DFSG NEW review for ocaml-decompress version 1.6.1+dfsg1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 6 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 6 found

Licensing

debian/copyright is DEP-5, but its Files: * stanza (MIT, Copyright: 2029, Romain Calascibetta) is the only one matching test/corpus, which is the Calgary Corpus: a compiled set of third-party works (a published book, conference/journal papers, 1987 Usenet articles and program sources) for which the package carries no licence or permission statement. That makes the copyright file inaccurate and the source non-DFSG for those files. The project's own code (MIT) and the other exceptions (public-domain zpipe.c, GPL-2+ miniLZO used only by tests) are free and compatible.

Packaging

The packaging is sound: debhelper compat 14 with dh-ocaml 3.8's ocaml_dune buildsystem and the dune_layout_version 1 config, 3.0 (quilt), a clean two-package split, correct build-time test dependencies, and Standards-Version 4.7.4 (current). Remaining items are minor: no man page for the installed /usr/bin/decompress, no autopkgtest, one unused build-dependency, a patch without Description/Forwarded, and a small over-broad miniLZO stanza. Availability of libbstr-ocaml-dev could not be confirmed and is noted under unconfirmed.

Issues

1. [blocker] [licensing] test/corpus is third-party Calgary Corpus data with no licence, wrongly covered by the MIT Files: * stanza

• Files: debian/copyright:4-6, test/corpus/bib, test/corpus/book1, test/corpus/book2, test/corpus/geo, test/corpus/news, test/corpus/obj1, test/corpus/obj2, test/corpus/paper1, test/corpus/paper2, test/corpus/pic, test/corpus/progc, test/corpus/progl, test/corpus/progp, test/corpus/trans
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright has only Files: * / Copyright: 2029, Romain Calascibetta / License: MIT for these files. Their contents show other authors: test/corpus/book2:3 .ds CX "Principles of computer speech"; test/corpus/paper1:11-14 ARITHMETIC CODING FOR DATA COMPRESSION by Ian H. Witten, Radford M. Neal, and John G. Cleary; test/corpus/news:1-8 1987 Usenet Path:/From:/Newsgroups: headers from many posters; test/corpus/book1:2-3 <A T. HARDY> / <T Madding Crowd(Penguin 1978)>; test/corpus/progc:1-3 a compress program source. CHANGES.md:234 names the set as the Calgary corpus, and test/test.ml and test/test_deflate.ml read the files as test data.
• Problem: No stanza describes this data and no licence or permission for it exists anywhere in the package. The Files: * stanza therefore falsely attributes MIT-licensed copyright in third-party works to Romain Calascibetta, and Debian has no documented right to distribute or modify the files. That is both an inaccurate debian/copyright (Policy 12.5; copyright-format 5.2 requires the matching Files stanza to carry the real Copyright and License) and a DFSG 1/3 problem for the source.
• Fix: If the rights holders granted permission for the corpus, add a Files: test/corpus/* stanza naming the actual holders (the book and paper authors, the Usenet posters, the program authors) with the exact grant. Otherwise add test/corpus to Files-Excluded, repack the orig tarball (e.g. 1.6.1+dfsg2), and extend patch 0001 to disable the remaining corpus-based test cases.

2. [minor] [licensing] Wrong copyright year 2029 in Files: *

• Files: debian/copyright:5, LICENSE.md:3
• Basis: checked, in the package or with a reference tool
• Evidence: Copyright: 2029, Romain Calascibetta in debian/copyright versus Copyright (c) 2019 Romain Calascibetta in LICENSE.md.
• Problem: 2029 is in the future and contradicts the upstream licence; a wrong year in a required DEP-5 field is an inaccuracy, even if small.
• Fix: Change 2029 to 2019.

3. [minor] [licensing] miniLZO stanza over-attributes the OCaml binding files to Oberhumer/GPL-2+

• Files: debian/copyright:12-14, test/minilzo-2.10/minilzo.ml, test/minilzo-2.10/stubs.c, test/minilzo-2.10/dune
• Basis: checked, in the package or with a reference tool
• Evidence: Files: test/minilzo-2.10/* / Copyright: 1996-2017, Markus F.X.J. Oberhumer / License: GPL-2+, but minilzo.ml, stubs.c and dune are the decompress project's own OCaml/C binding files, carry no Oberhumer notice, and are covered by LICENSE.md (MIT).
• Problem: The wildcard applies the vendored LZO copyright and GPL-2+ to files that are not part of miniLZO, so the copyright file misstates both holder and licence for them.
• Fix: Narrow the stanza to the vendored LZO files (COPYING, Makefile, README.LZO, lzoconf.h, lzodefs.h, minilzo.c, minilzo.h, testmini.c) and let the MIT Files: * cover minilzo.ml, stubs.c and dune.

4. [minor] [packaging] No manual page for the installed /usr/bin/decompress

• Files: debian/libdecompress-ocaml-dev.install:1, bin/decompress.ml
• Basis: checked, in the package or with a reference tool
• Evidence: debian/libdecompress-ocaml-dev.install contains usr/bin, and neither the source nor debian/ has a man page or debian/manpages.
• Problem: Policy 12.1 says each program should have an associated manual page and that its absence is considered a bug; the package installs a user-facing CLI without one.
• Fix: Ship a decompress(1) manual page in the package containing the binary (cmdliner can emit one), or file and reference a bug if it is deferred.

