Review: ocaml-bytesrw 0.4.1-1
Package Information
| Description | composable byte stream readers and writers for OCaml (development) Bytesrw extends the OCaml Bytes module with composable, memory efficient, byte stream readers and writers compatible with effect based concurrency. Except for byte slice life-times, these abstractions intentionally separate away resource management and the specifics of reading and writing bytes. This package contains development files. |
|---|---|
| Maintainer | Debian OCaml Maintainers <debian-ocaml-maint@lists.debian.org> |
| Changed By | Stéphane Glondu <glondu@debian.org> |
| Sponsor | glondu@debian.org |
| Distribution | unstable |
| Architecture | any |
| VCS | git: https://salsa.debian.org/ocaml-team/ocaml-bytesrw.git (browse) |
| Closes | #1150681 |
| Tracker | https://tracker.debian.org/pkg/ocaml-bytesrw |
| Uploaded | 23 days ago |
New Package Report
.changes
| Date | Thu, 15 Oct 2026 10:46:10 +0200 |
|---|---|
| Source | ocaml-bytesrw |
| Version | 0.4.1-1 |
| Changed-By | Stéphane Glondu <glondu@debian.org> |
| Architecture | source amd64 |
| Distribution | unstable |
Changelog
ocaml-bytesrw (0.4.1-1) unstable; urgency=medium . * Initial release (Closes: #1150681)
.dsc
| Package-List | libbytesrw-ocaml deb ocaml optional arch=any libbytesrw-ocaml-dev deb ocaml optional arch=any |
|---|---|
| Section | ocaml |
| Priority | optional |
| Component | main |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Files: *
Copyright: 2024-2025, The bytesrw programmers
License: ISC
Files: test/tpsa_tool.ml
Copyright: 2022, The tpsa programmers
License: ISC
Files: test/quickstart.ml
Copyright: 2024, The bytesrw programmers
License: CC0-1.0
Files: debian/*
Copyright: 2026, Stéphane Glondu <glondu@debian.org>
License: ISC
License: ISC
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
License: CC0-1.0
Creative Commons Legal Code
.
CC0 1.0 Universal
.
CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
HEREUNDER.
.
Statement of Purpose
.
The laws of most jurisdictions throughout the world automatically confer
exclusive Copyright and Related Rights (defined below) upon the creator
and subsequent owner(s) (each and all, an "owner") of an original work of
authorship and/or a database (each, a "Work").
.
Certain owners wish to permanently relinquish those rights to a Work for
the purpose of contributing to a commons of creative, cultural and
scientific works ("Commons") that the public can reliably and without fear
of later claims of infringement build upon, modify, incorporate in other
works, reuse and redistribute as freely as possible in any form whatsoever
and for any purposes, including without limitation commercial purposes.
These owners may contribute to the Commons to promote the ideal of a free
culture and the further production of creative, cultural and scientific
works, or to gain reputation or greater distribution for their Work in
part through the use and efforts of others.
.
For these and/or other purposes and motivations, and without any
expectation of additional consideration or compensation, the person
associating CC0 with a Work (the "Affirmer"), to the extent that he or she
is an owner of Copyright and Related Rights in the Work, voluntarily
elects to apply CC0 to the Work and publicly distribute the Work under its
terms, with knowledge of his or her Copyright and Related Rights in the
Work and the meaning and intended legal effect of CC0 on those rights.
.
1. Copyright and Related Rights. A Work made available under CC0 may be
protected by copyright and related or neighboring rights ("Copyright and
Related Rights"). Copyright and Related Rights include, but are not
limited to, the following:
.
i. the right to reproduce, adapt, distribute, perform, display,
communicate, and translate a Work;
ii. moral rights retained by the original author(s) and/or performer(s);
iii. publicity and privacy rights pertaining to a person's image or
likeness depicted in a Work;
iv. rights protecting against unfair competition in regards to a Work,
subject to the limitations in paragraph 4(a), below;
v. rights protecting the extraction, dissemination, use and reuse of data
in a Work;
vi. database rights (such as those arising under Directive 96/9/EC of the
European Parliament and of the Council of 11 March 1996 on the legal
protection of databases, and under any national implementation
thereof, including any amended or successor version of such
directive); and
vii. other similar, equivalent or corresponding rights throughout the
world based on applicable law or treaty, and any national
implementations thereof.
.
