phosh-session-services 0.3.0-1

Package Information

Description	Services for Phosh's user session Additional, non-essential, but recommended services for Phosh's user session. It contains * phosh-syncbus: A DBus interface to syncthing * phosh-os-updater: OS Update Notifier * phosh-push-distributor: A UnifiedPush distributor
Maintainer	DebianOnMobile Maintainers <debian-on-mobile-maintainers@alioth-lists.debian.net>
Changed By	Guido Günther <agx@sigxcpu.org>
Sponsor	guido@xcpu.ch
Distribution	unstable
Architecture	linux-any
VCS	git: https://salsa.debian.org/DebianOnMobile-team/phosh-session-services.git (browse)
Closes	#1148928
Tracker	https://tracker.debian.org/pkg/phosh-session-services
Uploaded	3 hours ago

New Package Report

.changes◂

Architecture	source amd64
Distribution	unstable
Date	Sat, 07 Nov 2026 16:17:13 +0100
Source	phosh-session-services
Version	0.3.0-1
Changed-By	Guido Günther <agx@sigxcpu.org>

Changelog◂

phosh-session-services (0.3.0-1) unstable; urgency=medium
 .
   * Initial upload to Debian (Closes: #1148928)

.dsc◂

Priority	optional
Component	main
Package-List	phosh-session-services deb gnome optional arch=linux-any
Section	gnome

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: phosh-session-services
Source: https://gitlab.gnome.org/World/Phosh/phosh-session-services

Files:
 *
Copyright:
 2026 Phosh.mobi e.V.
License: GPL-3.0-or-later
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU General Public License
 version 3 can be found in "/usr/share/common-licenses/GPL-3".

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for phosh-session-services version 0.3.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 1 important, 3 minor
debian/watch: absent
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree is free software throughout: every source file is GPL-3.0-or-later, there is no non-free or field-of-use wording, no vendored third-party code (the Rust crates come from Debian's registry), and no generated file without its input. debian/copyright is DEP-5 with the right licence short name and a correct pointer to /usr/share/common-licenses/GPL-3. It is, however, inaccurate: the .gitlab-ci/ helper scripts are copyright The Phosh developers and are not named, and the single Files: * stanza attributes the Debian packaging and the three maintainer patches - which carry From: Guido Günther - to Phosh.mobi e.V. A third-party-derived CI script is also undocumented.

Packaging

The packaging is clean and conventional: 3.0 (quilt), debhelper compat 13 via debhelper-compat (= 13), Rules-Requires-Root: no, Standards-Version 4.7.4 (current), Vcs-*/Homepage present, a changelog that closes the ITP, and an install file that matches exactly what meson installs (libexec binaries, dbus-1 services and interfaces, systemd user units, desktop file, icon, translations). The meson+cargo build via Debian's /usr/share/cargo/bin/cargo uses the documented prepare-debian --link-from-system pattern, and every direct crate in the four Cargo.toml files has a matching librust-*-dev Build-Depends whose archive version satisfies the requirement. No maintainer scripts are needed. Only a minor patch-header gap remains.

Issues

blocker licensing 1. Files: * names only Phosh.mobi e.V. and omits the holder The Phosh developers of the .gitlab-ci scripts ◂

Files: debian/copyright:6-9, .gitlab-ci/check-consistency:3, .gitlab-ci/check-meson:3, .gitlab-ci/check-po:3, .gitlab-ci/g-style.py:3
Basis: checked, in the package or with a reference tool
Evidence: # Copyright (C) 2024 The Phosh developers (check-consistency, check-po), # Copyright (C) 2025 The Phosh developers (check-meson), # Copyright (C) 2026 The Phosh developers (g-style.py), each followed by # SPDX-License-Identifier: GPL-3.0-or-later - while debian/copyright has one stanza, Files: * / Copyright: 2026 Phosh.mobi e.V.
Problem: Four files in the source carry a copyright notice of a holder that debian/copyright does not name. The licence is right (GPL-3.0-or-later), but the copyright statement is incomplete, so debian/copyright does not accurately describe every file (Policy 12.5, machine-readable copyright).
Fix: Add a stanza before or after Files: *, e.g. Files: .gitlab-ci/* with Copyright: 2024-2026 The Phosh developers and the existing GPL-3.0-or-later licence paragraph.

important licensing 2. The Debian packaging and the three maintainer patches are attributed to Phosh.mobi e.V. by the catch-all stanza instead of to Guido Günther ◂

Files: debian/copyright:6-9, debian/patches/build-Add-rust-triplet-to-path.patch:2, debian/patches/cargo-Drop-demo.patch:2, debian/patches/cargo-Pin-dependencies-to-versions-in-available-in-Debian.patch:2, debian/rules, debian/control
Basis: checked, in the package or with a reference tool
Evidence: All three patches start From: =?utf-8?q?Guido_G=C3=BCnther?= <agx@sigxcpu.org>, and debian/rules, debian/control, debian/changelog are his work; debian/copyright has no Files: debian/* stanza, so Files: * / Copyright: 2026 Phosh.mobi e.V. applies to them.
Problem: The catch-all makes debian/copyright state a copyright holder for the Debian packaging that is not its author. Every group of files with a different holder needs its own stanza (machine-readable copyright format, section 5.2).
Fix: Add a stanza at the end of debian/copyright: Files: debian/* / Copyright: 2026 Guido Günther <agx@sigxcpu.org> / License: GPL-3.0-or-later (or whichever licence the packaging is meant to carry).

