining build/CI/data files have no separate notice. debian/copyright is DEP-5, matches that, and adds a debian/* GPL-3 stanza for Amin Bandali's packaging and patches. No non-free wording, no vendored third-party code, no built or minified files, and the full GPL-3 text is available through /usr/share/common-licenses/GPL-3. The two Licenses combined in the binary (upstream GPL-3 and debian/ GPL-3) are compatible.

Packaging

Conventional and current: debhelper compat 13 with a plain dh and one CMake override, Standards-Version 4.7.4.1 (the current Policy), Vcs-* fields, good DEP-3 patches with forwarding notes, and build dependencies that match the CMake/Qt5 build. Three small defects remain: the NetworkManager client has no network-manager dependency, two of the four QML runtime dependencies are never imported, and the get-orig-source recipe copied into debian/rules cannot run for this version.

Issues

minor packaging 1. Depends omits network-manager, the app's only data source ◂

• Files: debian/control:20-24, app/wifiscanner.cpp:194, app/wifiscanner.cpp:360
• Basis: checked, in the package or with a reference tool
• Evidence: QDBusInterface iface("org.freedesktop.NetworkManager", "/org/freedesktop/NetworkManager", "org.freedesktop.NetworkManager", QDBusConnection::systemBus()); (also GetDevices, RequestScan, GetAllAccessPoints and PropertiesChanged on the same service); Depends: lists only the four qml modules plus substvars.
• Problem: Everything the program does is a call to NetworkManager on the system bus; with NetworkManager absent it can only print the D-Bus error ("No WiFi device found"). Policy 7.2 says Depends should be used when the other package is required for a significant amount of the package's functionality. Debian's other NetworkManager front ends (nm-connection-editor, plasma-nm) depend on network-manager for this reason.
• Fix: Add network-manager to Depends; if the maintainer prefers the current graceful failure, use Recommends instead.

minor packaging 2. Depends lists qml-module-lomiri-content and qml-module-qtquick-controls2, which no source file imports ◂

• Files: debian/control:22-23, debian/control:13
• Basis: checked, in the package or with a reference tool
• Evidence: The only QML imports in the tree are import QtQuick 2.4, import QtQuick.Layouts 1.1 and import Lomiri.Components 1.3; no QtQuick.Controls or Lomiri Content type is used anywhere in app/*.qml or the C++. qtquickcontrols2-5-dev in Build-Depends is equally unused.
• Problem: Unneeded dependencies pull in the content-hub service and the Controls 2 module for every installation without any code using them; dependencies should reflect what the program imports.
• Fix: Drop qml-module-lomiri-content, qml-module-qtquick-controls2 and qtquickcontrols2-5-dev unless a future feature needs them.

minor packaging 3. debian/rules get-orig-source is broken for 0.6.0: UREV expands to empty ◂

• Files: debian/rules:21, debian/rules:34
• Basis: inferred from what was read, not seen directly
• Evidence: UREV = $(shell echo $(VER) | cut -d"." -f4) with VER = 0.6.0 is empty, and the recipe then runs git checkout "$(UREV)"; the clone target is also $(PKG)-$(VER) (lomiri-wifiscanner-app-0.6.0) rather than the upstream wifiscanner-app-0.6.0.
• Problem: The target cannot produce a tarball: the clone succeeds and the empty git checkout "" aborts the recipe, leaving the clone behind because the || $(RM) -r only covers git clone. The block is also redundant with the working debian/watch.
• Fix: Remove the get-orig-source block and rely on uscan, or derive the checked-out revision from the upstream tag (v$(VER)) and clone into the real upstream directory name.

minor packaging 4. debian/watch is in the old version 4 format ◂

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

• Covered the whole package: all 20 upstream files under the tree (app/, po/, top level) and all eight files of debian/ were read; .pc/ was ignored as instructed and debian/cargo-checksum.json does not exist.
• The prescan's author check named no holder that debian/copyright misses; the only holders found anywhere are Michael Zanetti (2015, in every app source) and Amin Bandali (debian/), both covered by stanzas.
• app.svg is the editable Inkscape SVG (not a rendered/raster image), carries no licence notice of its own, and is covered by the Files: * GPL-3 stanza; it is a source file, not a built one.
• po/wifiscanner.arubislander.pot is xgettext output, but its inputs (the QML sources) are present, so it is not a built file without source; COPYING is the full GPL-3 text.
• No non-free terms (non-commercial, no modification, field-of-use, All rights reserved) occur anywhere in the tree; no bundled third-party library or embedded copy of a Debian library was found.
• Files: * and Files: debian/* match every file in the source, and debian/copyright points only at /usr/share/common-licenses/GPL-3, which exists.
• Standards-Version 4.7.4.1 equals the reviewing system's Policy version 4.7.4.1; debhelper compat is 13; Vcs-Git/Vcs-Browser and Homepage are present and consistent with debian/upstream/metadata.
• All four patches in the series have From/Date/Subject and a Forwarded field, apply to files they name, and the two Debian-only ones (rebranding, sans-serif font) are marked not-needed; no patches are obsolete.
• Build-Depends match the CMake build (cmake, Qt5 base/declarative/controls2 dev); the xgettext invoked by the patched po/CMakeLists.txt is not in Build-Depends but is installed transitively in a build chroot via debhelper -> po-debconf -> gettext, and qtbase5-dev-tools is already a dependency of qtbase5-dev, so neither is reported as a build failure.
• There are no maintainer scripts, no *.maintscript, no debian/tests or autopkgtest (optional, not a Policy violation), and the CMake install rules put the binary in /usr/bin, the desktop file in /usr/share/applications and the icon in /usr/share/icons/hicolor/scalable/apps, all matching the patched app.desktop.
• uscan found the packaged version as the newest upstream release (upstream 0.6.0, packaged 0.6.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed ◂

• debian/copyright credits 2024 Lorenzo Torracchi for Files: *, but no file in the tarball mentions that name (all 18 scanned files carry only Michael Zanetti's 2015 notice). The upstream git history is not in the package, so whether Torracchi is a genuine contributor cannot be checked either way.
• app.desktop (from patch 2010) sets Icon=lomiri-wifiscanner-app.svg while the icon is installed as /usr/share/icons/hicolor/scalable/apps/lomiri-wifiscanner-app.svg; themed icon names are conventionally given without the extension. Whether Qt/Lomiri or GTK still resolves the name with .svg would need a desktop-session test, which could not be run.
• No build or desktop run was possible, so the get-orig-source failure is deduced from the empty UREV and git's handling of an empty revision rather than observed.