2. Waiver. To the greatest extent permitted by, but not in contravention
of, applicable law, Affirmer hereby overtly, fully, permanently,
irrevocably and unconditionally waives, abandons, and surrenders all of
Affirmer's Copyright and Related Rights and associated claims and causes
of action, whether now known or unknown (including existing as well as
future claims and causes of action), in the Work (i) in all territories
worldwide, (ii) for the maximum duration provided by applicable law or
treaty (including future time extensions), (iii) in any current or future
medium and for any number of copies, and (iv) for any purpose whatsoever,
including without limitation commercial, advertising or promotional
purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
member of the public at large and to the detriment of Affirmer's heirs and
successors, fully intending that such Waiver shall not be subject to
revocation, rescission, cancellation, termination, or any other legal or
equitable action to disrupt the quiet enjoyment of the Work by the public
as contemplated by Affirmer's express Statement of Purpose.
.
3. Public License Fallback. Should any part of the Waiver for any reason
be judged legally invalid or ineffective under applicable law, then the
Waiver shall be preserved to the maximum extent permitted taking into
account Affirmer's express Statement of Purpose. In addition, to the
extent the Waiver is so judged Affirmer hereby grants to each affected
person a royalty-free, non transferable, non sublicensable, non exclusive,
irrevocable and unconditional license to exercise Affirmer's Copyright and
Related Rights in the Work (i) in all territories worldwide, (ii) for the
maximum duration provided by applicable law or treaty (including future
time extensions), (iii) in any current or future medium and for any number
of copies, and (iv) for any purpose whatsoever, including without
limitation commercial, advertising or promotional purposes (the
"License"). The License shall be deemed effective as of the date CC0 was
applied by Affirmer to the Work. Should any part of the License for any
reason be judged legally invalid or ineffective under applicable law, such
partial invalidity or ineffectiveness shall not invalidate the remainder
of the License, and in such case Affirmer hereby affirms that he or she
will not (i) exercise any of his or her remaining Copyright and Related
Rights in the Work or (ii) assert any associated claims and causes of
action with respect to the Work, in either case contrary to Affirmer's
express Statement of Purpose.
.
4. Limitations and Disclaimers.
.
a. No trademark or patent rights held by Affirmer are waived, abandoned,
surrendered, licensed or otherwise affected by this document.
b. Affirmer offers the Work as-is and makes no representations or
warranties of any kind concerning the Work, express, implied,
statutory or otherwise, including without limitation warranties of
title, merchantability, fitness for a particular purpose, non
infringement, or the absence of latent or other defects, accuracy, or
the present or absence of errors, whether or not discoverable, all to
the greatest extent permissible under applicable law.
c. Affirmer disclaims responsibility for clearing rights of other persons
that may apply to the Work or any use thereof, including without
limitation any person's Copyright and Related Rights in the Work.
Further, Affirmer disclaims responsibility for obtaining any necessary
consents, permissions or other rights required for any use of the
Work.
d. Affirmer understands and acknowledges that Creative Commons is not a
party to this document and has no duty or obligation with respect to
this CC0 or use of the Work.
DFSG Assistant LLM REVIEW 1 blocker, 1 important, 1 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 23 days ago.
Report
DFSG NEW review for ocaml-bytesrw version 0.4.1-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 1 blocker, 1 important, 1 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
Every licence actually present in the tree (ISC, CC0-1.0, Apache-2.0) is DFSG-free, so there is no non-free term, no missing permission and no missing source, and debian/copyright is valid DEP-5 with the correct Format URL and the ISC text reproduced in full. It is, however, not accurate: src/crypto/crypto.h is Apache-2.0 code copyright Arm Limited and/or its affiliates, and it is not named anywhere in debian/copyright (the Files: * stanza wrongly claims ISC for it and the Arm holder is absent, and no License: Apache-2.0 paragraph is given). In addition, four files whose headers declare CC0-1.0 (test/cookbook.ml, test/min_tls.ml, test/webfetch.ml, test/webserve.ml) fall under Files: * and are therefore described as ISC; only test/quickstart.ml is listed in the CC0-1.0 stanza. Apache-2.0 and CC0-1.0 are in /usr/share/common-licenses so only a reference is needed for them, while the (already included) ISC text is required as it is not.
