DFSG NEW review for nemo-qml-plugin-dbus version 2.1.39-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 0 blocker, 4 important, 5 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The code itself is DFSG-free and the licences combine cleanly: src/nemo-dbus/* is BSD-3-clause and src/plugin/* is LGPL-2.1-only, so the LGPL plugin may link the BSD library. debian/copyright is DEP-5 and names every holder found in the headers, but it does not describe two subtrees correctly: doc/ is offered under GFDL-1.3 by the documentation configuration while the file puts it under the BSD-3-clause catch-all, and tests/auto/tst_dbus.qml grants BSD-3-clause while the tests/* stanza says LGPL-2.1.

Packaging

The skeleton is sound (compat 14, dh with --buildsystem=qmake6, hardening, 3.0 quilt source, DEP-3 patch, Standards-Version 4.7.4), but there are concrete defects a sponsor would send back: the development package is not named libnemodbus-dev as Policy 8.4 requires, it does not depend on qt6-base-dev although every installed header includes QtDBus, and debian/ still carries leftovers of the abandoned libnemodbus-dev/Qt5 packaging. No autopkgtest exists and the upstream tests the package ships cannot be built or run.

Issues

1. [important] [licensing] doc/ is offered under GFDL-1.3 but debian/copyright covers it with the BSD-3-clause Files: * stanza

• Files: debian/copyright:5-11, doc/nemo-qml-plugin-dbus.qdocconf:28-35, doc/src/index.qdoc, doc/src/examples.qdoc
• Basis: inferred from what was read, not seen directly
• Evidence: doc/nemo-qml-plugin-dbus.qdocconf:28-35 sets the manual's footer to " <p><acronym title=\"Copyright\">&copy;</acronym> 2021 Jolla OY</p>\n" and " This document may be used under the terms of the " " <a href=\"http://www.gnu.org/licenses/fdl.html\">GNU Free Documentation License version 1.3</a>". debian/copyright has no GFDL stanza; the only stanza matching doc/ is Files: * ... License: BSD-3-clause (lines 5-11).
• Problem: The documentation sources in doc/ (index.qdoc, examples.qdoc, built into the manual) are granted under GFDL-1.3, but debian/copyright declares them BSD-3-clause and never mentions GFDL, so the file misstates the licence of a whole directory (copyright-format 6.7: the License field must state the actual licence).
• Fix: Add a stanza after Files: *: Files: doc/* / Copyright: 2021 Jolla OY / License: GFDL-1.3, plus a stand-alone License: GFDL-1.3 paragraph pointing at /usr/share/common-licenses/GFDL-1.3 (the file exists) and noting that no invariant sections or cover texts are declared.

2. [important] [licensing] Files: tests/* says LGPL-2.1 but tests/auto/tst_dbus.qml grants BSD-3-clause

• Files: debian/copyright:17-21, tests/auto/tst_dbus.qml:1-27
• Basis: checked, in the package or with a reference tool
• Evidence: tests/auto/tst_dbus.qml:3,9: ** Copyright (C) 2013 Jolla Ltd. ... ** This file is part of Sailfish Silica UI component package. / ** You may use this file under the terms of BSD license as follows:; debian/copyright:17-21 matches Files: tests/* with License: LGPL-2.1.
• Problem: The stanza that applies to tst_dbus.qml names a licence the file does not grant (the file is BSD-3-clause, not LGPL-2.1); the two other test files (tst_dbus_interface.qml, dbustestd.c) are indeed LGPL-2.1, so the pattern is simply too broad. A downstream user reading debian/copyright would apply the wrong terms.
• Fix: Add a later, more specific stanza: Files: tests/auto/tst_dbus.qml / Copyright: 2013 Jolla Ltd / License: BSD-3-clause (the BSD-3-clause paragraph already exists), leaving the rest of tests/ under LGPL-2.1.

