Review: optee-client 4.11.0-1

Package Information

Description	normal world user space client APIs for OP-TEE (development) OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. OP-TEE implements TEE Internal Core API v1.1.x which is the API exposed to Trusted Applications and the TEE Client API v1.0, which is the API describing how to communicate with a TEE. This package provides the TEE Client API library. This package contains the development files OpTEE Client API
Maintainer	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Changed By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Sponsor	paulliu@debian.org
Distribution	unstable
Architecture	arm64 armhf
VCS	git: https://salsa.debian.org/debian/optee-client.git (browse)
Popcon Installs	2
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/optee-client
Uploaded	19 days ago

New Package Report

.changes◂

Version	4.11.0-1
Changed-By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Architecture	source arm64
Distribution	unstable
Date	Tue, 20 Oct 2026 00:03:46 +0100
Source	optee-client

Changelog◂

optee-client (4.11.0-1) unstable; urgency=low
 .
   * New upstream version 4.11.0
   * debian/control: add new package libasteec1
   * debian/patches/0001_fix_libasteec_symlink.patch: fix libasteec symlink

.dsc◂

Section	libs
Priority	optional
Component	main
Package-List	libasteec1 deb libs optional arch=arm64,armhf libckteec0t64 deb libs optional arch=arm64,armhf libseteec0t64 deb libs optional arch=arm64,armhf libteeacl0.1.0t64 deb libs optional arch=arm64,armhf libteec2 deb libs optional arch=arm64,armhf optee-client-dev deb libdevel optional arch=arm64,armhf tee-supplicant deb libs optional arch=arm64,armhf

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: optee-client
Upstream-Contact: https://github.com/OP-TEE/optee_client
Source: https://github.com/OP-TEE/optee_client

Files: *
Copyright: 2014-2021 Linaro Limited
	   2020 Open Mobile Platform LLC
           2014 STMicroelectronics International N.V.
	   2005-2007 Olivier Gay <olivier.gay@a3.epfl.ch>
License: BSD-2-Clause

Files: debian/*
Copyright: 2021 Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
License: BSD-2-Clause

License: BSD-2-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice,
 this list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright notice,
 this list of conditions and the following disclaimer in the documentation
 and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 2 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 19 days ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for optee-client version 4.11.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 2 important, 2 minor
debian/watch: old format (version 4)
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

All licences in the tree are free (BSD-2-Clause, BSD-3-Clause, MIT-0, Apache-2.0) and DFSG-compliant; there are no non-commercial/no-modification clauses, no preferred-form problems (the tree is all C/Makefile/build text, no binaries or minified code), and no built files without sources. However debian/copyright is inaccurate: its single Files: * catch-all stanza names only Linaro/Open Mobile Platform/STMicroelectronics/Olivier Gay and declares everything BSD-2-Clause, omitting the Foundries Limited/Foundries.io holders of libseteec and the Vaisala Oyj holders of libasteec/libteeacl, and mislabelling the BSD-3-Clause pta_*.h files, the MIT-0 sd_notify files and the Apache-2.0 Android build files.

Packaging

The packaging is of good quality: clean split into dev/runtime/t64 packages, correct Multi-Arch (same) and Architecture restriction to arm64/armhf for OP-TEE, compat 12 with ${shlibs:Depends} and ${misc:Depends} present where needed, DEP-3 patches with clear purpose, docbook manpage generation wired into Build-Depends, data dir relocated for FHS and created at runtime. Only substantive nit is a stale Standards-Version (4.5.1 vs current 4.7.4.1).

Issues

important licensing 1. debian/copyright omits copyright holders of libseteec, libasteec and libteeacl ◂

Files: debian/copyright
Basis: checked, in the package or with a reference tool
Evidence: The Files: * stanza reads Copyright: 2014-2021 Linaro Limited, 2020 Open Mobile Platform LLC, 2014 STMicroelectronics International N.V., 2005-2007 Olivier Gay. Yet libseteec/include/se_tee.h:3 is Copyright (c) 2021, Foundries.io, libseteec/src/se.c:3 Copyright (c) 2021, Foundries.io Ltd, libseteec/src/pta_apdu.h:3 and pta_scp03.h:3 Copyright (C) 2020/2021, Foundries Limited, and libasteec/include/asteec.h, libasteec/src/asteec.c, app_secrets_ta.h plus all libteeacl files carry Copyright (c) 2026/2020, Vaisala Oyj.
Problem: The catch-all stanza is the governing Files: * match for these files, so their real copyright holders are not declared in debian/copyright. A sponsor would require every holder to be represented in the file.
Fix: Add Foundries Limited / Foundries.io (Libseteec) and Vaisala Oyj (libasteec, libteeacl) to the Copyright line, or give them their own Files: stanzas.

important licensing 2. Several files declared BSD-2-Clause are actually under a different licence ◂

Files: debian/copyright, libseteec/src/pta_apdu.h, libseteec/src/pta_scp03.h, tee-supplicant/src/sd_notify.c, tee-supplicant/src/sd_notify.h, Android.bp, optee_client.device.mk
Basis: checked, in the package or with a reference tool
Evidence: pta_apdu.h:1 and pta_scp03.h:1 are SPDX-License-Identifier: BSD-3-Clause; sd_notify.c:1 and sd_notify.h:1 are SPDX-License-Identifier: MIT-0 (a systemd standalone implementation); Android.bp:1 and optee_client.device.mk:1 are SPDX-License-Identifier: Apache-2.0. The Files: * stanza labels every file BSD-2-Clause and the sole License paragraph reproduces BSD-2-Clause text only.
Problem: debian/copyright describes these files under the wrong licence short name and no text is given for MIT-0 or Apache-2.0 (and BSD-3-Clause differs from the supplied BSD-2-Clause text). All are free, so not a DFSG problem, but the licence description is inaccurate.
Fix: Add a BSD-3-Clause stanza for pta_apdu.h and pta_scp03.h, name MIT-0 for sd_notify.c/h and Apache-2.0 for Android.bp/optee_client.device.mk, each with its full licence text.

