DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: ocaml-bytesrw 0.4.1-1

Package Information

Descriptioncomposable byte stream readers and writers for OCaml (development)

Bytesrw extends the OCaml Bytes module with composable, memory efficient, byte stream readers and writers compatible with effect based concurrency.

Except for byte slice life-times, these abstractions intentionally separate away resource management and the specifics of reading and writing bytes.

This package contains development files.

MaintainerDebian OCaml Maintainers <debian-ocaml-maint@lists.debian.org>
Changed ByStéphane Glondu <glondu@debian.org>
Sponsorglondu@debian.org
Distributionunstable
Architectureany
VCSgit: https://salsa.debian.org/ocaml-team/ocaml-bytesrw.git (browse)
Closes#1150681
Trackerhttps://tracker.debian.org/pkg/ocaml-bytesrw
Uploaded23 days ago

New Package Report

.changes◂
DateThu, 15 Oct 2026 10:46:10 +0200
Sourceocaml-bytesrw
Version0.4.1-1
Changed-ByStéphane Glondu <glondu@debian.org>
Architecturesource amd64
Distributionunstable
Changelog◂
ocaml-bytesrw (0.4.1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1150681)
.dsc◂
Package-Listlibbytesrw-ocaml deb ocaml optional arch=any
libbytesrw-ocaml-dev deb ocaml optional arch=any
Sectionocaml
Priorityoptional
Componentmain
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/

Files: *
Copyright: 2024-2025, The bytesrw programmers
License: ISC

Files: test/tpsa_tool.ml
Copyright: 2022, The tpsa programmers
License: ISC

Files: test/quickstart.ml
Copyright: 2024, The bytesrw programmers
License: CC0-1.0

Files: debian/*
Copyright: 2026, Stéphane Glondu <glondu@debian.org>
License: ISC

