DFSG, Licensing & New Packages Team

Hi,

A number of issues were found, but the package is already in Debian with these issues, so it is accepted. Please fix these with your next upload.

1. [important] [licensing] doc/manuals/ is absent from debian/copyright and ships non-free (GFDL with Invariant Sections) and unlicensed files in the source package

• Files: debian/copyright (Files: * stanza), doc/manuals/osmomgw-usermanual-docinfo.xml, doc/manuals/osmomgw-usermanual.adoc, doc/manuals/osmomgw-vty-reference.xml
• Evidence: osmomgw-usermanual-docinfo.xml: "Version 1.3 or any later version ... with the Invariant Sections being just 'Foreword', 'Acknowledgements' and 'Preface'". osmomgw-vty-reference.xml: "This work is copyright by sysmocom - s.f.m.c. GmbH. All rights reserved." (no licence grant). debian/patches/non-dfsg-manuals.patch: "the manual contains an invariant section and is not compatible with DFSG", and removes doc/manuals from the build (configure.ac AC_CONFIG_FILES and doc/Makefile.am SUBDIRS). Files-Excluded in debian/copyright lists only debian.
• Problem: debian/copyright must cover every file in the source; doc/manuals is completely undocumented. The GFDL Invariant Sections make the manual non-free per Debian (this is the exact tag that debian/source/lintian-overrides suppresses), and the vty-reference XML has no free licence at all. The patch only prevents the manual being built and installed, so the binary packages are clean, but the non-free/unlicensed sources are still distributed in the +dfsg1 orig tarball, which defeats the purpose of the dfsg repack.
• Fix: Document doc/manuals in debian/copyright with a GFDL-1.3 Files stanza (© 2017-2018 sysmocom - s.f.m.c. GmbH) including the GFDL text, and either Files-Exclude the non-free manual in the repack (requires +dfsg2) or, at minimum, drop the lintian override and state the rationale. The vty-reference file with no grant needs an upstream licence or exclusion as well.

2. [important] [licensing] GPL-2+ sources shipped in libosmo-mgcp-client16 are covered by the AGPL-3.0+ catch-all stanza

• Files: debian/copyright (Files: * stanza), src/libosmo-mgcp-client/{mgcp_client,mgcp_client_vty,mgcp_client_fsm,mgcp_client_pool}.c, src/libosmo-mgcp/g711common.h
• Evidence: Each header says "GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version." (g711common.h: "Copyright (c) 2000 by Abramo Bagnara abramo@alsa-project.org"); the catch-all stanza grants License: AGPL-3.0+.
• Problem: These five files are explicitly GPL-2+ yet debian/copyright describes them as AGPL-3.0+. They are compiled into the shipped libosmo-mgcp-client16 library, so the inaccuracy affects a shipped binary's licensing record. GPL-2+ is compatible with the AGPL-covered rest of the library, so this is not a DFSG problem, but the licence short names and holders do not match the files.
• Fix: Add a Files: stanza for these five files with an appropriate Copyright (sysmocom 2016; Abramo Bagnara 2000 for g711common.h) and License: GPL-2+, with the full GPL-2 or a reference to /usr/share/common-licenses/GPL-2.

3. [minor] [licensing] git-version-gen and .clang-format have licence headers that do not match the AGPL-3.0+ catch-all

• Files: debian/copyright, git-version-gen, .clang-format
• Evidence: git-version-gen: "either version 3 of the License, or (at your option) any later version" with "Copyright (C) 2007-2010 Free Software Foundation, Inc." (GPL-3.0+). .clang-format line 1: # SPDX-License-Identifier: GPL-2.0. Both fall under the Files: * License: AGPL-3.0+ stanza.
• Problem: Neither file is AGPL-3.0+, nor is the FSF holder listed; the catch-all gives an inaccurate licence and holder for them.
• Fix: Add stanzas for git-version-gen (GPL-3.0+, © Free Software Foundation) and .clang-format (GPL-2.0, SPDX short name), or explicitly note them as covered by the project's overall licence if that is upstream's intent.

4. [minor] [packaging] Dead packaging files left over from the removed libosmo-mgcp1 / libosmo-mgcp-dev packages

• Files: debian/libosmo-mgcp1.install, debian/libosmo-mgcp1.symbols, debian/libosmo-mgcp-dev.install, debian/.symbols, debian/osmo-mgw.cfg
• Evidence: debian/control defines no libosmo-mgcp1 or libosmo-mgcp-dev package (libosmo-mgcp is now an internal noinst_LIBRARIES static lib, src/libosmo-mgcp/Makefile.am). debian/.symbols and libosmo-mgcp1.symbols are for libosmo-legacy-mgcp.so.0/libosmo-mgcp.so.1, removed in 1.7.0-1 ('remove legacy packages'); osmo-mgw.install marks debian/osmo-mgw.cfg #obsolete: debian/osmo-mgw.cfg etc/osmocom/.
• Problem: Dead files that no packaging step uses; they only confuse future maintainers and are never processed.
• Fix: Delete debian/libosmo-mgcp1.install, debian/libosmo-mgcp1.symbols, debian/libosmo-mgcp-dev.install, debian/.symbols and debian/osmo-mgw.cfg.

5. [minor] [packaging] Wrong Build-Depends-Package in the client symbols file

• Files: debian/libosmo-mgcp-client16.symbols
• Evidence: Header line: * Build-Depends-Package: libosmo-mgcp-dev for libosmo-mgcp-client.so.16, whose actual -dev package is libosmo-mgcp-client-dev.
• Problem: The symbols' build-dependency metadata points at a non-existent package (there is no libosmo-mgcp-dev), so the association used by symbol tooling for reverse-dependency builds is wrong.
• Fix: Change the field to Build-Depends-Package: libosmo-mgcp-client-dev.

Thanks!