DFSG NEW review for mpvqt version 1.2.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 2 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every licence in the tree is free and DFSG-compliant: LGPL-2.1-only / LGPL-3.0-only / LicenseRef-KDE-Accepted-LGPL in src/, MIT in examples/, BSD-3-Clause for the CMake files, CC0-1.0 for README.md and the CI dotfiles. debian/copyright is in DEP-5 format and matches the header notices for src/, examples/ and the CMake files, but it is inaccurate for three CI files, which carry CC0-1.0 while Files: * says LGPL, and for debian/rules, which is LGPL-2.0-or-later by Jonathan Riddell while Files: debian/* says GPL-3.0-or-later. The LGPL-2.1-only and LGPL-3.0-only stand-alone paragraphs also quote the wrong licence notices.

Packaging

The packaging is clean and follows current KDE/Qt6 practice: compat 14 with a bare dh sequencer, hardening=+all, correct binary split and Multi-Arch: same on the library, symbols file with Build-Depends-Package, and build dependencies that match what the CMake build actually looks for. The install patterns are right despite the library's odd 1.2.1/SOVERSION 4 naming, and both dh sequences exist in the archive. Only cosmetic wording in the descriptions was noticed, which is below the reporting threshold.

Issues

1. [important] [licensing] Files: * names the LGPL triple licence for the CC0-1.0 files .gitignore, .gitlab-ci.yml and .kde-ci.yml

• Files: .gitignore:4, .gitlab-ci.yml:2, .kde-ci.yml:2, debian/copyright:5-7, debian/copyright:9-11
• Basis: checked, in the package or with a reference tool
• Evidence: .gitignore, .gitlab-ci.yml and .kde-ci.yml each say SPDX-License-Identifier: CC0-1.0 (.gitignore also SPDX-FileCopyrightText: 2023 George Florea Bănuș); the only CC0-1.0 stanza in debian/copyright is Files: README.md (lines 9-11), and no other stanza matches these three, so Files: * (lines 5-7) with License: LGPL-2.1-only or LGPL-3.0-only or LicenseRef-KDE-Accepted-LGPL applies to them.
• Problem: In a DEP-5 file the last matching stanza wins and * also matches leading dots, so debian/copyright states a licence for these files that their own notices contradict; the file therefore does not accurately describe the licensing of every file in the source.
• Fix: Extend the CC0-1.0 stanza, e.g. Files: README.md .gitignore .gitlab-ci.yml .kde-ci.yml with the CC0-1.0 licence paragraph, so that the licence of each of these files is stated as their notices give it.

2. [important] [licensing] Files: debian/* gives GPL-3.0-or-later for debian/rules, which is LGPL-2.0-or-later, and does not name its holder Jonathan Riddell

• Files: debian/rules:2-3, debian/copyright:30-33
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules: # SPDX-License-Identifier: LGPL-2.0-or-later and # SPDX-FileCopyrightText: 2023 Jonathan Riddell <jr@jriddell.org>; debian/copyright lines 30-33: Files: debian/* / Copyright: 2024 Rik Mills / 2024 Scarlett Moore <sgmoore@debian.org> / License: GPL-3.0-or-later.
• Problem: debian/rules is the one file under debian/ whose notice states a different licence (LGPL-2.0-or-later) and a holder (Jonathan Riddell) that the debian/* stanza omits, so the packaging copyright is inaccurate for that file.
• Fix: Add a stanza for debian/rules with Copyright: 2023 Jonathan Riddell <jr@jriddell.org> and a stand-alone License: LGPL-2.0-or-later paragraph, or, if relicensing is intended, change the SPDX header in debian/rules to GPL-3.0-or-later so header and copyright agree.

3. [minor] [licensing] The LGPL-2.1-only and LGPL-3.0-only License paragraphs quote the wrong notices and mislabel the common-licenses pointer

• Files: debian/copyright:44-50, debian/copyright:53-59
• Basis: checked, in the package or with a reference tool
• Evidence: Under License: LGPL-2.1-only: either version 2.1 of the License, or (at your option) any later version. followed by the complete text of the GNU General Public License version 3 can be found in "/usr/share/common-licenses/LGPL-2.1". Under License: LGPL-3.0-only: This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License ... either version 3 of the License, or (at your option) any later version.
• Problem: Both short names say -only, but the quoted grant text says or any later version; the LGPL-2.1 paragraph calls the LGPL-2.1 file the GPL version 3, and the LGPL-3.0 paragraph quotes the GPL-3 notice instead of the LGPL-3 one. The pointers themselves are to the right files in /usr/share/common-licenses, so the licence text is available, but the descriptions contradict the short names they belong to.
• Fix: Replace both bodies with the matching GNU Lesser General Public License notices ('This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1/3 of the License ...') and correct the sentence to say 'the GNU Lesser General Public License version 2.1/3'.

