ocaml-tar 3.5.0-1

Package Information

Description	decode and encode tar format files in pure OCaml (dev) tar is a library to read and write tar files with an emphasis on streaming. This is pure OCaml code, no C bindings. This package contains development files.
Maintainer	Debian OCaml Maintainers <debian-ocaml-maint@lists.debian.org>
Changed By	Stéphane Glondu <glondu@debian.org>
Sponsor	glondu@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/ocaml-team/ocaml-tar.git (browse)
Closes	#1151031
Tracker	https://tracker.debian.org/pkg/ocaml-tar
Uploaded	3 hours ago

New Package Report

.changes◂

Source	ocaml-tar
Version	3.5.0-1
Changed-By	Stéphane Glondu <glondu@debian.org>
Architecture	source arm64
Distribution	unstable
Date	Thu, 22 Oct 2026 15:47:41 +0200

Changelog◂

ocaml-tar (3.5.0-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1151031)

.dsc◂

Section	ocaml
Priority	optional
Component	main
Package-List	libtar-ocaml deb ocaml optional arch=any libtar-ocaml-dev deb ocaml optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/

Files: *
Copyright: 2012-2018, The ocaml-tar contributors
           2022, Romain Calascibetta
           2006-2015, Citrix Systems Inc.
           2012, Thomas Gazagnaire
           2023, Patrick Ferris
License: ISC

Files: lib_test/parse_test.ml
Copyright: 2011-2013, Citrix Inc
License: LGPL-2.1-only

Files: debian/*
Copyright: 2026, Stéphane Glondu <glondu@debian.org>
License: ISC

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: LGPL-2.1-only
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU Lesser General Public License as published
 by the Free Software Foundation; version 2.1 only. with the special
 exception on linking described as follows.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU Lesser General Public License for more details.
 .
 As a special exception to the GNU Library General Public License, you
 may link, statically or dynamically, a "work that uses the Library"
 with a publicly distributed version of the Library to produce an
 executable file containing portions of the Library, and distribute
 that executable file under terms of your choice, without any of the
 additional requirements listed in clause 6 of the GNU Library General
 Public License.  By "a publicly distributed version of the Library",
 we mean either the unmodified Library as distributed by INRIA, or a
 modified version of the Library that is distributed under the
 conditions defined in clause 3 of the GNU Library General Public
 License.  This exception does not however invalidate any other reasons
 why the executable file might be covered by the GNU Library General
 Public License.
 .
 On Debian systems, the complete text of the GNU Library General
 Public License can be found in /usr/share/common-licenses/LGPL-2.1 file.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for ocaml-tar version 3.5.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 4 found

Licensing

The tree is almost entirely ISC (LICENSE.md matches the notice in every module header; dune-project declares (license ISC)), and lib_test/parse_test.ml is LGPL-2.1-only with a special linking exception, as its header states. debian/copyright is DEP-5 with a Files: * catch-all naming all ISC holders and a separate stanza for parse_test.ml, plus stand-alone ISC and LGPL-2.1-only paragraphs (LGPL pointing to /usr/share/common-licenses/LGPL-2.1). The pre-scan's author comparison found every holder declared in the packaging present; none missing. The four .tar files are test fixtures consumed by parse_test.ml, not built artifacts with absent sources. Both licences are free and compatible. DFSG-compliant.

Packaging

Modern standard OCaml packaging: debhelper-compat 14, dh with the ocaml + ocaml_dune sequence, ${ocaml:Depends}/${ocaml:Provides} from dh-ocaml, proper -dev/-runtime split, dpkg-buildflags hardening, upstream Vcs-* on salsa, Standards-Version 4.7.4 (current first-two 4.7), well-formed changelog with a bug closure. Only minor cleanup: a stray install file referencing a binary package not declared in the source.

Issues

1. [minor] [packaging] Stray install file for a binary package not in the source

Files: debian/libdecompress-ocaml-dev.install
Basis: checked, in the package or with a reference tool
Evidence: File content is usr/bin; debian/control declares only libtar-ocaml-dev and libtar-ocaml as binary packages, no libdecompress-ocaml-dev.
Problem: dh only processes debian/<package>.install files for binary packages declared in debian/control, so this file is dead weight that installs nothing; likely a scaffolding leftover. Harmless, but should be removed.
Fix: Delete debian/libdecompress-ocaml-dev.install.

Verified

debian/copyright is machine-readable (DEP-5) and, read in full, correctly maps every file: Files: * (ISC) with all holders (ocaml-tar contributors, Romain Calascibetta, Citrix Systems Inc., Thomas Gazagnaire, Patrick Ferris) matches module headers in lib/, unix/, eio/, mirage/, bin/ and the top-level LICENSE.md; lib_test/parse_test.ml is separately LGPL-2.1-only per its header.
Copyright holders found across the tree (Citrix, Thomas Gazagnaire, Romain Calascibetta, Patrick Ferris, contributors) are all named in debian/copyright; the pre-scan's author check confirms none is missing.
The four files the scan flagged (lib_test/long-implicit-dir.tar, long-pax.tar, long.tar, pax-shenanigans.tar) are tar archives used as test fixtures; parse_test.ml reads them by name. They are test data, not missing-preferred-form artifacts, in a tar-consuming library's own suite.
Libraries used at runtime are reflected in Build-Depends (libdecompress, liblogs, libfpath, liblwt) for the shipped tar/tar-unix surfaces; the non-shipped tar-mirage/tar-eio dune packages are excluded via debian/dune listing only tar and tar-unix.
debhelper compat 14 auto-adds relationship substvars; Depends fields (${shlibs:Depends}, ${ocaml:Depends}, ${misc:Depends}) are correct; hardening via default build flags through dh.
Standards-Version 4.7.4 has current first two components (Policy now 4.7.x); not an issue.
uscan found the packaged version as the newest upstream release (upstream 3.5.0, packaged 3.5.0).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (LGPL-2.1).

Not confirmed

lib_test/dune declares (package tar-mirage) and uses mirage-block-unix, mirage-block, alcotest, alcotest-lwt, none of which are Build-Depends, while debian/dune restricts installed dune packages to tar and tar-unix. Whether the ocaml_dune build runs these tests, or whether missing build-deps would break the test build, depends on dh-ocaml's handling of unshipped dune packages; I could not run a build. If tests build, missing alcotest/mirage deps could fail them.
Build-Depends libdecompress-ocaml-dev is not present in the reviewing system's package lists; presumably part of the same new-OCaml-cohort upload or accepted recently. Not treated as a fault on that basis.
No debian/tests autopkgtest harness is present; not required for this library and not counted against it.

Proposed changes

None.

Uploader's response to the LLM review

The uploader was emailed about the review 1 hour ago.

Back to Dashboard | View all reviews for this package