Packaging
The packaging is clean and modern: debhelper-compat 14 with dh $@ --with ocaml, dh-ocaml 3.7+ with its dh-ocaml.conf.json (dune_layout_version 1) and debian-findlib naming the findlib package, source format 3.0 (quilt) with no patches, no maintainer scripts, correct ${ocaml:Depends}/${ocaml:Provides} and Multi-Arch-free split into libbytesrw-ocaml / libbytesrw-ocaml-dev, hardening left to dh, homepage and Vcs-* present, Standards-Version 4.7.4 (current Policy is 4.7.4). The only real defect is that zstd support is silently dropped: libzstd-dev is not in Build-Depends although the other optional backends are, so the bytesrw.zstd library that upstream and pkg/META advertise is never built. Everything else is fine.
Issues
blocker licensing 1. src/crypto/crypto.h is Apache-2.0 (Arm) but debian/copyright claims ISC and omits the holder and licence ◂
- Files:
src/crypto/crypto.h:1-2; debian/copyright (Files: * stanza, lines 3-5, and the missing License: Apache-2.0 paragraph) - Evidence:
// SPDX-FileCopyrightText: Copyright 2018-2024 Arm Limited and/or its affiliates <open-source-office@arm.com>/// SPDX-License-Identifier: Apache-2.0(crypto.h lines 1-2). debian/copyright has onlyFiles: *->Copyright: 2024-2025, The bytesrw programmers/License: ISC, plus stanzas for test/tpsa_tool.ml, test/quickstart.ml and debian/*; no stanza mentions crypto.h or Arm. - Problem: The file is a vendored PSA Crypto API declaration header (743 lines of typedefs and PSA_* macros) copied from Arm's Apache-2.0 licensed PSA Crypto headers; it carries no bytesrw copyright. debian/copyright neither names the Arm copyright holder nor records Apache-2.0, and the catch-all Files: * stanza asserts ISC for it, which is wrong for that file. Apache-2.0 requires its notices to be retained, so the source package must document this file separately; it is not built or installed (nothing includes src/crypto/crypto.h; the C stubs include the system <psa/crypto.h>), but it is still shipped in the source tarball.
- Fix: Add a stanza such as
Files: src/crypto/crypto.h/Copyright: 2018-2024, Arm Limited and/or its affiliates/License: Apache-2.0, and a stand-aloneLicense: Apache-2.0paragraph referring to/usr/share/common-licenses/Apache-2.0(or quoting the text).
important licensing 2. Four CC0-1.0 test files are described as ISC in debian/copyright ◂
- Files:
test/cookbook.ml:3, test/min_tls.ml:3, test/webfetch.ml:3, test/webserve.ml:3; debian/copyright (Files: * and Files: test/quickstart.ml stanzas) - Evidence: Each of these files begins
Copyright (c) 2024/2025 The bytesrw programmers. All rights reserved./SPDX-License-Identifier: CC0-1.0. debian/copyright lists onlyFiles: test/quickstart.mlwithLicense: CC0-1.0; everything else, including these four, is covered byFiles: */License: ISC. - Problem: debian/copyright states the wrong licence for these four files: they are CC0-1.0, not ISC. Both licences are DFSG-free so this is not a licence-compatibility problem, but the copyright file is inaccurate and must describe the actual licence of every file.
- Fix: Extend the CC0-1.0 stanza to name all five files, e.g.
Files: test/cookbook.ml test/min_tls.ml test/quickstart.ml test/webfetch.ml test/webserve.ml(the CC0-1.0 text can be replaced by a reference to /usr/share/common-licenses/CC0-1.0, or kept).
minor packaging 3. zstd support is silently not built: libzstd-dev missing from Build-Depends ◂
- Files:
debian/control (Build-Depends), debian/rules, pkg/pkg.ml, pkg/META - Evidence: debian/control Build-Depends lists
libblake3-dev, libmd-dev, libxxhash-dev, zlib1g-devbut nolibzstd-dev; pkg/pkg.ml buildsPkg.mllib ~cond:zstd "src/zstd/bytesrw_zstd.mllib",cond:zstdbeingConf.with_pkg "conf-zstd"(pkg-config libzstd); pkg/META declares azstdfindlib sub-package; upstream's opam description and README advertise zstd support and test/test_zstd.ml, test/zstdtrip.ml exist. - Problem: Without libzstd-dev the pkg-config probe for zstd fails and the bytesrw.zstd library is dropped from the build (only zlib, blake3, md and xxhash backends are built). The omission is silent, unlike the deliberate
--with-conf-mbedtls false, and disagrees with what pkg/META and the upstream documentation advertise. - Fix: Add
libzstd-devto Build-Depends so the zstd backend is built (binary deps are picked up via ${shlibs:Depends}), or document that zstd is intentionally disabled.