Verified

• Licensing: every upstream file (6 top-level files, 6 in LICENSES/, cmake/FindLibmpv.cmake, 12 in examples/, 9 in src/) was opened or grepped; each carries an SPDX-License-Identifier header, and no file in the tree lacks a licence statement.
• src/*.cpp and .h (including the private _p.h headers) are LGPL-2.1-only OR LGPL-3.0-only OR LicenseRef-KDE-Accepted-LGPL, matching Files: *; examples/.cpp, .h and Main.qml are MIT, matching Files: examples/*; the two examples//CMakeLists.txt are BSD-3-Clause, and the later BSD-3-Clause stanza names them explicitly, so they are not caught by the MIT stanza.
• Top-level CMakeLists.txt, MpvQtConfig.cmake.in, src/CMakeLists.txt and cmake/FindLibmpv.cmake are BSD-3-Clause with the four holders named in the BSD stanza (Montel, Becker, Angelaccio, Bănuș), matching debian/copyright:17-28.
• README.md is CC0-1.0, matching its stanza; LICENSES/*.txt are the standard licence texts shipped by upstream (MIT and BSD-3-Clause templates, LGPL-2.1, LGPL-3, CC0-1.0 and the KDE Accepted LGPL text, the last matching the stand-alone LicenseRef paragraph verbatim); they are covered by Files: * and exist only as REUSE licence references.
• All licences used (LGPL-2.1/3.0, KDE Accepted LGPL, MIT, BSD-3-Clause, CC0-1.0) are free; no non-commercial, no-modification, field-of-use or 'good, not evil' wording occurs anywhere in the tree, and /usr/share/common-licenses/{LGPL-2.1,LGPL-3,CC0-1.0,GPL-3} all exist.
• No compiled, generated, minified or archive files, no images, fonts or firmware, and no vendored third-party code in the tree; the only non-source artefacts are the licence texts above and debian/upstream/signing-key.asc.
• The orig tarball is plain upstream (mpvqt-1.2.1/, no debian/), signed beside it, so no repack and no Files-Excluded are needed; the debian tarball contains exactly the contents of the unpacked debian/ directory.
• Packaging read in full: debian/control, rules, changelog, copyright, salsa-ci.yml, source/format, upstream/metadata, upstream/signing-key.asc, libmpvqt4.install, libmpvqt-dev.install, libmpvqt-dev.examples, libmpvqt4.symbols; there is no debian/patches, no maintainer script and no debian/tests.
• At compat 14 dh_gencontrol adds relationship substvars itself, so the absence of ${shlibs:Depends}/${misc:Depends} from debian/control is correct (checked with the debhelper tool for compat 14).
• Both dh-sequence Build-Depends exist: dh-sequence-kf6 and dh-sequence-pkgkde-symbolshelper are provided by pkg-kde-tools 0.22.1 (apt-cache).
• Standards-Version 4.7.4 is current: the reviewing system's Policy is 4.7.4.1.
• libmpvqt4.install is right despite the odd naming: src/CMakeLists.txt sets VERSION ${MPVQT_VERSION} (1.2.1) with SOVERSION 4, so the build produces libMpvQt.so.1.2.1 with libMpvQt.so.4 and libMpvQt.so symlinks; usr/lib/*/libMpvQt.so.4 and usr/lib/*/libMpvQt.so.1.* cover the runtime side and the dev .install takes libMpvQt.so, headers and CMake package files.
• The installed public headers (mpvabstractitem.h, mpvcontroller.h) include <mpv/client.h>, <mpv/render_gl.h> and <QtQuick/QQuickFramebufferObject>, so libmpvqt-dev's Depends on libmpv-dev, qt6-base-dev and qt6-declarative-dev are the required ones; symbols file uses * Build-Depends-Package: libmpvqt-dev and is arch-annotated as Multi-Arch: same requires.
• debian/rules runs the plain dh $@ sequencer with hardening=+all; the changelog's SONAME rename libmpvqt3 -> libmpvqt4, distribution (experimental) and the #1143676 closure in 1.2.0-3 are consistent; the pre-review scan's holder check found no holder missing from debian/copyright.
• uscan found the packaged version as the newest upstream release (upstream 1.2.1, packaged 1.2.1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC0-1.0, GPL-3, LGPL-2.1, LGPL-3).

Not confirmed

• src/CMakeLists.txt installs the QML metatypes JSON only when ECM_VERSION >= 6.27, while debian/control allows extra-cmake-modules (>= 6.15.0~); on an ECM older than 6.27 the usr/lib/*/qt6/metatypes/ line in libmpvqt-dev.install would match nothing and the file fixed for #1143676 would silently not be shipped. A build would show which ECM the archive has; no failure is inferred here.

Proposed changes

None.