5. [minor] [packaging] No autopkgtest

• Files: debian/, test/dune
• Basis: checked, in the package or with a reference tool
• Evidence: There is no debian/tests/control, although test/dune defines alcotest runtest targets and a cram CLI test.
• Problem: Nothing checks the installed package after the build; a new OCaml library benefits from an autopkgtest against the installed libraries.
• Fix: Add debian/tests/control (e.g. a dependency on the -dev package and a small test running the upstream suite or the decompress CLI).

6. [minor] [packaging] libbytesrw-ocaml-dev is an unused build-dependency

• Files: debian/control:19, bench/dune:6
• Basis: inferred from what was read, not seen directly
• Evidence: libbytesrw-ocaml-dev <!nocheck>, while the only use of bytesrw is (libraries ... bytesrw.zlib) in bench/dune. The dh-ocaml buildsystem (/usr/share/perl5/Debian/Debhelper/Buildsystem/ocaml_dune.pm) runs dune build and dune runtest with -p limited to the packages in debian/debian-dune (decompress, rfc1951); bench/ has no package association and is never built.
• Problem: The dependency is never needed for the build or tests, and apt-cache finds no such binary package in the archive or NEW (see unconfirmed), so it can only make dependency resolution fail.
• Fix: Remove libbytesrw-ocaml-dev from Build-Depends.

7. [minor] [packaging] Patch header lacks DEP-3 Description and Forwarded

• Files: debian/patches/0001-Disable-tests-that-rely-on-rfc5322-text.patch:1-6
• Basis: checked, in the package or with a reference tool
• Evidence: The header has only From:, Date: and Subject:; there is no Description: or Forwarded: field.
• Problem: DEP-3 asks for a Description and a Forwarded status; this is a Debian-repack patch that should explicitly not be sent upstream.
• Fix: Add Description: explaining the rfc5322.txt repack and Forwarded: not-needed.

Verified

• Full inventory taken with glob (hidden files included, gitignore disabled): 58 files in root, lib/, bin/, bench/, fuzz/, test/ (including corpus/ and minilzo-2.10/), .github/ and debian/. All were read except the five binary corpus files, which were identified by their Calgary Corpus names and their use in test/test.ml and test/test_deflate.ml; .pc/ was excluded.
• Prescan binary files test/corpus/geo, obj1, obj2, pic and trans are part of the same Calgary Corpus fixture set, consumed by the alcotest corpus tests; they are not build products, and their licensing is covered by the corpus issue.
• Prescan wording at test/corpus/news:7906 is a 1987 Usenet subject line Re: EVALuation of Shareware Word Processors, not a licence clause; no proprietary licence term is present.
• Prescan author check reports all declared source authors are named in debian/copyright; no holder from that check is missing.
• Files-Excluded test/corpus/rfc5322.txt is honoured: the file is absent from the tree and patch 0001 comments out the four tests in test/test.ml and test/test_ns.ml that open it.
• test/bin/zpipe.c is Mark Adler's zlib example marked Not copyrighted -- provided to the public domain, matching its stanza.
• test/minilzo-2.10 is miniLZO 2.10 under GPL-2+ (COPYING plus per-file headers saying version 2 or any later version), used only by test/test_lzo.ml and fuzz/fuzz_lzo.ml, not installed; GPL-2+ and MIT are compatible in those test binaries.
• LICENSE.md is MIT for the project; lib/, bin/, bench/, fuzz/, .github/, Dockerfile and the opam/dune metadata carry no conflicting notice.
• All of debian/ read: control, rules (dh $@ --with ocaml --buildsystem ocaml_dune), changelog (initial release closing #1150429, unstable), source/format 3.0 (quilt), gbp.conf, dh-ocaml.conf.json (dune_layout_version 1, matching dh-ocaml 3.8), debian-dune, install file; there are no maintainer scripts, debian/tests or man pages.
• Build mechanics checked against /usr/share/perl5/Debian/Debhelper/Buildsystem/ocaml_dune.pm: build/test use dune -p with the debian-dune package list, and install uses dune install with the configured layout.
• Standards-Version 4.7.4 is current for Policy 4.7.4.1; debhelper-compat 14 is used. Every Build-Depends name except libbstr-ocaml-dev and libbytesrw-ocaml-dev exists in apt-cache's package lists.
• Oddities in debian/patches were checked: series lists only 0001 and the patch content matches the applied state in test/test.ml and test/test_ns.ml.
• uscan found the packaged version as the newest upstream release (upstream 1.6.1, packaged 1.6.1+dfsg1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed

• libbstr-ocaml-dev is in neither the archive lists nor ftp-master's NEW queue according to apt-cache; the test and fuzz executables genuinely use bstr, so if the package is not accepted before the build, the build with tests fails. The lists may be a few days old.
• libbytesrw-ocaml-dev is likewise absent from the lists and NEW; issue 5 proposes dropping it as unnecessary.
• No permission statement for the Calgary Corpus was found anywhere in the package; if one exists outside it, debian/copyright must record it rather than the files being excluded. Their free status is otherwise unverified.

Proposed changes

None.