Verified ◂
- Prescan finding accounted for: src/crypto/crypto.h is the Apache-2.0 Arm PSA header reported above; it is the only file whose holder is absent from debian/copyright.
- debian/copyright is valid DEP-5:
Format:is exactly the 1.0 URL; stanza ordering is correct (Files: * catch-all, then tpsa_tool.ml, quickstart.ml, debian/*); the ISC text is reproduced in full (required, ISC is not in /usr/share/common-licenses); CC0-1.0 full text is included (redundant, since /usr/share/common-licenses/CC0-1.0 exists) and Apache-2.0 is in /usr/share/common-licenses too. - LICENSE.md and the per-file
SPDX-License-Identifier: ISCheaders agree with the ISC text in debian/copyright; the only copyright holders in the tree are 'The bytesrw programmers' (all src/ and most test/ files), 'The tpsa programmers' (test/tpsa_tool.ml) and 'Arm Limited and/or its affiliates' (src/crypto/crypto.h). - All source files not carrying their own notice (doc/.mld, README.md, CHANGES.md, opam, _tags, BRZO, myocamlbuild.ml, B0.ml, pkg/) are upstream bytesrw files and are correctly covered by the Files: * ISC stanza.
- No built/minified artifacts, archives, bytecode, PDFs or fonts in the tree; the pre-review scan flagged no such files. src/crypto/crypto.h is a plain-text source header, not a build product.
- Packaging read in full and found sound: debian/control, rules, changelog, source/format, debian-findlib, dh-ocaml.conf.json, gbp.conf. source/format is 3.0 (quilt) with no debian/patches (nothing to forward). No maintainer scripts or *.maintscript. No debian/tests (autopkgtests not required). Standards-Version 4.7.4 matches current Policy 4.7.4 (Policy tool, section A10.2).
- debian-findlib is a legitimate dh-ocaml convention file: /usr/bin/dh_ocamllibinstall (via /usr/share/dh-ocaml/helper.exe) reads debian/debian-dune or debian/debian-findlib to learn the findlib package name, here 'bytesrw'.
- /usr/share/ocaml/ocamlvars.mk, which debian/rules includes, exists on the reviewing system.
- Used only file/URL-free reference tools (policy, apt-cache); libzstd-dev, libtopkg-ocaml-dev exist in the archive; b0/libb0-ocaml-dev do not appear in the archive lists.
- uscan found the packaged version as the newest upstream release (upstream
0.4.1, packaged0.4.1).
Not confirmed ◂
- debian/rules runs
ocaml pkg/pkg.ml testat dh_auto_test, but the test suite is b0-driven (B0.ml uses B0_kit/B0_ocaml, test/*.mlopen B0_testing) and b0 is neither in Build-Depends nor, apparently, in the Debian archive. If topkg'stestaction requires b0, the build would fail there; a build would show whether topkg merely warns and skips. I could not verify topkg's test action (libtopkg-ocaml-dev is not installed on the reviewing system). - The dh_auto_install target passes
opam-installer --docdir=./usr/share/ocaml-dune/doc; I could not confirm whether that path is the intended dh-ocaml dune-layout-1 documentation directory (dh-ocaml's own helper installs under /usr/share/ocaml-dune/) or an accidental carry-over from another package. opam-installer and its manual page are not available on the reviewing system. - No man pages could be read on the reviewing system (the man tool returned only its own documentation for every name tried, including dh_install), so opam-installer and debhelper command behaviour could not be checked from system manuals.
- Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused:
grep: " /usr/lib/dh-ocaml" is not a file of the package or of the reviewing system.
Proposed changes ◂
None.
Review Information
accepted — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.
Final Comment
Hi,
In your next upload, please correct debian/copyright information for:
- src/crypto/crypto.h: Copyright 2018-2024 Arm Limited, Apache-2.0 licensed
- test/cookbook.ml, test/min_tls.ml, test/webfetch.ml, test/webserve.ml: Copyright (c) 2024/2025 The bytesrw programmers, CC0-1.0 licensed (note that the CC0-1.0 text can be replaced by a reference to /usr/share/common-licenses/CC0-1.0 as well).
I note that the LLM reviewer also reckons your Build-Depends should reference libzstd-dev, but that's exactly the sort of wild assertion that is wrong about 20% of the time... :-)
Thanks!