Review: ocaml-bstr 0.1.1-2

Package Information

Description	simple library for OCaml bigstrings (dev) This small set of libraries offers a homogeneous API between 2 types and their derivations with the slice type. The aim is to homogenize the 2 types bytes and bigstring and to derive them with a slice type, giving the user all the levers needed to manipulate byte sequences, whether in the form of a bigstring or bytes. The slice view avoids copying when it comes to decoding a packet and extracting a sub-part. The slice also applies to bigstrings, whose Bigarray.Array1.sub is more expensive. This set of libraries is a synthesis of astring (which offers a range of useful functions as well as slice), cstruct (which offers a similar API for bigstrings), bigstringaf (which offers some other useful functions), the standard OCaml library and repr for decoding/encoding these values into OCaml records/variants. This package contains development files.
Maintainer	Debian OCaml Maintainers <debian-ocaml-maint@lists.debian.org>
Changed By	Stéphane Glondu <glondu@debian.org>
Sponsor	glondu@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/ocaml-team/ocaml-bstr.git (browse)
Closes	#1150680
Tracker	https://tracker.debian.org/pkg/ocaml-bstr
Uploaded	23 days ago

New Package Report

.changes◂

Source	ocaml-bstr
Version	0.1.1-2
Changed-By	Stéphane Glondu <glondu@debian.org>
Architecture	source amd64
Distribution	unstable
Date	Thu, 15 Oct 2026 08:03:26 +0200

Changelog◂

ocaml-bstr (0.1.1-2) unstable; urgency=medium
 .
   * Fixes after DFSG review:
     - debian/copyright:
       + the package license is ISC, actually
       + add missing copyright holders (The astring programmers)
     - debian/control:
       + do not mention the packet DSL in descriptions
 .
 ocaml-bstr (0.1.1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1150680)

.dsc◂

Section	ocaml
Priority	optional
Component	main
Package-List	libbstr-ocaml deb ocaml optional arch=any libbstr-ocaml-dev deb ocaml optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/

Files: *
Copyright: 2024-2026, Romain Calascibetta
License: ISC

Files: lib/bstr.ml
Copyright: 2015, The astring programmers
           2024, Romain Calascibetta
License: ISC

Files: debian/*
Copyright: 2026, Stéphane Glondu <glondu@debian.org>
License: ISC

License: ISC
 Permission to use, copy, modify, and distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 23 days ago.

Report◂

DFSG NEW review for ocaml-bstr version 0.1.1-2

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 1 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

All code is DFSG-free and the source-file headers consistently grant ISC, which debian/copyright quotes in full and attributes correctly (Romain Calascibetta 2024-2026; The astring programmers 2015 in lib/bstr.ml). But debian/copyright is not fully accurate: LICENSE.md is the MIT/Expat licence text ("The MIT License (MIT)") and all three .opam files declare license: "MIT", while the copyright file describes every file as ISC and never mentions these. The file also omits where the upstream sources were obtained, which Policy 12.5 requires. Both licences are free and compatible, so there is no DFSG violation, only a copyright file that does not reflect all licensing statements in the tree.

Packaging

Packaging follows current practice: debhelper compat 14 driving the dh-ocaml ocaml_dune buildsystem, correct and satisfiable Build-Depends (ocaml-dune 3.24.1, dh-ocaml 3.8 in the archive), a proper dev/runtime split using ${ocaml:Depends}/${ocaml:Provides}, correct Vcs-*/Homepage fields, Standards-Version: 4.7.4 (Policy is 4.7.4.1), source format 3.0 (quilt) with no patches needed, and a well-formed changelog closing #1150680. The debian/debian-dune dune-package list and debian/dh-ocaml.conf.json are exactly what the buildsystem expects. No packaging fault that would require fixing before upload.

Issues

important licensing 1. debian/copyright claims ISC for all files but LICENSE.md is the MIT text and the .opam files declare MIT ◂

