Review: nemo-qml-plugin-dbus 2.1.39+dfsg-3
Package Information
| Description | Nemo Qt6 QML Plugin D-Bus The nemo-dbus library provides C++11 extensions to QtDBus to make it easier to call and handle the replies from asynchronous DBus methods. |
|---|---|
| Maintainer | DebianOnMobile Team <debian-on-mobile-maintainers@alioth-lists.debian.net> |
| Changed By | Yifei Zhan <debian@zhan.science> |
| Distribution | experimental |
| Architecture | any |
| VCS | git: https://salsa.debian.org/DebianOnMobile-team/puremaps/nemo-qml-plugin-dbus.git (browse) |
| Closes | #1022917, #1135244 |
| Tracker | https://tracker.debian.org/pkg/nemo-qml-plugin-dbus |
| Uploaded | 2 days ago |
New Package Report
.changes
| Source | nemo-qml-plugin-dbus |
|---|---|
| Version | 2.1.39+dfsg-3 |
| Changed-By | Yifei Zhan <debian@zhan.science> |
| Architecture | source amd64 |
| Distribution | experimental |
| Date | Thu, 05 Nov 2026 09:15:46 +0000 |
Changelog
nemo-qml-plugin-dbus (2.1.39+dfsg-3) experimental; urgency=medium . [ Yifei Zhan ] * Split into packages * Polish and update d/copyright * New upstream release * Initial release (Closes: #1022917) * Initial release (Closes: #1135244) * Migrate to Qt6 * Exclude doc/* . [ Teemu Ikonen ] * New upstream release
.dsc
| Package-List | libnemodbus-dev deb libdevel optional arch=any libnemodbus1 deb libs optional arch=any qml6-module-nemo-qml-plugin-dbus deb libs optional arch=any |
|---|---|
| Section | libdevel |
| Priority | optional |
| Component | main |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: nemo-qml-plugin-dbus
Source: https://github.com/sailfishos/nemo-qml-plugin-dbus
# GFDL as used for doc/* is not DFSG compatible
Files-Excluded:
doc/*
Files: *
Copyright:
2013-2022 Jolla OY
2016-2021 Jolla Ltd
Andrew den Exter <andrew.den.exter@jolla.com>
2021 Open Mobile Platform LLC
License: BSD-3-clause
Files:
src/plugin/*
tests/tests.pro
tests/dbustestd/Makefile
tests/dbustestd/dbustestd.c
tests/dbustestd/dbus/org.nemomobile.dbustestd.service
tests/auto/tst_dbus_interface.qml
tests/test-definition/tests.xml
Copyright:
2013-2018 Jolla Ltd
Andrew den Exter <andrew.den.exter@jolla.com>
Simo Piiroinen <simo.piiroinen@jollamobile.com>
License: LGPL-2.1
Files: debian/*
Copyright:
2021-2022 Sebastian Spaeth, Teemu Ikonen
2026 Yifei Zhan <yifei@debian.org>
License: BSD-3-clause
License: LGPL-2.1
On Debian systems, the full text of the GNU Library Public License 2.1
can be found in the file '/usr/share/common-licenses/LGPL-2.1'.
License: BSD-3-clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials provided
with the distribution.
* Neither the name of the copyright holder nor the names of its
contributors may be used to endorse or promote products derived
from this software without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
DFSG Assistant LLM REVIEW 0 blocker, 1 important, 2 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 2 days ago.
Report
DFSG NEW review for nemo-qml-plugin-dbus version 2.1.39+dfsg-3
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: No
- Issues: 0 blocker, 1 important, 2 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
Everything shipped is DFSG-free: src/nemo-dbus and tests/auto/tst_dbus.qml are BSD-3-Clause, src/plugin, tests/auto/tst_dbus_interface.qml and tests/dbustestd/dbustestd.c are LGPL-2.1 (version 2.1, not "or later", as their headers say), and there are no non-free terms anywhere. doc/ is excluded and declared in Files-Excluded. debian/copyright is DEP-5, its Files stanzas (including the multi-line pattern list in the second stanza, which copyright-format 6.9 allows) match the tree exactly and are overridden correctly, it names every holder found in the files, and it reproduces the full BSD-3 text while pointing LGPL-2.1 at common-licenses.
Packaging
The packaging itself is modern and mostly clean: debhelper compat 14, Qt6 qmake6 build system, a sensible three-way split (library, -dev, QML module) with matching .install files, satisfiable Build-Depends, current Standards-Version and no maintainer scripts. Two things need fixing: the .orig tarball carries an obsolete Debian packaging tree (debian/ from 2.1.24-1, the 2022 deepin packaging) instead of upstream source only, and the changelog for this upload is muddled. A redundant symbolshelper build-dependency is a minor leftover.
