DFSG NEW review for ocaml-decompress version 1.6.1+dfsg1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 5 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 6 found

Licensing

Every licence in the tree is DFSG-free: upstream code is MIT (LICENSE.md, matching the text in debian/copyright), the vendored miniLZO is GPL-2+ with its full COPYING, and test/bin/zpipe.c is public domain. No licence is combined into a shipped binary that is incompatible (the GPL-2+ miniLZO is linked only into test/fuzz executables, which are not distributed). debian/copyright is DEP-5, but it is not accurate for the whole tree: the 14 third-party files of test/corpus (the Calgary corpus) are declared MIT (c) Romain Calascibetta, although they are third-party text he did not write, and their provenance and terms are recorded nowhere; there are three smaller inaccuracies (upstream year given as 2029 instead of 2019, the public-domain stanza without the explanation copyright-format 1.0 requires, and the test/minilzo-2.10 glob also capturing files written for this project).

Packaging

The packaging is clean and follows the Debian OCaml team's current practice: dh 14 with dh-ocaml 3.8 and the dune buildsystem (debian/debian-dune, dh-ocaml.conf.json), quilt format, DEP-3 patch that disables exactly the tests needing the excluded file, two-package dev/runtime split with ${ocaml:Depends}/${ocaml:Provides}, and a sane changelog, Homepage and Vcs-* fields. Standards-Version 4.7.4 is current. Only small dependency-field nits remain: one Build-Depends is unnecessary (and currently unsatisfiable), and zlib1g-dev, which the cram test needs at build time, is not declared but happens to be pulled in transitively.

Issues

1. [important] [licensing] debian/copyright attributes the third-party Calgary-corpus test data to the upstream author under MIT

• Files: debian/copyright:2, debian/copyright:4-6, test/corpus/book1:1, test/corpus/book2:1, test/corpus/news:7906, test/corpus/progl:1
• Evidence: Files-Excluded: test/corpus/rfc5322.txt, then Files: * / Copyright: 2029, Romain Calascibetta / License: MIT. The corpus files are third-party: book1 begins <Y 1874> / <A T. HARDY> (Far from the Madding Crowd), book2 begins .CH "1 WHY SPEECH OUTPUT?" (Witten, Principles of computer speech), news is 1987 Usenet postings, progl/progc are excerpts of Lisp and C programs. No file under test/corpus/ carries any licence or copyright notice (grep for Copyright/(C)/SPDX/"All rights reserved" finds only ordinary prose in news).
• Problem: debian/copyright (Policy 4.5, DEP-5) must state the copyright holder and licence of every file; here 14 files written by others are declared to be the upstream author's MIT-licensed work. The package's own exclusion of test/corpus/rfc5322.txt shows the dir was treated as licensable material, yet nothing in the package establishes the terms of the other corpus files, which come from the Calgary corpus and include in-copyright material (book2 is a 1982 book).
• Fix: Add a Files stanza for test/corpus/* recording the files' origin and the terms they are shipped under (the Calgary corpus and the terms of its distribution), or, if those terms cannot be established, drop the corpus and disable the tests that use it, as was done for rfc5322.txt.

2. [minor] [licensing] debian/copyright gives the upstream copyright year as 2029

• Files: debian/copyright:5, LICENSE.md:3, CHANGES.md:1
• Evidence: Copyright: 2029, Romain Calascibetta against LICENSE.md Copyright (c) 2019 Romain Calascibetta; the changelog starts at v0.7 (2017) and the current release is dated 2026.
• Problem: The year is a typo, so the copyright statement in the package does not match the one in the source.
• Fix: Write a plausible range, e.g. Copyright: 2019-2026, Romain Calascibetta.

3. [minor] [licensing] public-domain stanza does not explain the exemption

• Files: debian/copyright:8-10, test/bin/zpipe.c:2
• Evidence: Stanza is just Copyright: not copyrighted / License: public-domain with nothing after the short name; zpipe.c says Not copyrighted -- provided to the public domain.
• Problem: copyright-format 1.0, section 7.1.1: when the License short name is public-domain, the remaining lines of the field must explain exactly what exemption the files have from copyright.
• Fix: Add an explanatory line after the short name, e.g. This file was explicitly placed in the public domain by its author (Mark Adler).

4. [minor] [licensing] test/minilzo-2.10/* stanza also claims project-written bindings for Oberhumer and the GPL

• Files: debian/copyright:12-14, test/minilzo-2.10/minilzo.ml:1, test/minilzo-2.10/stubs.c:1, test/minilzo-2.10/dune:1
• Evidence: Files: test/minilzo-2.10/* / Copyright: 1996-2017, Markus F.X.J. Oberhumer / License: GPL-2+; minilzo.ml (OCaml bindings: external compress ... = "caml_lzo1x_1_compress"), stubs.c and dune carry no Oberhumer notice and are part of this project.
• Problem: The glob covers the directory's own OCaml/C binding written for decompress, which is therefore described as Oberhumer's GPL-2+ code; those files belong to the upstream MIT work (Files: *).
• Fix: Restrict the stanza to the vendored files (minilzo.c, minilzo.h, lzoconf.h, lzodefs.h, COPYING, README.LZO, Makefile, testmini.c) and let minilzo.ml, stubs.c and dune fall under Files: *.