Files: debian/copyright:3-5, LICENSE.md:1-3, bstr.opam:10, slice.opam:10, bin.opam:10
Evidence: debian/copyright: Files: * / License: ISC (ISC text quoted in full); LICENSE.md line 1-3: The MIT License (MIT) / Copyright (c) 2024 Romain Calascibetta; bstr.opam/slice.opam/bin.opam: license: "MIT"
Problem: The machine-readable copyright file describes every file, including LICENSE.md and the .opam metadata, as ISC and reproduces only the ISC text. LICENSE.md however contains the Expat/MIT licence and all three .opam files declare MIT, so the file does not describe the licensing actually asserted in the tree. The per-file headers (e.g. SPDX-License-Identifier: ISC in lib/bstr.ml, the ISC permission text in every .ml/.mli/.c file) do support ISC for the code, and ISC and Expat/MIT are both DFSG-free and mutually compatible, so this is not a freeness problem but an inaccurate/incomplete debian/copyright (Policy 12.5, copyright-format 1.0).
Fix: Resolve the upstream inconsistency with the upstream author, then make debian/copyright reflect it: either add a Files: LICENSE.md/.opam stanza with the Expat text, or (if ISC is confirmed for the whole work) add a Comment explaining that LICENSE.md and the .opam license fields are stale and that the project is ISC.

minor licensing 2. debian/copyright does not say where the upstream sources were obtained ◂

Files: debian/copyright:1-3
Evidence: Header stanza contains only Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ — no Source:/Upstream-Name/Upstream-Contact.
Problem: Policy 12.5 requires that "the copyright file must say where the upstream sources (if any) were obtained, and should include a name or contact address for the upstream authors". The holder is named, but no upstream source location is given anywhere in debian/copyright (the Homepage field in debian/control is a different file).
Fix: Add a Source: field (and ideally Upstream-Name/Upstream-Contact) to the header stanza, e.g. the upstream repository URL https://github.com/robur-coop/bstr.

Verified ◂

Covered the whole tree: every file under ocaml-bstr-0.1.1 except .pc/ was listed and the .ml/.mli/.c/dune/opam/markdown files were read or head-read.
Licence headers: all of bin/.ml, lib/.ml, lib/.mli, lib/.c (and lib/*.ml.in) carry the same ISC permission text; lib/bstr.ml additionally bears SPDX-License-Identifier: ISC and Copyright (c) 2015 The astring programmers plus Romain Calascibetta 2024. test/, fuzz/ and bench/ sources carry no separate header (covered by Files: *).
Copyright holders found (Romain Calascibetta 2024/2026; The astring programmers 2015 in lib/bstr.ml) are all represented in debian/copyright; the pre-scan's dfsh-author-check reported ALL SOURCE AUTHORS LISTED and named no file to account for.
No LICENSE/COPYING/NOTICE/AUTHORS file exists other than LICENSE.md, and no vendored third-party code was found; nothing needs a Files-Excluded or an extra holder.
No compiled, minified, archived or otherwise non-preferred-form files are shipped: .ml files produced from templates (slice_bytes.ml, slice_bstr.ml, bin_{encoder,decoder}{bstr,bytes,string}.ml) are generated at build time from the in-tree lib/slice.ml.in and lib/bin{encoder,decoder}.ml.in by bin/generate.ml and bin/branches.ml, which are present.
debian/debian-dune (list bstr/slice) and debian/dh-ocaml.conf.json are the files dh-ocaml's ocaml_dune buildsystem looks for (confirmed against /usr/share/perl5/Debian/Debhelper/Buildsystem/ocaml_dune.pm), not stray files.
Build-Depends are satisfiable in the archive: ocaml-dune 3.24.1-4 and dh-ocaml 3.8 (>= 3.5~); Standards-Version 4.7.4 has the same first three components as the current Policy 4.7.4.1, so it is fine.
Packaging structure is clean: source format 3.0 (quilt) with no patches, debhelper compat 14, dev/runtime split with ${ocaml:Depends}/${ocaml:Provides}, no maintainer scripts, changelog well-formed and closing #1150680.
uscan found the packaged version as the newest upstream release (upstream 0.1.1, packaged 0.1.1).

Not confirmed ◂

The package was not built or its tests run (not possible here). dune-workspace sets the dev profile's C flags to -Werror, so an unforeseen warning under a newer dune/compiler could fail the build; this was not confirmed.
Whether slice/ and bin/ sources are derived from astring, cstruct, bigstringaf or repr, as the README claims the libraries synthesise them, is not evidenced in the files themselves beyond lib/bstr.ml's astring notice; no in-file holder is claimed for them, so no additional stanza was asserted.

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Hi,

Thanks for fixing the license, but maybe one case is missed? Or perhaps you're just waiting to hear back from upstream - I'm sure you'll get to the bottom of it and upload with whatever changes are needed at that point.

Speaking of upstream... debian/copyright should have a "Source: " line saying where that is (policy 12.5), and ideally also Upstream-Name and Upstream-Contact as well.

Thanks!

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.1.1-1	814f325c…	2026-10-13 04:29	2026-10-13 04:36	awm	rejected	VIEW

Back to Dashboard | View all reviews for this package