DFSG NEW review for optee-client version 4.11.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 2 important, 2 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All licences in the tree are free (BSD-2-Clause, BSD-3-Clause, MIT-0, Apache-2.0) and DFSG-compliant; there are no non-commercial/no-modification clauses, no preferred-form problems (the tree is all C/Makefile/build text, no binaries or minified code), and no built files without sources. However debian/copyright is inaccurate: its single Files: * catch-all stanza names only Linaro/Open Mobile Platform/STMicroelectronics/Olivier Gay and declares everything BSD-2-Clause, omitting the Foundries Limited/Foundries.io holders of libseteec and the Vaisala Oyj holders of libasteec/libteeacl, and mislabelling the BSD-3-Clause pta_*.h files, the MIT-0 sd_notify files and the Apache-2.0 Android build files.

Packaging

The packaging is of good quality: clean split into dev/runtime/t64 packages, correct Multi-Arch (same) and Architecture restriction to arm64/armhf for OP-TEE, compat 12 with ${shlibs:Depends} and ${misc:Depends} present where needed, DEP-3 patches with clear purpose, docbook manpage generation wired into Build-Depends, data dir relocated for FHS and created at runtime. Only substantive nit is a stale Standards-Version (4.5.1 vs current 4.7.4.1).

Issues

1. [important] [licensing] debian/copyright omits copyright holders of libseteec, libasteec and libteeacl

• Files: debian/copyright
• Basis: checked, in the package or with a reference tool
• Evidence: The Files: * stanza reads Copyright: 2014-2021 Linaro Limited, 2020 Open Mobile Platform LLC, 2014 STMicroelectronics International N.V., 2005-2007 Olivier Gay. Yet libseteec/include/se_tee.h:3 is Copyright (c) 2021, Foundries.io, libseteec/src/se.c:3 Copyright (c) 2021, Foundries.io Ltd, libseteec/src/pta_apdu.h:3 and pta_scp03.h:3 Copyright (C) 2020/2021, Foundries Limited, and libasteec/include/asteec.h, libasteec/src/asteec.c, app_secrets_ta.h plus all libteeacl files carry Copyright (c) 2026/2020, Vaisala Oyj.
• Problem: The catch-all stanza is the governing Files: * match for these files, so their real copyright holders are not declared in debian/copyright. A sponsor would require every holder to be represented in the file.
• Fix: Add Foundries Limited / Foundries.io (Libseteec) and Vaisala Oyj (libasteec, libteeacl) to the Copyright line, or give them their own Files: stanzas.

2. [important] [licensing] Several files declared BSD-2-Clause are actually under a different licence

• Files: debian/copyright, libseteec/src/pta_apdu.h, libseteec/src/pta_scp03.h, tee-supplicant/src/sd_notify.c, tee-supplicant/src/sd_notify.h, Android.bp, optee_client.device.mk
• Basis: checked, in the package or with a reference tool
• Evidence: pta_apdu.h:1 and pta_scp03.h:1 are SPDX-License-Identifier: BSD-3-Clause; sd_notify.c:1 and sd_notify.h:1 are SPDX-License-Identifier: MIT-0 (a systemd standalone implementation); Android.bp:1 and optee_client.device.mk:1 are SPDX-License-Identifier: Apache-2.0. The Files: * stanza labels every file BSD-2-Clause and the sole License paragraph reproduces BSD-2-Clause text only.
• Problem: debian/copyright describes these files under the wrong licence short name and no text is given for MIT-0 or Apache-2.0 (and BSD-3-Clause differs from the supplied BSD-2-Clause text). All are free, so not a DFSG problem, but the licence description is inaccurate.
• Fix: Add a BSD-3-Clause stanza for pta_apdu.h and pta_scp03.h, name MIT-0 for sd_notify.c/h and Apache-2.0 for Android.bp/optee_client.device.mk, each with its full licence text.

3. [minor] [packaging] Standards-Version 4.5.1 is outdated

• Files: debian/control
• Basis: checked, in the package or with a reference tool
• Evidence: Standards-Version: 4.5.1; current Debian Policy is 4.7.4.1 (first components 4.5 vs 4.7).
• Problem: Per the review policy on Standards-Version, the first two components (4.5) are older than the current Policy's (4.7), so the field is out of date.
• Fix: Bump Standards-Version to 4.7.x after checking the A10 upgrading checklist.

4. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• All 99 upstream source files were matched by licence grep; every file carries one of BSD-2-Clause, BSD-3-Clause (libseteec/src/pta_.h), MIT-0 (tee-supplicant/src/sd_notify.) or Apache-2.0 (Android.bp, optee_client.device.mk). No non-free terms (NC/ND/no-modification/JSON-like clause) appear anywhere.
• Tree is all C / Makefile / build-system text: no .jar/.class/.so/.pyc/minified/PDF or built files lacking sources; preferred form for modification present.
• The BSD-2-Clause text in the License paragraph matches the upstream LICENSE and the BSD-2-Clause files; unfiled files (Makefiles, CMakeLists, config.mk, ci/, .github/, .devcontainer/) fall under the upstream LICENSE catch-all.
• sd_notify.c/h are the intended standalone systemd example, MIT-0 (attribution-free); more permissive than described, not a DFSG concern.
• Android.bp/optee_client.device.mk are Android build metadata not compiled into any Debian binary, Apache-2.0.
• Root Makefile defaults WITH_TEEACL/WITH_ASTEEC=1 and adds build-libteeacl/build-libasteec to the default build; copy_export installs headers and lib*.so* for libteeacl/libasteec, so the libteeacl0.1.0t64 and libasteec1 packages build real content.
• t64 packages carry Provides/Replaces/Breaks plus lintian-overrides for the soname-vs-package-name mismatch; consistent with the time_t transition.
• /var/lib/optee-client/data/tee is created at runtime by tee_supp_fs_init (do_mkdir/mkpath); tee-supplicant.dirs creates optee_armtz and plugin dirs.
• uscan found the packaged version as the newest upstream release (upstream 4.11.0, packaged 4.11.0).

Not confirmed

• Could not run the build; no build/test failure is indicated by anything in the tree.
• Could not confirm whether libteeacl0.1.0t64 was newly introduced or pre-existing in 4.10.0 from the changelog, which only says 'New upstream version'.