5. [minor] [packaging] Build-Depends on libbytesrw-ocaml-dev is not needed by anything the Debian build builds

• Files: debian/control:17, bench/dune:1-4, bench/b.ml:61
• Evidence: libbytesrw-ocaml-dev <!nocheck>; bench/dune has (libraries cmdliner bstr decompress.zl camlzip bytesrw.zlib) with no (package ...), and debian/debian-dune lists only decompress and rfc1951, so dh-ocaml runs dune build -p decompress,rfc1951 and dune runtest -p decompress,rfc1951 (Debian::Debhelper::Buildsystem::ocaml_dune).
• Problem: The benchmark belongs to no dune package, hence is neither built nor run from debian/rules; the dependency is superfluous for the build, and it also could not be found in the archive lists or in ftp-master's NEW queues (see unconfirmed).
• Fix: Drop libbytesrw-ocaml-dev from Build-Depends (or give bench/b a (package ...) and run the benchmark, if it is meant to be built).

6. [minor] [packaging] The build-time cram test needs zlib headers and library, which Build-Depends does not declare

• Files: test/bin/simple.t:5, test/bin/zpipe.c:18, debian/control:4-19
• Evidence: test/bin/simple.t runs cc -o zpipe zpipe.c -lz and zpipe.c does #include "zlib.h"; Build-Depends has no zlib1g-dev, and dh_auto_test runs dune runtest -p decompress because test/bin/dune declares (package decompress).
• Problem: zlib.h and libz.so are only available because libzip-ocaml-dev (Depends: zlib1g-dev) happens to be installed for the tests; the requirement should be declared explicitly, both for correctness and so that it keeps holding if the test dependencies change.
• Fix: Add zlib1g-dev <!nocheck> to Build-Depends, or drop that part of the cram test.

Verified

• Scan file test/corpus/geo, test/corpus/obj1, test/corpus/obj2, test/corpus/pic, test/corpus/trans: the binary members of the Calgary corpus, used only as test inputs (test/test.ml, test/test_ns.ml, test/test_deflate.ml, test/bin/simple.t); no binary package installs them (debian/libdecompress-ocaml-dev.install installs only usr/bin).
• Scan file test/corpus/news:7906: the body of a 1987 Usenet posting inside that corpus, not a licence term.
• Upstream licensing: LICENSE.md is MIT, Copyright (c) 2019 Romain Calascibetta, identical in substance to the MIT paragraph in debian/copyright; lib/.ml(i), bin/, fuzz/, bench/ and test/.ml carry no per-file notices; AUTHORS.md is a credit list, not a copyright notice.
• lib/lzo.ml is an independent OCaml LZO implementation (comments refer to minilzo only as a comparison oracle, e.g. it seems that [minilzo] does not call [ctz] at the end of [progl]); the libraries and the installed binary link no GPL code (lib/dune, bin/dune).
• test/minilzo-2.10 is GPL-2+ (COPYING is GPL-2; README.LZO: distributed under the terms of the GNU General Public License); it is linked only by test/test_lzo.ml and fuzz/fuzz_lzo.ml, which are not installed, so no GPL/MIT mixing reaches a binary package.
• test/bin/zpipe.c is zlib's public-domain example (Not copyrighted -- provided to the public domain), matching its stanza.
• Files-Excluded test/corpus/rfc5322.txt is absent from the tree; every reference to it (test/test.ml:1138, :1191 and their call sites) is disabled by debian/patches/0001, which is applied in test/test.ml:2113,2139,2146,2150 and test/test_ns.ml:1252; the tests reference only the 14 corpus files present.
• The absent lib/rfc1951.ml is generated at build time from lib/de.ml by the rule in lib/dune:8-11, so no source is missing.
• debian/copyright is DEP-5 with the exact current Format URL and no draft field names; Files-Excluded plus the +dfsg1 version are consistent with the tree.
• Packaging skeleton: debian/rules includes /usr/share/ocaml/ocamlvars.mk (present in dh-ocaml 3.8) and uses dh $@ --with ocaml --buildsystem ocaml_dune; source format 3.0 (quilt); gbp.conf sets pristine-tar; no maintainer scripts, dirs, links, docs or *.maintscript to check.
• Standards-Version 4.7.4 is current (Policy 4.7.4.1); debhelper-compat 14; the single program usr/bin/decompress is installed into the -dev package, which the Debian OCaml Packaging Policy permits when a library ships few programs; dev->runtime dependency comes from ${ocaml:Depends} (as in liboptint-ocaml-dev).
• Build-Depends names exist: ocaml-dune 3.24.1 (>= 2.8 needed by dune-project), libcheckseum-ocaml-dev 0.5.4, liboptint-ocaml-dev 0.3.0, libcmdliner-ocaml-dev 2.1.1, libzip-ocaml-dev 1.14, libcrowbar-ocaml-dev 0.2.2, dh-ocaml 3.8.
• Changelog is a single initial-release entry (1.6.1+dfsg1-1, unstable, medium) closing the ITP bug; version matches dune-project and both .opam files.
• There is no debian/tests/control; the upstream alcotest, cram and crowbar suites run at build time through dh_auto_test, which I judged sufficient for this library package.
• uscan found the packaged version as the newest upstream release (upstream 1.6.1, packaged 1.6.1+dfsg1).

Not confirmed

• libbytesrw-ocaml-dev was found neither in the archive lists nor among the binaries of this package or of uploads waiting in ftp-master's NEW queues; if it is still unavailable at upload time, dpkg-buildpackage will fail to install the build dependencies (see the corresponding issue).
• The split of files between libdecompress-ocaml-dev and libdecompress-ocaml is done by dh_ocamllibinstall (new in dh-ocaml 3.8); I could not run it, so I did not verify that the runtime package is non-empty or that every dune-installed file is claimed by a package.
• Whether the Calgary corpus files under test/corpus/ may be redistributed: nothing in the package states it, and I have no way to check it here (see the licensing issue).

Proposed changes

None.