3. [important] [packaging] Development package is nemo-qml-plugin-dbus-dev, not libnemodbus-dev as Policy 8.4 requires

• Files: debian/control:29-31, debian/nemo-qml-plugin-dbus-dev.install, debian/libnemodbus-dev/usr/share/doc/libnemodbus-dev/
• Basis: checked, in the package or with a reference tool
• Evidence: Package: nemo-qml-plugin-dbus-dev next to Package: libnemodbus1; debian/libnemodbus-dev/usr/share/doc/libnemodbus-dev/ already exists. Policy 8.4: 'the source package needs to generate a binary development package named libraryname-dev'.
• Problem: The development files of libnemodbus are shipped in a package named after the source package instead of after the library, contrary to Policy 8.4, so the naming no longer tells users which library the package belongs to and differs from the name the maintainers evidently intended (the leftover debian/libnemodbus-dev tree).
• Fix: Rename the binary package to libnemodbus-dev, rename debian/nemo-qml-plugin-dbus-dev.install accordingly, and delete the stale debian/libnemodbus-dev/ directory.

4. [important] [packaging] nemo-qml-plugin-dbus-dev does not depend on qt6-base-dev although its installed headers include QtDBus headers

• Files: debian/control:29-38, src/nemo-dbus/dbus.h:38-42, src/nemo-dbus/response.h:38-39, debian/nemo-qml-plugin-dbus-dev.install:1-6
• Basis: checked, in the package or with a reference tool
• Evidence: deb.h installs usr/include/nemo-dbus/dbus.h, which does #include <QDBusArgument>, <QDBusConnection>, <QDBusMessage>, <QDBusVariant>; response.h includes <QDBusPendingCallWatcher> and <QDBusPendingReply>. The package's Depends: is only libnemodbus1 (= ${binary:Version}), ${misc:Depends}.
• Problem: Compiling against the installed headers — or running pkg-config --cflags nemodbus, whose generated nemodbus.pc requires Qt6DBus — needs the QtDBus development headers, which only qt6-base-dev provides; libnemodbus1 and its shlibs dependency give the runtime library, not the headers. Policy 8.4: installing the development package must install all development files needed to compile against the library.
• Fix: Add qt6-base-dev to the development package's Depends.

5. [minor] [packaging] qml6-module-nemo-qml-plugin-dbus is Section: libdevel; QML runtime modules belong in libs

• Files: debian/control:40-42
• Basis: checked, in the package or with a reference tool
• Evidence: Package: qml6-module-nemo-qml-plugin-dbus ... Section: libdevel; Debian's own qml6-module-qtquick (apt-cache) is Section: libs.
• Problem: The package contains a runtime QML module (plugin .so, qmldir, plugins.qmltypes), not development files, so it is filed under the wrong section of the archive (Policy 2.4, sections).
• Fix: Set Section: libs for qml6-module-nemo-qml-plugin-dbus.

6. [minor] [packaging] Stale Qt5-era and abandoned dev-package files left under debian/old/ and debian/libnemodbus-dev/

• Files: debian/old/libnemodbus-dev.install, debian/old/libnemodbus1.install, debian/libnemodbus-dev/usr/share/doc/libnemodbus-dev/changelog.Debian, debian/libnemodbus-dev/usr/share/doc/libnemodbus-dev/copyright
• Basis: checked, in the package or with a reference tool
• Evidence: debian/old/libnemodbus1.install contains usr/lib/*/qt5/qml/Nemo/DBus; debian/libnemodbus-dev/usr/share/doc/libnemodbus-dev/changelog.Debian is an older 2.1.39-1 entry dated Mon, 16 Mar 2026 04:39:11 +0000 without the Split into packages and Polish and update d/copyright lines, while debian/changelog has Sun, 01 Nov 2026 10:35:26 +0000.
• Problem: None of these paths corresponds to a binary package in debian/control: they are dead copies from the Qt5 packaging and from the earlier name of the development package, and the copy of debian/copyright and the changelog in them is already out of date, which invites confusion about which files are authoritative.
• Fix: Delete debian/old/ and debian/libnemodbus-dev/ (see also the package-rename issue).

7. [minor] [packaging] changelog says 'Initial release' twice in 2.1.39-1 and re-closes #1022917, already closed in 2.1.30-1

• Files: debian/changelog:1-10, debian/changelog:12-19
• Basis: checked, in the package or with a reference tool
• Evidence: 2.1.39-1 lists * Initial release (Closes: #1022917), * Initial release (Closes: #1135244) and * Migrate to Qt6, while the 2.1.30-1 entry already reads * Initial release. (Closes: #1022917: ITP: nemo-qml-plugin-dbus -- Nemo QML Plugin D-Bus); New upstream release also appears in both entries.
• Problem: 2.1.39-1 is not an initial release, and a bug that a previous upload already closed cannot be closed again; dpkg-genchanges will put both bug numbers in the upload's Closes list, attributing to this upload changes it does not contain, and the log no longer records reliably what was done.
• Fix: Keep one concise list for 2.1.39-1 (new upstream release, Qt6 migration, package split, copyright work) and close only the bug that belongs to this package and is still open, if any.

