DFSG NEW review for ltrsift version 1.0.2-12

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

The package is DFSG-compliant: all upstream code is GPL-2+ (headers say 'either version 2 ... or any later version', matching the shipped GPL-2 LICENSE) and scripts/tar_root.sh is ISC, both correctly. No non-free terms, no JSON-type clauses, no embedded non-free third-party code, no binary blobs lacking source (the one gzip is a freely-available reference genome shipped as sample data). However debian/copyright is slightly inaccurate: the GPL Files: * stanza omits the institutional holder Center for Bioinformatics, University of Hamburg, which heads virtually every src/*.c/h file and the Makefile. The prescan's three 'missing' holders are false positives (Sascha Kastens/Steinbiss are named; the FSF line is just the embedded GPL-3 about-dialog text).

Packaging

Good quality packaging: debhelper-compat 14, clean dh sequence, hardening=+all, correct Build-Depends (libgenometools0-dev, libglib2.0-dev, libgtk-3-dev), both Recommends exist (last-align, ncbi-blast+), Standards-Version 4.7.4 current, sensible binary split (ltrsift + ltrsift-sample for data), autopkgtests plus a GUI regression test, well-documented DEP-3 patches with Bug-Debian references. No policy violations or broken-upgrade risks found.

Issues

1. [important] [licensing] debian/copyright Files: * stanza omits a copyright holder

• Files: debian/copyright (Files: * stanza), src/ltrsift.c, src/message_strings.h, Makefile
• Basis: checked, in the package or with a reference tool
• Evidence: Headers, e.g. src/ltrsift.c:2-3 Copyright (c) 2011-2012 Sascha Kastens ... / Copyright (c) 2011-2012 Center for Bioinformatics, University of Hamburg; Makefile:3 Copyright (c) 2012-2013 Center for Bioinformatics, University of Hamburg. The Files: * stanza lists only 2012 Sascha Steinbiss and 2012 Sascha Kastens.
• Problem: The institutional holder Center for Bioinformatics, University of Hamburg heads essentially every source file and the Makefile, so the catch-all stanza does not accurately name all copyright holders for the bulk of the code. It appears only in the separate ISC stanza for scripts/tar_root.sh (why the loose author-check passed), which does not cover the GPL files. The licence itself (GPL-2+) is correct, so this is an incompleteness, not a DFSG problem.
• Fix: Add Center for Bioinformatics, University of Hamburg to the Copyright: list of the Files: * stanza (optionally with the year range 2011-2013 used in sources).

Verified

• debian/copyright is in machine-readable DEP-5 format with a valid Format line; it has a Files: * GPL-2+ stanza, an ISC stanza for scripts/tar_root.sh, and no Files-Excluded.
• Read debian/copyright, control, rules, changelog (full history to 1.0.1-1), source/format (3.0 quilt), dirs, all .install/.docs/*.manpages, tests/control and both test scripts, README.test, upstream/metadata, salsa-ci.yml, and all seven patches in debian/patches/series.
• All 29 upstream src/*.c/.h files carry a GPL-2+ header ('either version 2 of the License, or (at your option) any later version') with holders Sascha Kastens and Center for Bioinformatics, University of Hamburg; LICENSE is GPL-2; scripts/tar_root.sh is ISC.
• Read the embedded GPL text in src/message_strings.h: the prescan-cited FSF holder and the GUI_COPYRIGHT names (Sascha Kastens, Sascha Steinbiss, Center for Bioinformatics) are the GTK about-dialog strings, all already named in debian/copyright (except the Center, see issue).
• sample_data/dmel-2L-chromosome-r5.8.fasta.gz is a gzipped FASTA of the D. melanogaster 2L chromosome, freely-published reference genome data shipped as sample data; its raw source is obtained by gunzip, so not a non-free or missing-preferred-form concern. It is installed only in the ltrsift-sample package.
• filters/*.lua, sample_data scripts, style/default.style, Makefile, run_ltrsift, VERSION, CHANGELOG carry no separate header but fall under the upstream Files: * GPL-2+ catch-all; no conflicting or additional licences found by grep across the tree.
• debian/ltrsift.svg is derived from a Novell 'familysearch' icon with embedded CC/GPL-2.0 RDF metadata crediting Lapo Calamandrei and Jakub Steiner; GNU GPL-2 is compatible with the package's GPL-2+ and it is covered by the Files: * stanza.
• Both Recommends (last-align, ncbi-blast+) and Build-Depends (libgenometools0-dev) resolve in the archive via apt-cache.
• Patches are DEP-3 commented, several with Bug-Debian references (#967603, #1126708, #1105470); gtk3 and use-after-free and shuffled-build patches have clear purpose.
• Standards-Version 4.7.4 against current Policy 4.7.4.1: first two components match, so fine. debhelper-compat 14: substvars auto-added, Depends correctly lists them.
• uscan found the packaged version as the newest upstream release (upstream 1.0.2, packaged 1.0.2).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed

• The autopkgtests (run-unit-test and gui-project-creation) were not executed here; their logic and the referenced binary ltrsift_encode and sample-data paths were read and appear consistent, but actual pass/fail is unverified.
• The binary .so/.a dependencies on libgenometools and the GTK-3 API changes in gtk3.patch were not compiled; only inspected as source. A genuine build failure is not otherwise suggested by anything in the tree.

Proposed changes

None.