Issues
important packaging 1. The .orig tarball contains an obsolete Debian debian/ directory from the 2.1.24-1 packaging, not only upstream source ◂
- Files:
nemo-qml-plugin-dbus_2.1.39+dfsg.orig.tar.xz: nemo-qml-plugin-dbus-2.1.39/debian/changelog,nemo-qml-plugin-dbus_2.1.39+dfsg.orig.tar.xz: nemo-qml-plugin-dbus-2.1.39/debian/control,nemo-qml-plugin-dbus_2.1.39+dfsg.orig.tar.xz: nemo-qml-plugin-dbus-2.1.39/debian/copyright,nemo-qml-plugin-dbus_2.1.39+dfsg.orig.tar.xz: nemo-qml-plugin-dbus-2.1.39/debian/rules,nemo-qml-plugin-dbus_2.1.39+dfsg.orig.tar.xz: nemo-qml-plugin-dbus-2.1.39/debian/libnemodbus.install - Basis: checked, in the package or with a reference tool
- Evidence:
nemo-qml-plugin-dbus (2.1.24-1) unstable; urgency=medium ... -- LiChengGang <lichenggang@uniontech.com> Tue, 09 Aug 2022,Maintainer: lichenggang <lichenggang@deepin.org>,Build-Depends: debhelper-compat (= 13), qt5-qmake, ... qt5-defaultinside the .orig tarball's debian/. - Problem: A +dfsg orig tarball is meant to be upstream source with the declared Files-Excluded non-DFSG files removed, and nothing else. This one also carries a complete 2022 Debian packaging tree (changelog, control, copyright, rules, libnemodbus.install, source/) whose Source, maintainer, package names and Build-Depends (qt5-default, debhelper 13) contradict the package it is attached to, and whose debian/copyright states a different, vaguer licence claim (
License: BSD and LGPLv2). The provenance of the "upstream" tarball is therefore unclear, the repack is incomplete, and anyone unpacking the .orig alone gets a misleading tree; dpkg-source replaces the stale debian/ on unpack of the debian tarball, so this does not break the build, but it is a defect a sponsor would require fixed before upload. - Fix: Rebuild the .orig tarball from upstream source only, again dropping doc/ as declared in Files-Excluded and this time also removing debian/, upload it as a new upstream version (2.1.39+dfsg1, e.g. -1) since the tarball name changes, and record in the changelog that the repack was redone.
minor packaging 2. The 2.1.39+dfsg-3 changelog entry calls itself an initial release twice and mixes unrelated changes ◂
- Files:
debian/changelog:1-16 - Basis: checked, in the package or with a reference tool
- Evidence:
* New upstream release,* Initial release (Closes: #1022917),* Initial release (Closes: #1135244)and* Migrate to Qt6all in the entry for version2.1.39+dfsg-3, whose predecessor in the file is2.1.30-1, itself* Initial release. (Closes: #1022917: ITP: ...). - Problem: A version -3 entry that is not a first upload cannot sensibly contain two "Initial release" lines, and #1022917 was already closed by the 2.1.30-1 entry, so the new entry re-presents old news; the reader cannot tell what this upload actually changes. Version -3 with no -1 or -2 in the changelog also looks like an accidental jump.
- Fix: Write one entry describing this upload (new upstream 2.1.39, Qt6 migration, package split into libnemodbus1/libnemodbus-dev/qml6-module-nemo-qml-plugin-dbus, doc/ excluded for DFSG reasons) with a single
Closes:for the ITP that this upload closes, and drop the duplicate "Initial release" lines or renumber the upload.
minor packaging 3. Build-Depends names dh-sequence-pkgkde-symbolshelper, but there is no symbols file for libnemodbus1 ◂
- Files:
debian/control:11 - Basis: checked, in the package or with a reference tool
- Evidence:
Build-Depends: debhelper-compat (= 14), dh-sequence-pkgkde-symbolshelper, dh-sequence-qmldeps, ...while debian/ contains no libnemodbus1.symbols or other symbols file。 - Problem: The pkgkde-symbolshelper sequence exists to process debian/*.symbols files, and none is shipped, so the dependency does nothing; pkg-kde-tools (which provides both that sequence and dh-sequence-qmldeps, per apt-cache) is pulled in by dh-sequence-qmldeps anyway. Policy 8.6 says a shlibs file, which dh_makeshlibs generates, is sufficient for a C++ library, so the symbols helper is not needed and the extra Build-Depends entry is dead weight.
- Fix: Drop dh-sequence-pkgkde-symbolshelper, keeping dh-sequence-qmldeps (which already depends on pkg-kde-tools); alternatively ship a symbols file if ABI tracking is wanted.
Verified ◂
- Upstream tree is small (41 files, no images, fonts, sounds, archives or minified code); I read debian/ in full, every licence file and the first 30-40 lines of every upstream source file.