minor licensing 3. .gitlab-ci/check-style.py is derived from Carlos Garnacho's script but has no licence statement and is not documented in debian/copyright ◂

Files: .gitlab-ci/check-style.py:1-4, debian/copyright:6-9
Basis: checked, in the package or with a reference tool
Evidence: Header is only #!/bin/env python3 / # Based on check-style.py by / # Carlos Garnacho <carlosg@gnome.org>, with no SPDX-License-Identifier or other licence text (contrast .gitlab-ci/g-style.py, which has both).
Problem: A file that is explicitly derived from someone else's work has no licence notice of its own, and debian/copyright - which names only Phosh.mobi e.V. under Files: * - gives no account of that upstream author or the terms his original was under. It is a CI helper and not installed, so this is not a DFSG problem, but the provenance should be recorded.
Fix: Ask upstream to add an SPDX header to check-style.py (or state that it is GPL-3.0-or-later like the rest), and document the derived file, its author and its licence in debian/copyright.

minor packaging 4. build-Add-rust-triplet-to-path.patch has no Forwarded: field, unlike the other two patches ◂

Files: debian/patches/build-Add-rust-triplet-to-path.patch:1-4, debian/patches/series
Basis: checked, in the package or with a reference tool
Evidence: The patch header has From:, Date:, Subject: build: Add rust triplet to path and a one-line body, but no Forwarded: line; cargo-Drop-demo.patch and cargo-Pin-dependencies-to-versions-in-available-in-Debian.patch both carry Forwarded: not-needed.
Problem: DEP-3 asks patches to record whether they went upstream; the trilogy of Debian-only patches is inconsistent, leaving the reader unable to tell whether this one was submitted.
Fix: Add Forwarded: not-needed (or Forwarded: <URL>) to the patch header.

minor packaging 5. There is no debian/watch ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Problem: Without a watch file new upstream releases are not noticed by uscan, the tracker or the maintainer's tools.
Fix: Add a debian/watch in version 5 format, or, if upstream has no usable release channel, one holding a comment that says so.

Verified ◂

Read all of debian/ in full: copyright, control, rules, changelog, install, gbp.conf, salsa-ci.yml, source/format, patches/series and all three patches, plus the .dsc.
Inventory: 80 files outside debian/ and .pc/; no LICENSE/COPYING/NOTICE file other than the top-level GPL-3 LICENSE, no subprojects/ or vendored c-code, no built binaries, minified files or PDFs other than the assets named below.
All Rust sources under phosh-session-services/, phosh-os-updater/, phosh-push-distributor/ carry SPDX-FileCopyrightText: 2026 Phosh.mobi e.V. and SPDX-License-Identifier: GPL-3.0-or-later; the .gitlab-ci scripts carry GPL-3.0-or-later by The Phosh developers (reported).
phosh-syncbus/src/.rs, demo/src/.rs, demo/build.rs, data/.in, data/interfaces/.xml, demo/src/resources/{ui,icons}, po/* and the top-level config files carry no per-file notice; nothing contradicts the project-wide GPL-3.0-or-later grant in LICENSE, so Files: * is right for them other than the holder question above.
po/de.po's # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER is the untranslated gettext template header, not a copyright claim.
phosh-os-updater/src/config.rs is generated from the shipped config.rs.in, and demo resources from the shipped resources.gresource.xml/.ui/icons - no generated file without its input.
Grep of the whole tree for Copyright/(C)/©/SPDX/Licensed under/Permission is hereby granted/All rights reserved found no other holders and no non-free wording (no NC/ND, no field-of-use, no 'no modification' clause).
Assets recorded by name, not opened: data/screenshots/demo-1.png (screenshot of the demo described in README.md), data/icons/mobi.phosh.OsUpdater-symbolic.svg, demo/src/resources/icons/{external-link,play,stop}-symbolic.svg - project artwork under the same GPL-3.0-or-later.
Build-Depends cover every direct crate in the four Cargo.toml files; apt-cache shows satisfying versions in the archive: rand 0.10.3, oo7 0.6.0, quick-xml 0.38.4, clap 4.6.7, toml 1.1.6, gettext-rs 0.7.7, zbus 5.19.0, reqwest 0.13.5.
debian/rules uses the documented /usr/share/cargo/bin/cargo prepare-debian ... --link-from-system pattern; rm -f Cargo.lock matches the pins in the patch, and execute_after_dh_auto_clean removes debian/cargo_home and debian/cargo_registry.
No debian/tests; the only upstream test is cargo test -p phosh-os-updater, run by dh_auto_test/meson test during the build.
Standards-Version 4.7.4 is current against the reviewing system's Policy 4.7.x; Section/Architecture/Priority and the substvars in Depends are correct for compat 13.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed ◂

The demo is dropped from the Cargo workspace by cargo-Drop-demo.patch and its meson subdir is disabled by default, so demo/ never builds; its leftover meson.build still lacks the deb_triplet path component. I did not check whether anything would build it.
Could not check what gtk-update-icon-cache does to the DESTDIR at install time (gnome.post_install) or whether it leaves an icon-theme.cache in debian/tmp for dh_missing to warn about; a build would show it.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-09 23:27 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package