DFSG NEW review for orac version 0.1.0

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 3 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Apache-2.0 throughout and accurately described. LICENSE is the full Apache-2.0 text, every orac/.py and orac/tests/unit/.py carries the Apache-2.0 notice, setup.cfg and README.rst agree, and debian/copyright is DEP-5 with a Files: * stanza plus a stanza for bash-completion/orac, whose 2018-2024 notice names the same holder (Thomas Goirand). No non-free wording, no embedded third-party code, and every file in the tree is matched by a stanza.

Packaging

The packaging follows the OpenStack team's template and has no policy or dependency faults: correct Build-Depends/-Indep split, debhelper compat 13 with a nocheck-guarded test override, autopkgtest using @builddeps@, ${misc:Depends}/${python3:Depends} present, and a source format consistent with the shipped native tarball. Only small man-page inaccuracies: it points at documentation paths and an orac(3) page that are not shipped, and documents a --verbose option the program does not accept.

Issues

minor packaging 1. man page points to /usr/share/doc/orac/docs/*.md and to orac(3), neither of which the package ships ◂

• Files: debian/orac.1:128-135, debian/orac.docs:2, debian/orac.manpages:1
• Basis: checked, in the package or with a reference tool
• Evidence: debian/orac.1 has .BR orac (3) and .IR /usr/share/doc/orac/docs/inband-protocol.md , / .IR /usr/share/doc/orac/docs/remote-protocol.md .; debian/orac.docs lists docs/*.md; dh_installdocs copies a listed file with doit("cp", ..., "-a", $doc, $target_dir), so each one lands as /usr/share/doc/orac/; debian/orac.manpages lists only debian/orac.1.
• Problem: After installation the SEE ALSO references are dead: the protocol notes are /usr/share/doc/orac/inband-protocol.md and .../remote-protocol.md (no docs/ subdirectory), and there is no section-3 manual page for orac. Users following the man page find nothing.
• Fix: Either list docs/ instead of docs/*.md in debian/orac.docs (which installs the directory as /usr/share/doc/orac/docs/), or change the two paths in debian/orac.1 to the flat locations; drop the orac (3) reference or ship the page.

minor packaging 2. debian/orac.1 documents --verbose, which the shipped program does not accept ◂

• Files: debian/orac.1:89-90, orac/main.py:180-218
• Basis: checked, in the package or with a reference tool
• Evidence: debian/orac.1: .B \-\-verbose / Log at the INFO level. build_conf() registers device, remote*, interactive, stoponcerterr, more, nocertwarn and the ignored -v/-l/-L/-t options, then logging.register_options(); oslo.log 8.3.2 registers only debug (short='d') as a CLI option (/usr/lib/python3/dist-packages/oslo_log/_options.py:44-52) and oslo.config parses with argparse's parse_args (/usr/lib/python3/dist-packages/oslo_config/cfg.py:3984), so an unknown option is a usage error.
• Problem: orac --verbose get idrac.info aborts argument parsing (SystemExit code 2, returned by main()) instead of running, while the man page presents --verbose as a global option. The bash completion also offers it, and orac/tests/unit/test_completion.py requires it there, so nothing catches the mismatch.
• Fix: Remove the --verbose entry from debian/orac.1 and, upstream, from bash-completion/orac and the main.py module docstring; or register a verbose option in build_conf().

minor packaging 3. debian/watch is in the old version 4 format ◂

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

• bash-completion/orac (the file the prescan listed): its line 4 is # (c) 2018-2024 Thomas Goirand <zigo@debian.org>, Apache-2.0.; it is covered by the later Files: bash-completion/orac stanza (2018-2024, 2026, Thomas Goirand), so the holder the prescan matched only approximately is the same person and nothing is missing.
• Read or grepped all 28 non-debian files: every orac/.py and orac/tests/unit/.py opens with the Apache-2.0 notice, LICENSE is the complete Apache-2.0 text, setup.cfg says license = Apache-2.0, README.rst says Apache-2.0; no other LICENSE/COPYING/NOTICE/AUTHORS file exists anywhere in the tree.
• No non-free or restricted wording: grep for non-commercial, no-modification, field-of-use, CC-*-NC/ND, 'All rights reserved', GPL/LGPL/MPL/MIT/BSD found only the Apache-2.0 texts and unrelated hyphenated words.
• docs/*.md are original protocol notes (prose, no copied vendor code): the Dell references describe observed behaviour, and grep over docs plus orac/ found no embedded or vendored third-party code; the runtime imports are the standard library, oslo.config and oslo.log only.
• No built artifacts, bytecode, minified code, PDFs, images, fonts or archives in the tree; no .pc/ directory and no debian/cargo-checksum.json; the only data-heavy file, bash-completion/orac, is a hand-maintained shell script.
• Read every packaging file except watch: control, rules, copyright, changelog, orac.1, orac.docs, orac.install, orac.manpages, salsa-ci.yml, source/format, source/options, tests/control, tests/unittests.
• Dependencies exist and are satisfiable: openstack-pkg-tools 158 (Build-Depends needs >= 123~), dh-python, python3-pbr, python3-setuptools, python3-oslo.config 10.7.0, python3-oslo.log 8.3.2.
• autopkgtest: @builddeps@ expands to Build-Depends, Build-Depends-Indep and build-essential (autopkgtest specification, Depends field), so pkgos-dh_auto_test from openstack-pkg-tools and the test dependencies are installed for debian/tests/unittests; .stestr.conf and orac/tests are present in the source tree.
• debhelper compat 13: dh itself skips the override_dh_auto_test target under nocheck, and debian/rules also guards on nocheck; ${misc:Depends} and ${python3:Depends} are declared; dh_install's bash-completion/orac usr/share/bash-completion/completions installs into that directory (dh_install(1) EXAMPLES).
• Standards-Version 4.7.4 shares its first two components with the reviewing system's Policy 4.7.4.1, so it is not an issue; the changelog entry is a well-formed initial upload to unstable closing the ITP.
• Source format 3.0 (native) matches the shipped orac_0.1.0.tar.xz (no .orig tarball; debian/ is inside it, as native format requires), and source/options' tar-ignores (.opencode, AGENTS.md) name files that are absent from the tree, so nothing excluded is expected in debian/copyright.
• python3-oslo.config Depends: python3-pbr, which is the module main.py's _version_string() imports, so orac --version resolves at runtime despite pbr being only a Build-Depends.
• uscan found the packaged version as the newest upstream release (upstream 0.1.0, packaged 0.1.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

• Whether the build supplies a pbr version could not be confirmed: the native tarball contains neither PKG-INFO/METADATA nor .git, and debian/rules does not export PBR_VERSION, in which case pbr's get_version() raises (pbr packaging.py:409). openstack-pkg-tools is not installed on the reviewing system, so I could not read pkgos.make, which would be the place to set it; a build log would show.
• openstack-pkg-tools is not installed, so the exact behaviour of pkgos-dh_auto_test (used in both debian/rules and debian/tests/unittests) was not read; the package uses the OpenStack team's usual template for it.