- Licence map: BSD-3-Clause in src/nemo-dbus/*.h and *.cpp (16 files) and tests/auto/tst_dbus.qml ("You may use this file under the terms of the BSD license"); LGPL-2.1 in the seven src/plugin files, tests/auto/tst_dbus_interface.qml and tests/dbustestd/dbustestd.c ("GNU Lesser General Public License version 2.1 ... in the file license.lgpl"), with no "or any later version" grant. debian/copyright's second stanza lists exactly these paths (plus files with no header) and, being the later stanza, overrides Files: *.
- Prescan holders accounted for: Andrew den Exter andrew.den.exter@jolla.com is named in Files: * and in the LGPL stanza, and is only the "Contact:" of the src/nemo-dbus files whose copyright is Jolla Ltd; Simo Piiroinen simo.piiroinen@jollamobile.com is named in the LGPL stanza, which covers tests/auto/tst_dbus_interface.qml and tests/dbustestd/dbustestd.c, the only two files that carry his copyright. No holder in the tree is missing from debian/copyright.
- Files with no licence notice of their own - dbus.pro, src/src.pro, src/nemo-dbus/nemo-dbus.pro, src/nemo-dbus/private/private.pri, src/plugin/plugin.pro, src/plugin/qmldir, src/plugin/plugins.qmltypes, rpm/nemo-qml-plugin-dbus-qt5.spec, tests/tests.pro, tests/dbustestd/Makefile, tests/dbustestd/dbus/org.nemomobile.dbustestd.service, tests/test-definition/tests.xml, src/nemo-dbus/README, .gitignore, .gitmodules - are all matched by Files: * (BSD-3-Clause); the four test files among them are additionally listed in the LGPL stanza.
- src/plugin/plugins.qmltypes is generated ("auto-generated by: 'qmlplugindump -nonrelocatable Nemo.DBus 2.0'") from the plugin sources present in the package, so it is not a built file whose preferred form is missing.
- license.bsd is the BSD-3-Clause text and matches the License: BSD-3-clause paragraph; license.lgpl is the FSF's LGPL-2.1 text (Copyright (C) 1991, 1999 Free Software Foundation). Both are licence-text copies under Files: * rather than code; I did not treat the unlisted FSF line in license.lgpl as a copyright inaccuracy, since copying and distributing licence texts verbatim is what the archive expects and copyright-format 5.2 requires only the information the archive needs.
- tests/dbustestd/dbus-gmain is an empty directory in the tarball (git submodule not checked out, .gitmodules points at dbus-glib); tests are not built, so it has no effect.
- Both dh sequences resolve: apt-cache shows pkg-kde-tools provides dh-sequence-pkgkde-symbolshelper and dh-sequence-qmldeps; qt6-base-dev and qt6-declarative-dev exist in unstable; the qmake6 build system is shipped by debhelper.
- Hardening is effective: debhelper's qmake build system passes CFLAGS/CXXFLAGS/LDFLAGS from dpkg-buildflags into QMAKE_*FLAGS (read /usr/share/perl5/Debian/Debhelper/Buildsystem/qmake.pm), so hardening=+all reaches the compiler.
- Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match) is current; compat 14 makes the missing ${shlibs:Depends} in the QML package harmless; ${source:Synopsis} and ${source:Extended-Description} are documented substvars in deb-substvars(5).
- Install files match what the .pro files install (libnemodbus.so.* in libnemodbus1, libnemodbus.so plus headers and nemodbus.pc in -dev, Nemo/DBus plugin and qmldir/plugins.qmltypes in the QML package), and the QML module path matches module Nemo.DBus and qmldir's
plugin nemodbus. - doc/ is absent from the orig tarball, consistent with Files-Excluded: doc/*, and debian/patches/0001 drops doc and tests from SUBDIRS as the repack requires.
- There is no debian/tests (no autopkgtest), and the upstream test suite is not compiled or run at build time.
- uscan found the packaged version as the newest upstream release (upstream
2.1.39, packaged2.1.39+dfsg). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (LGPL-2.1).
Not confirmed ◂
- Whether the excluded doc/ really carried a non-DFSG GFDL grant (calling for a +dfsg repack): the files are not in the tarball, so the comment
# GFDL as used for doc/* is not DFSG compatiblecannot be checked. - The Vcs-Browser/Vcs-Git URLs and branch names (salsa.debian.org/DebianOnMobile-team/puremaps/...) were not fetched, so they are not verified.
- The exact contents of the generated nemodbus.pc (its Version field depends on qmake's VERSION handling) were not checked; no build output is available.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader was emailed about the review 2 days ago.
Review Information
accepted — allocated to awm 2 days ago, started 2 days ago, completed 2 days ago.