8. [minor] [packaging] No autopkgtest, and the upstream tests the package ships cannot be built or run

• Files: debian/patches/0001-Do-Not-Build-Tests-And-Docs, tests/auto/tst_dbus_interface.qml:24-27, tests/tests.pro, tests/dbustestd/Makefile:10-11
• Basis: checked, in the package or with a reference tool
• Evidence: The only patch changes SUBDIRS += src tests doc to SUBDIRS += src, so nothing under tests/ is built; tst_dbus_interface.qml imports org.nemomobile.dbus 2.0 (the Qt5 module name, while src/plugin/qmldir declares module Nemo.DBus) and QtTest 1.0/QtQuick 2.0; tests/dbustestd/Makefile builds against DBUS_GMAIN_DIR := dbus-gmain, whose directory in the tarball is empty (a git submodule).
• Problem: The source carries a test suite that is neither built nor runnable as shipped (Qt5 imports, missing dbus-gmain sources), and debian/ has no debian/tests/, so the package's only automated check anywhere is the build itself. Nothing in Debian exercises the QML module.
• Fix: Add debian/tests/control with a test that installs the package and imports the Nemo.DBus module (e.g. qml6 runtime via qmlscene/qml6 + dbus-run-session), and say in the patch header (or forward the patch upstream) that the Qt5-era tests and the sailfish-qdoc-template documentation cannot be built against Qt6.

9. [minor] [packaging] dh-sequence-pkgkde-symbolshelper is a build-dependency with no symbols file to act on

• Files: debian/control:6-13
• Basis: inferred from what was read, not seen directly
• Evidence: Build-Depends: ... dh-sequence-pkgkde-symbolshelper, ...; there is no debian/*.symbols file in the package.
• Problem: The sequence exists to merge pkg-kde-tools' symbols-file handling into dh_makeshlibs; with no symbols file it has nothing to do, so it pulls pkg-kde-tools into the build chroot for no benefit.
• Fix: Drop dh-sequence-pkgkde-symbolshelper, or add a debian/libnemodbus1.symbols file if ABI tracking is wanted (a C++ library benefits from one, which would also make the build-dependency meaningful).

