DFSG NEW review for p4est version 2.8.7-1~exp1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 1 blocker, 2 important, 4 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: 3 found

Licensing

Every licence found in the tree is free and mutually compatible, but debian/copyright is materially inaccurate. Its Files: sc/* stanza calls the whole sc subtree LGPL-2.1+, although the subtree contains BSD-2-Clause, MIT, zlib and public-domain files whose notices are not reproduced, and it claims GPL-2.0+ for a PDF article for which no licence grant exists. Several stanzas also name files that are no longer in the tree.

Packaging

The package is debhelperised cleanly (compat 13, DEP-3 patches, autopkgtest), but the add_soname patch replaces -version-info with -release 2.8. Libtool then installs only libp4est-2.8.so/libsc-2.8.so, with no libp4est.so/libsc.so link name, so two lines of debian/libp4est-dev.install match nothing and dh_install aborts the build; the .pc files' -lp4est/-lsc and the autopkgtest have no shared link name to resolve.

Issues

1. [blocker] [licensing] debian/copyright describes bundled BSD-2, MIT, zlib and public-domain files as LGPL-2.1+

• Files: debian/copyright:12-21, sc/src/sc_uint128.c:1-27, sc/src/sc_uint128.h:1-27, sc/src/sc3_mpi_types.h:1-27, sc/iniparser/inistring.c:1-25, sc/iniparser/inistring.h:1-25, sc/iniparser/iniparser.c:1-23, sc/iniparser/dictionary.c, sc/iniparser/LICENSE:1-20, sc/src/sc_puff.c:1-33, sc/src/sc_puff.h:1-23, sc/doc/attic/puff.h:1-23, sc/libb64/LICENSE:1-28, sc/libb64/README:37-41, sc/libb64/b64enc.c:9, sc/test/test_helpers.c:1-24, sc/test/test_mpi_pack.c:1-24, sc/test/test_version.c:1-24, sc/src/sc_builtin/gettimeofday.c:1
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: Files: sc/* ... License: LGPL-2.1+. But: sc_uint128.{c,h}, sc3_mpi_types.h, inistring.{c,h}, test_helpers.c, test_mpi_pack.c, test_version.c say Copyright (C) 2019/2020 individual authors followed by Redistribution and use in source and binary forms ... (BSD-2-Clause); sc/iniparser/LICENSE starts Copyright (c) 2000-2011 by Nicolas Devillard. / MIT License; sc_puff.h says Permission is granted to anyone to use this software for any purpose ... (zlib, Mark Adler); sc/libb64/README says This work is released under into the Public Domain; gettimeofday.c says /* public domain: https://stackoverflow.com/a/26085827 */.
• Problem: Several files compiled into libsc (sc_uint128.c, sc3_mpi_types.h, inistring.c, iniparser.c, dictionary.c, sc_puff.c) and their installed headers are not LGPL-2.1+ but BSD-2-Clause, MIT, zlib or public domain. Debian Policy 4.5 requires the distribution licences in debian/copyright, and copyright-format 6.7 requires the BSD-2/MIT/zlib notices to be reproduced; none of those licences or texts is present, and the holders Mark Adler and Nicolas Devillard are missing. Every licence is DFSG-free, so the tree is distributable, but the copyright file is wrong.
• Fix: Add Files stanzas for these groups with the correct holders and add stand-alone License paragraphs with the BSD-2-Clause, MIT, Zlib and public-domain texts (the latter two are not in /usr/share/common-licenses), or point to the bundled LICENSE files where that satisfies the notice requirement.

2. [important] [licensing] PDF article in the source has no licence grant and no source

• Files: doc/2002siamnews/Software_p4est_newstest2.pdf, doc/2002siamnews/README:1-13, debian/copyright:4, debian/copyright:6-11
• Basis: inferred from what was read, not seen directly
• Evidence: doc/2002siamnews/README: The file Software_p4est_newstest2.pdf contains the final author-approved version of the following article: ... journal = {SIAM News}. debian/copyright says Comment: Removed from tarball: doc/*.pdf sc/doc/*.pdf and Files: * ... License: GPL-2.0+.
• Problem: This is a published journal article in PDF form. Neither the README nor any other file states a licence for it, and its source form is absent, yet Files: * claims GPL-2.0+ for it. The removal comment's globs do not match this nested path, so the article remains in the source package. Whether the PDF is GPL-licensed cannot be established; at minimum the copyright file does not describe it accurately.
• Fix: Either drop the PDF from the source package (Files-Excluded and a repacked tarball, updating the Comment) or add a Files stanza naming its actual copyright holder and licence and, if DFSG 2 is to be met, its source.

3. [important] [packaging] -release 2.8 leaves no libp4est.so/libsc.so, so libp4est-dev.install matches nothing and dh_install aborts

• Files: debian/patches/add_soname.patch:15-18, debian/patches/add_soname.patch:33-36, debian/libp4est-dev.install:3-4, config/p4est_autotools.pc.in:13, sc/config/sc_autotools.pc.in:11, debian/tests/smoke-test:11
• Basis: checked, in the package or with a reference tool
• Evidence: Patch replaces -version-info $(SC_SOVERSION) with -release 2.8 in both Makefile.am files. Libtool's ltmain.sh: if test -z "$vinfo" && test -n "$release"; then major= ... versuffix= ..., so the only installed name is libp4est-2.8.so/libsc-2.8.so. debian/libp4est-dev.install asks for usr/lib/*/libp4est.so and usr/lib/*/libsc.so; dh_install increments its missing-file counter and ends with error("missing files, aborting").
• Problem: The dev package's two .so patterns cannot match what libtool now installs, so the build fails in dh_install. Even if it did not, the dev package would not provide the shared linker name, while the .pc files advertise -lp4est/-lsc and the autopkgtest links with -lp4est -lsc; those would resolve only to the static archives, and the libp4est-2.8.so file itself is claimed by the runtime package.
• Fix: Give the shared library a versioned soname again (restore -version-info with an appropriate current:revision:age), or keep the -release name and add an unversioned symlink in the dev package (dh_link) and install the -release .so there; make the .install and .pc files agree.