minor packaging 3. Standards-Version 4.5.1 is outdated ◂

Files: debian/control
Basis: checked, in the package or with a reference tool
Evidence: Standards-Version: 4.5.1; current Debian Policy is 4.7.4.1 (first components 4.5 vs 4.7).
Problem: Per the review policy on Standards-Version, the first two components (4.5) are older than the current Policy's (4.7), so the field is out of date.
Fix: Bump Standards-Version to 4.7.x after checking the A10 upgrading checklist.

minor packaging 4. debian/watch is in the old version 4 format ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

All 99 upstream source files were matched by licence grep; every file carries one of BSD-2-Clause, BSD-3-Clause (libseteec/src/pta_.h), MIT-0 (tee-supplicant/src/sd_notify.) or Apache-2.0 (Android.bp, optee_client.device.mk). No non-free terms (NC/ND/no-modification/JSON-like clause) appear anywhere.
Tree is all C / Makefile / build-system text: no .jar/.class/.so/.pyc/minified/PDF or built files lacking sources; preferred form for modification present.
The BSD-2-Clause text in the License paragraph matches the upstream LICENSE and the BSD-2-Clause files; unfiled files (Makefiles, CMakeLists, config.mk, ci/, .github/, .devcontainer/) fall under the upstream LICENSE catch-all.
sd_notify.c/h are the intended standalone systemd example, MIT-0 (attribution-free); more permissive than described, not a DFSG concern.
Android.bp/optee_client.device.mk are Android build metadata not compiled into any Debian binary, Apache-2.0.
Root Makefile defaults WITH_TEEACL/WITH_ASTEEC=1 and adds build-libteeacl/build-libasteec to the default build; copy_export installs headers and lib*.so* for libteeacl/libasteec, so the libteeacl0.1.0t64 and libasteec1 packages build real content.
t64 packages carry Provides/Replaces/Breaks plus lintian-overrides for the soname-vs-package-name mismatch; consistent with the time_t transition.
/var/lib/optee-client/data/tee is created at runtime by tee_supp_fs_init (do_mkdir/mkpath); tee-supplicant.dirs creates optee_armtz and plugin dirs.
uscan found the packaged version as the newest upstream release (upstream 4.11.0, packaged 4.11.0).

Not confirmed ◂

Could not run the build; no build/test failure is indicated by anything in the tree.
Could not confirm whether libteeacl0.1.0t64 was newly introduced or pre-existing in 4.10.0 from the changelog, which only says 'New upstream version'.

Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

# Compulsory line, this is a version 4 file
# GitHub hosted projects
Template: Github
Dist: https://github.com/OP-TEE/optee_client
Update-Script: uupdate

Uploader's response to the LLM review

The uploader hasn't responded yet, and is welcome to at any time. The 24-hour hold has ended, so the package is now open for review as usual.

Review Information

accepted — allocated to awm 15 days ago, started 15 days ago, completed 15 days ago.

Final Comment

Hi,

Please fix the two important issues identified by the LLM review.

Thanks!

Public Notes

15 days ago ● public

Missed Author Check

Command: dfsg-author-check -markdown
Exit code: 1

Author check: optee-client-4.11.0

Scanned 99 files. Authors declared in debian/copyright: 5.

Not named in debian/copyright (4):

Foundries Limited
- libseteec/src/pta_apdu.h:3
- libseteec/src/pta_scp03.h:3
- libseteec/src/se.c:3
Foundries.io Jorge Ramirez-Ortiz <jorge@foundries.io>
- libseteec/include/se_tee.h:3
The Android Open Source Project
- Android.bp:3
- optee_client.device.mk:3
Vaisala Oyj
- libasteec/include/asteec.h:3
- libasteec/src/app_secrets_ta.h:3
- libasteec/src/asteec.c:3
- libteeacl/include/teeacl.h:3
- libteeacl/src/group.c:3
- … and 1 more file

Result: 4 holders not named in debian/copyright

To name them, add to the end of debian/copyright:

Files: Android.bp
 libasteec/include/asteec.h
 libasteec/src/app_secrets_ta.h
 libasteec/src/asteec.c
 libseteec/include/se_tee.h
 libseteec/src/pta_apdu.h
 libseteec/src/pta_scp03.h
 libseteec/src/se.c
 libteeacl/include/teeacl.h
 libteeacl/src/group.c
 libteeacl/src/tee_uuid.c
 optee_client.device.mk
Copyright: 2020-2021 Foundries Limited
           2021 Foundries.io Jorge Ramirez-Ortiz <jorge@foundries.io>
           2024 The Android Open Source Project
           2020, 2026 Vaisala Oyj
License: BSD-2-Clause

Each paragraph names every holder found in its files, with the years their copyright lines give, and has the License of the paragraph that covers them now, which it takes the place of for them. Check the License, and whether the files' holders are all there: one a file names only in prose, or in a form the check passes over, is not.

Back to Dashboard | View all reviews for this package