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: CC0-1.0
 Creative Commons Legal Code
 .
 CC0 1.0 Universal
 .
     CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
     LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
     ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
     INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
     REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
     PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
     THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
     HEREUNDER.
 .
 Statement of Purpose
 .
 The laws of most jurisdictions throughout the world automatically confer
 exclusive Copyright and Related Rights (defined below) upon the creator
 and subsequent owner(s) (each and all, an "owner") of an original work of
 authorship and/or a database (each, a "Work").
 .
 Certain owners wish to permanently relinquish those rights to a Work for
 the purpose of contributing to a commons of creative, cultural and
 scientific works ("Commons") that the public can reliably and without fear
 of later claims of infringement build upon, modify, incorporate in other
 works, reuse and redistribute as freely as possible in any form whatsoever
 and for any purposes, including without limitation commercial purposes.
 These owners may contribute to the Commons to promote the ideal of a free
 culture and the further production of creative, cultural and scientific
 works, or to gain reputation or greater distribution for their Work in
 part through the use and efforts of others.
 .
 For these and/or other purposes and motivations, and without any
 expectation of additional consideration or compensation, the person
 associating CC0 with a Work (the "Affirmer"), to the extent that he or she
 is an owner of Copyright and Related Rights in the Work, voluntarily
 elects to apply CC0 to the Work and publicly distribute the Work under its
 terms, with knowledge of his or her Copyright and Related Rights in the
 Work and the meaning and intended legal effect of CC0 on those rights.
 .
 1. Copyright and Related Rights. A Work made available under CC0 may be
 protected by copyright and related or neighboring rights ("Copyright and
 Related Rights"). Copyright and Related Rights include, but are not
 limited to, the following:
 .
   i. the right to reproduce, adapt, distribute, perform, display,
      communicate, and translate a Work;
  ii. moral rights retained by the original author(s) and/or performer(s);
 iii. publicity and privacy rights pertaining to a person's image or
      likeness depicted in a Work;
  iv. rights protecting against unfair competition in regards to a Work,
      subject to the limitations in paragraph 4(a), below;
   v. rights protecting the extraction, dissemination, use and reuse of data
      in a Work;
  vi. database rights (such as those arising under Directive 96/9/EC of the
      European Parliament and of the Council of 11 March 1996 on the legal
      protection of databases, and under any national implementation
      thereof, including any amended or successor version of such
      directive); and
 vii. other similar, equivalent or corresponding rights throughout the
      world based on applicable law or treaty, and any national
      implementations thereof.
 .
 2. Waiver. To the greatest extent permitted by, but not in contravention
 of, applicable law, Affirmer hereby overtly, fully, permanently,
 irrevocably and unconditionally waives, abandons, and surrenders all of
 Affirmer's Copyright and Related Rights and associated claims and causes
 of action, whether now known or unknown (including existing as well as
 future claims and causes of action), in the Work (i) in all territories
 worldwide, (ii) for the maximum duration provided by applicable law or
 treaty (including future time extensions), (iii) in any current or future
 medium and for any number of copies, and (iv) for any purpose whatsoever,
 including without limitation commercial, advertising or promotional
 purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
 member of the public at large and to the detriment of Affirmer's heirs and
 successors, fully intending that such Waiver shall not be subject to
 revocation, rescission, cancellation, termination, or any other legal or
 equitable action to disrupt the quiet enjoyment of the Work by the public
 as contemplated by Affirmer's express Statement of Purpose.
 .
 3. Public License Fallback. Should any part of the Waiver for any reason
 be judged legally invalid or ineffective under applicable law, then the
 Waiver shall be preserved to the maximum extent permitted taking into
 account Affirmer's express Statement of Purpose. In addition, to the
 extent the Waiver is so judged Affirmer hereby grants to each affected
 person a royalty-free, non transferable, non sublicensable, non exclusive,
 irrevocable and unconditional license to exercise Affirmer's Copyright and
 Related Rights in the Work (i) in all territories worldwide, (ii) for the
 maximum duration provided by applicable law or treaty (including future
 time extensions), (iii) in any current or future medium and for any number
 of copies, and (iv) for any purpose whatsoever, including without
 limitation commercial, advertising or promotional purposes (the
 "License"). The License shall be deemed effective as of the date CC0 was
 applied by Affirmer to the Work. Should any part of the License for any
 reason be judged legally invalid or ineffective under applicable law, such
 partial invalidity or ineffectiveness shall not invalidate the remainder
 of the License, and in such case Affirmer hereby affirms that he or she
 will not (i) exercise any of his or her remaining Copyright and Related
 Rights in the Work or (ii) assert any associated claims and causes of
 action with respect to the Work, in either case contrary to Affirmer's
 express Statement of Purpose.
 .
 4. Limitations and Disclaimers.
 .
  a. No trademark or patent rights held by Affirmer are waived, abandoned,
     surrendered, licensed or otherwise affected by this document.
  b. Affirmer offers the Work as-is and makes no representations or
     warranties of any kind concerning the Work, express, implied,
     statutory or otherwise, including without limitation warranties of
     title, merchantability, fitness for a particular purpose, non
     infringement, or the absence of latent or other defects, accuracy, or
     the present or absence of errors, whether or not discoverable, all to
     the greatest extent permissible under applicable law.
  c. Affirmer disclaims responsibility for clearing rights of other persons
     that may apply to the Work or any use thereof, including without
     limitation any person's Copyright and Related Rights in the Work.
     Further, Affirmer disclaims responsibility for obtaining any necessary
     consents, permissions or other rights required for any use of the
     Work.
  d. Affirmer understands and acknowledges that Creative Commons is not a
     party to this document and has no duty or obligation with respect to
     this CC0 or use of the Work.

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 23 days ago.

Report◂

DFSG NEW review for ocaml-bytesrw version 0.4.1-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 1 blocker, 1 important, 1 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

Every licence actually present in the tree (ISC, CC0-1.0, Apache-2.0) is DFSG-free, so there is no non-free term, no missing permission and no missing source, and debian/copyright is valid DEP-5 with the correct Format URL and the ISC text reproduced in full. It is, however, not accurate: src/crypto/crypto.h is Apache-2.0 code copyright Arm Limited and/or its affiliates, and it is not named anywhere in debian/copyright (the Files: * stanza wrongly claims ISC for it and the Arm holder is absent, and no License: Apache-2.0 paragraph is given). In addition, four files whose headers declare CC0-1.0 (test/cookbook.ml, test/min_tls.ml, test/webfetch.ml, test/webserve.ml) fall under Files: * and are therefore described as ISC; only test/quickstart.ml is listed in the CC0-1.0 stanza. Apache-2.0 and CC0-1.0 are in /usr/share/common-licenses so only a reference is needed for them, while the (already included) ISC text is required as it is not.