4. [minor] [licensing] Several copyright stanzas name files that are not in the tree, leaving real files mismatched

• Files: debian/copyright:22-24, debian/copyright:57-63, debian/copyright:65-88, debian/copyright:95-109, sc/doc/attic/config/sc_lint.m4:1-27
• Basis: checked, in the package or with a reference tool
• Evidence: Stanzas name sc/src/sc_obstack.c, sc/config/sc_blas.m4, sc_lapack.m4, sc_c_check_flag.m4, sc_c_version.m4 and sc_lint.m4; sc/config contains none of those names (its files are sc_include.m4, sc_qsort.m4, ...). The actual copies are under sc/doc/attic/config/.
• Problem: The stanzas never match, so those attic files fall through to Files: sc/* and are recorded as LGPL-2.1+, although sc_lint.m4 is X11 and sc_c_check_flag.m4/sc_c_version.m4 are GPL-2.0+ with the Autoconf exception. sc/src/sc_obstack.c does not exist at all.
• Fix: Point the stanzas at sc/doc/attic/config/... (or remove them if the attic is not meant to be covered) and drop the non-existent sc/src/sc_obstack.c.

5. [minor] [licensing] git2cl copyright holders are incomplete

• Files: debian/copyright:52-56, build-aux/git2cl:3-8, sc/build-aux/git2cl:3-8, sc/config/ax_split_version.m4:20-21
• Basis: checked, in the package or with a reference tool
• Evidence: build-aux/git2cl says Copyright (C) 2001,2002,2003,2004 Martyn J. Pearce and Copyright (C) 1999 Karl Fogel, but debian/copyright lists only 2007 Simon Josefsson. sc/config/ax_split_version.m4 also has Additional copyright (c) 2021 Carsten Burstedde, which is not listed.
• Problem: Named copyright holders in file notices are absent from debian/copyright.
• Fix: Add Martyn J. Pearce and Karl Fogel to the git2cl stanza, and the additional ax_split_version holder.

6. [minor] [packaging] do_not_declare_library_dirty.patch lacks a DEP-3 header

• Files: debian/patches/do_not_declare_library_dirty.patch:1
• Basis: checked, in the package or with a reference tool
• Evidence: The file starts directly with Index: p4est/build-aux/git-version-gen; it has no Description:, Author:, Last-Update: or Bug: field, unlike the other four patches in the series.
• Problem: The patch's purpose and origin are not recorded, which the other patches do provide and which a sponsor expects for a quilt series.
• Fix: Add a DEP-3 header describing the change and its author/date (and why the sc/build-aux copy needs no change).

7. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Read debian/copyright in full; it is machine-readable DEP-5 with the exact required Format URL. Read every file under debian/, including all five patches and the whole series.
• Inventoried the upstream tree and read every LICENSE, COPYING, AUTHORS, FREEBSD and NOTICE file (root, sc/, sc/libb64/, sc/iniparser/, sc/doc/attic/), plus licence headers in src/, test/, example/, config/, cmake/, build-aux/, doc/ and all of sc/.
• The prescan's sc/libb64/LICENSE wording (commercial or non-commercial) is a public-domain dedication that grants commercial and non-commercial use; it restricts nothing and is DFSG-free.
• The prescan's example/mesh/conndebug.p8c is a 1.2 KB p8est connectivity input file read by example/mesh/periodicity3.c and copied by the CMake build; it is demonstration data, not a build artifact, and is covered by Files: * GPL-2.0+.
• The prescan's PDF is reported above. No other PDF, .so, .a, .jar, .class, .pyc, .dll or .exe is in the tree; the only other binaries are the ten PNG images under doc/images/.
• The prescan's missing holders: Mark Adler (zlib puff) and Nicolas Devillard (MIT iniparser) are part of the blocker above; Karl Fogel and Martyn J. Pearce are the minor git2cl issue. individual authors in AUTHORS:7/README:7 and the file headers is a generic notice, not a distinct named holder, and doc/author_.txt plus sc/doc/author_.txt grant contributors' code under FreeBSD/BSD-2 or public domain while those files also carry GPL-2+/LGPL-2.1+ headers, so the Files: /sc: licence choice remains valid.
• The /usr/share/common-licenses pointers in debian/copyright are to GPL-2, GPL-3 and LGPL-2.1, all existing files.
• Standards-Version 4.7.4 against Policy 4.7.4.1 is current; compat 13 with all needed substvars; debhelper Depends on dh-autoreconf, so dh_autoreconf and autoconf/automake/libtool are available from the Build-Depends; source format 3.0 (quilt); an autopkgtest and upstream metadata are present.
• The other four patches carry DEP-3 headers and modify files present in the tree; the test-removal and soname patches are consistent with the changelog.
• uscan found the packaged version as the newest upstream release (upstream 2.8.7, packaged 2.8.7).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2, GPL-3, LGPL-2.1).

Not confirmed

• No build or autopkgtest was run. The dh_install abort is derived from debian/libp4est-dev.install, add_soname.patch and libtool's ltmain.sh on the reviewing system, not from an observed build.
• The PDF and the PNG images were not opened; their nature and licence were judged from their paths and the accompanying README. No licence statement could be found for the PDF.