Verified

• debian/copyright read in full: DEP-5 with the exact 1.0 Format URL, four Files stanzas (*, src/plugin/*, tests/*, debian/*), stand-alone License paragraphs for BSD-3-clause (full text) and LGPL-2.1 (pointer to /usr/share/common-licenses/LGPL-2.1, which exists); no Files-Excluded.
• Licence headers read on all 18 files under src/nemo-dbus/ including private/: You may use this file under the terms of the BSD license, holders Jolla Ltd (2016-2021) and Open Mobile Platform LLC (2021) — both named in the Files: * stanza; all 7 files under src/plugin/ carry the LGPL-2.1-only grey header naming Jolla Ltd (2013-2018), matching the src/plugin/* stanza.
• Prescan hits accounted for: Jolla Ltd Contact: Andrew den Exter <andrew.den.exter@jolla.com> in src/nemo-dbus/connection.cpp:2, connection.h:2, dbus.h:2 and the other 19 src/nemo-dbus files (headers: Copyright (C) 2016 Jolla Ltd plus a Contact line), and Jolla Ltd. Contact: Simo Piiroinen <simo.piiroinen@jollamobile.com> in tests/auto/tst_dbus_interface.qml:3 and tests/dbustestd/dbustestd.c:3; both names appear in debian/copyright (Files: * lists Andrew den Exter <andrew.den.exter@jolla.com>; Files: tests/* lists Simo Piiroinen <simo.piiroinen@jollamobile.com>), so no holder is missing.
• tests/auto/tst_dbus_interface.qml and tests/dbustestd/dbustestd.c are LGPL-2.1-only and match the tests stanza; only tests/auto/tst_dbus.qml differs, and that is reported as an issue.
• license.lgpl is the LGPL-2.1 text and license.bsd is the BSD-3-clause text reproduced verbatim in debian/copyright; there is no other COPYING/NOTICE/AUTHORS file anywhere in the tree; grep for non-commercial, no-modification, field-of-use, CC-*-NC/ND and similar wording found none, and All rights reserved appears only next to a real licence grant.
• Libre compatibility: the LGPL-2.1-only QML plugin links the BSD-3-clause libnemodbus, and the installed headers are the BSD ones, so the combination is fine and nothing LGPL is installed for reuse.
• tests/dbustestd/dbus-gmain is an empty directory (a git submodule, .gitmodules -> sailfishos-mirror/dbus-glib), so no vendored dbus-glib code is shipped; the only third-party code in the tree is upstream's own.
• src/plugin/plugins.qmltypes is generated (qmlplugindump -nonrelocatable Nemo.DBus 2.0); its inputs, the C++ sources in src/plugin/, are present, so it is not a built file without source. No other generated, minified or binary file was found in the tree.
• debian/rules: compat 14, dh $@ --buildsystem=qmake6, DEB_BUILD_MAINT_OPTIONS = hardening=+all; debhelper's qmake6 buildsystem (qmake6.pm -> qmake.pm) passes the dpkg-buildflags CFLAGS/CXXFLAGS/LDFLAGS as QMAKE_CFLAGS/CXXFLAGS/LDFLAGS_RELEASE and _DEBUG with PREFIX=/usr, so hardening flags reach the compiler.
• ${source:Synopsis}/${source:Extended-Description} in debian/control are real dpkg substvars (set_desc_substvars in /usr/share/perl5/Dpkg/Substvars.pm), not unknown ones, and at compat 14 dh_gencontrol adds the relationship substvars itself.
• Standards-Version 4.7.4 against Policy 4.7.4.1 — the first two components match, so no issue.
• Build-dependencies are satisfiable: qmake6 comes with qt6-base-dev; dh-sequence-qmldeps and dh-sequence-pkgkde-symbolshelper are virtual packages provided by pkg-kde-tools 0.22.1 (apt-cache); libnemodbus1 is a binary of this source package, not an archive package.
• The single patch has a DEP-3 header (Description, Author, Origin: vendor, Forwarded: no) and its effect is visible in the applied dbus.pro (SUBDIRS += src); removing doc from the build is necessary because doc.pro needs sailfish-qdoc-template, and tests.pro installs to /opt, which Policy 10.1 disallows.
• debian/source/format is 3.0 (quilt); Vcs-Git/Vcs-Browser and Homepage are present; there are no maintainer scripts or *.maintscript files; gbp.conf matches the debian/latest + upstream/latest + pristine-tar workflow.
• uscan found the packaged version as the newest upstream release (upstream 2.1.39, packaged 2.1.39).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (LGPL-2.1).

Not confirmed

• Whether libnemodbus is built versioned at all: src/nemo-dbus/nemo-dbus.pro sets only QMAKE_PKGCONFIG_VERSION = $$VERSION and never VERSION itself, upstream's rpm spec supplies it (%qmake5 "VERSION=%{version}"), and debhelper's qmake6 buildsystem (qmake.pm read: -makefile, flags, PREFIX=/usr) passes no VERSION. If qmake6 then emits an unversioned libnemodbus.so, libnemodbus1.install's usr/lib/${DEB_HOST_MULTIARCH}/libnemodbus.so.* matches nothing (dh_install aborts with 'missing files, aborting', /usr/bin/dh_install:315), the only library ends up in the -dev package, libnemodbus1 is empty, and nemodbus.pc has an empty Version. A build's debian/tmp would settle it; qmake is not installed here, so the default was not checked.
• The Vcs-Browser/Vcs-Git URLs point into .../DebianOnMobile-team/puremaps/nemo-qml-plugin-dbus, a repository named after an unrelated package; with no network access I could not check that it exists or holds this package.
• Without a build I could not confirm that the qmake install paths (target.path = $$[QT_INSTALL_LIBS], qmldir.path = $$[QT_INSTALL_QML]/Nemo/DBus under PREFIX=/usr) resolve to exactly the multiarch paths used in the three .install files.

Proposed changes

None.