Packaging

The packaging is clean and modern: debhelper-compat 14 with dh $@ --with ocaml, dh-ocaml 3.7+ with its dh-ocaml.conf.json (dune_layout_version 1) and debian-findlib naming the findlib package, source format 3.0 (quilt) with no patches, no maintainer scripts, correct ${ocaml:Depends}/${ocaml:Provides} and Multi-Arch-free split into libbytesrw-ocaml / libbytesrw-ocaml-dev, hardening left to dh, homepage and Vcs-* present, Standards-Version 4.7.4 (current Policy is 4.7.4). The only real defect is that zstd support is silently dropped: libzstd-dev is not in Build-Depends although the other optional backends are, so the bytesrw.zstd library that upstream and pkg/META advertise is never built. Everything else is fine.

Issues

blocker licensing 1. src/crypto/crypto.h is Apache-2.0 (Arm) but debian/copyright claims ISC and omits the holder and licence ◂
  • Files: src/crypto/crypto.h:1-2; debian/copyright (Files: * stanza, lines 3-5, and the missing License: Apache-2.0 paragraph)
  • Evidence: // SPDX-FileCopyrightText: Copyright 2018-2024 Arm Limited and/or its affiliates <open-source-office@arm.com> / // SPDX-License-Identifier: Apache-2.0 (crypto.h lines 1-2). debian/copyright has only Files: * -> Copyright: 2024-2025, The bytesrw programmers / License: ISC, plus stanzas for test/tpsa_tool.ml, test/quickstart.ml and debian/*; no stanza mentions crypto.h or Arm.
  • Problem: The file is a vendored PSA Crypto API declaration header (743 lines of typedefs and PSA_* macros) copied from Arm's Apache-2.0 licensed PSA Crypto headers; it carries no bytesrw copyright. debian/copyright neither names the Arm copyright holder nor records Apache-2.0, and the catch-all Files: * stanza asserts ISC for it, which is wrong for that file. Apache-2.0 requires its notices to be retained, so the source package must document this file separately; it is not built or installed (nothing includes src/crypto/crypto.h; the C stubs include the system <psa/crypto.h>), but it is still shipped in the source tarball.
  • Fix: Add a stanza such as Files: src/crypto/crypto.h / Copyright: 2018-2024, Arm Limited and/or its affiliates / License: Apache-2.0, and a stand-alone License: Apache-2.0 paragraph referring to /usr/share/common-licenses/Apache-2.0 (or quoting the text).
important licensing 2. Four CC0-1.0 test files are described as ISC in debian/copyright ◂
  • Files: test/cookbook.ml:3, test/min_tls.ml:3, test/webfetch.ml:3, test/webserve.ml:3; debian/copyright (Files: * and Files: test/quickstart.ml stanzas)
  • Evidence: Each of these files begins Copyright (c) 2024/2025 The bytesrw programmers. All rights reserved. / SPDX-License-Identifier: CC0-1.0. debian/copyright lists only Files: test/quickstart.ml with License: CC0-1.0; everything else, including these four, is covered by Files: * / License: ISC.
  • Problem: debian/copyright states the wrong licence for these four files: they are CC0-1.0, not ISC. Both licences are DFSG-free so this is not a licence-compatibility problem, but the copyright file is inaccurate and must describe the actual licence of every file.
  • Fix: Extend the CC0-1.0 stanza to name all five files, e.g. Files: test/cookbook.ml test/min_tls.ml test/quickstart.ml test/webfetch.ml test/webserve.ml (the CC0-1.0 text can be replaced by a reference to /usr/share/common-licenses/CC0-1.0, or kept).
minor packaging 3. zstd support is silently not built: libzstd-dev missing from Build-Depends ◂
  • Files: debian/control (Build-Depends), debian/rules, pkg/pkg.ml, pkg/META
  • Evidence: debian/control Build-Depends lists libblake3-dev, libmd-dev, libxxhash-dev, zlib1g-dev but no libzstd-dev; pkg/pkg.ml builds Pkg.mllib ~cond:zstd "src/zstd/bytesrw_zstd.mllib", cond:zstd being Conf.with_pkg "conf-zstd" (pkg-config libzstd); pkg/META declares a zstd findlib sub-package; upstream's opam description and README advertise zstd support and test/test_zstd.ml, test/zstdtrip.ml exist.
  • Problem: Without libzstd-dev the pkg-config probe for zstd fails and the bytesrw.zstd library is dropped from the build (only zlib, blake3, md and xxhash backends are built). The omission is silent, unlike the deliberate --with-conf-mbedtls false, and disagrees with what pkg/META and the upstream documentation advertise.
  • Fix: Add libzstd-dev to Build-Depends so the zstd backend is built (binary deps are picked up via ${shlibs:Depends}), or document that zstd is intentionally disabled.
Verified ◂
  • Prescan finding accounted for: src/crypto/crypto.h is the Apache-2.0 Arm PSA header reported above; it is the only file whose holder is absent from debian/copyright.
  • debian/copyright is valid DEP-5: Format: is exactly the 1.0 URL; stanza ordering is correct (Files: * catch-all, then tpsa_tool.ml, quickstart.ml, debian/*); the ISC text is reproduced in full (required, ISC is not in /usr/share/common-licenses); CC0-1.0 full text is included (redundant, since /usr/share/common-licenses/CC0-1.0 exists) and Apache-2.0 is in /usr/share/common-licenses too.
  • LICENSE.md and the per-file SPDX-License-Identifier: ISC headers agree with the ISC text in debian/copyright; the only copyright holders in the tree are 'The bytesrw programmers' (all src/ and most test/ files), 'The tpsa programmers' (test/tpsa_tool.ml) and 'Arm Limited and/or its affiliates' (src/crypto/crypto.h).
  • All source files not carrying their own notice (doc/.mld, README.md, CHANGES.md, opam, _tags, BRZO, myocamlbuild.ml, B0.ml, pkg/) are upstream bytesrw files and are correctly covered by the Files: * ISC stanza.
  • No built/minified artifacts, archives, bytecode, PDFs or fonts in the tree; the pre-review scan flagged no such files. src/crypto/crypto.h is a plain-text source header, not a build product.
  • Packaging read in full and found sound: debian/control, rules, changelog, source/format, debian-findlib, dh-ocaml.conf.json, gbp.conf. source/format is 3.0 (quilt) with no debian/patches (nothing to forward). No maintainer scripts or *.maintscript. No debian/tests (autopkgtests not required). Standards-Version 4.7.4 matches current Policy 4.7.4 (Policy tool, section A10.2).
  • debian-findlib is a legitimate dh-ocaml convention file: /usr/bin/dh_ocamllibinstall (via /usr/share/dh-ocaml/helper.exe) reads debian/debian-dune or debian/debian-findlib to learn the findlib package name, here 'bytesrw'.
  • /usr/share/ocaml/ocamlvars.mk, which debian/rules includes, exists on the reviewing system.
  • Used only file/URL-free reference tools (policy, apt-cache); libzstd-dev, libtopkg-ocaml-dev exist in the archive; b0/libb0-ocaml-dev do not appear in the archive lists.
  • uscan found the packaged version as the newest upstream release (upstream 0.4.1, packaged 0.4.1).
Not confirmed ◂
  • debian/rules runs ocaml pkg/pkg.ml test at dh_auto_test, but the test suite is b0-driven (B0.ml uses B0_kit/B0_ocaml, test/*.ml open B0_testing) and b0 is neither in Build-Depends nor, apparently, in the Debian archive. If topkg's test action requires b0, the build would fail there; a build would show whether topkg merely warns and skips. I could not verify topkg's test action (libtopkg-ocaml-dev is not installed on the reviewing system).
  • The dh_auto_install target passes opam-installer --docdir=./usr/share/ocaml-dune/doc; I could not confirm whether that path is the intended dh-ocaml dune-layout-1 documentation directory (dh-ocaml's own helper installs under /usr/share/ocaml-dune/) or an accidental carry-over from another package. opam-installer and its manual page are not available on the reviewing system.
  • No man pages could be read on the reviewing system (the man tool returned only its own documentation for every name tried, including dh_install), so opam-installer and debhelper command behaviour could not be checked from system manuals.
  • Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: grep: " /usr/lib/dh-ocaml" is not a file of the package or of the reviewing system.
Proposed changes ◂

None.

Review Information

accepted — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Hi,

In your next upload, please correct debian/copyright information for:

  • src/crypto/crypto.h: Copyright 2018-2024 Arm Limited, Apache-2.0 licensed
  • test/cookbook.ml, test/min_tls.ml, test/webfetch.ml, test/webserve.ml: Copyright (c) 2024/2025 The bytesrw programmers, CC0-1.0 licensed (note that the CC0-1.0 text can be replaced by a reference to /usr/share/common-licenses/CC0-1.0 as well).

I note that the LLM reviewer also reckons your Build-Depends should reference libzstd-dev, but that's exactly the sort of wild assertion that is wrong about 20% of the time... :-)

Thanks!

Back to Dashboard | View all reviews for this package