php-structures-graph 1.2.0-1

Package Information

Description	${phppear:summary} ${phppear:description}
Maintainer	Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed By	David Prévot <taffit@debian.org>
Sponsor	taffit@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/php-team/pear/php-structures-graph.git (browse)
Tracker	https://tracker.debian.org/pkg/php-structures-graph
Uploaded	3 hours ago

New Package Report

.changes◂

Distribution	unstable
Date	Sat, 31 Oct 2026 21:04:41 +0100
Source	php-structures-graph
Version	1.2.0-1
Changed-By	David Prévot <taffit@debian.org>
Architecture	source all

Changelog◂

php-structures-graph (1.2.0-1) unstable; urgency=medium
 .
   * Initial release (php-pear dependency, cf. #1152703)

.dsc◂

Section	php
Priority	optional
Component	main
Package-List	php-structures-graph deb php optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Structures_Graph
Upstream-Contact: Sérgio Gonçalves Carvalho <sergiosgc@gmail.com>
Source: https://github.com/pear/Structures_Graph

Files: *
Copyright: 2003 Sérgio Gonçalves Carvalho <sergiosgc@gmail.com>
License: LGPL-3.0+
 On Debian systems, the complete text of the GNU Lesser General
 Public License can be found in "/usr/share/common-licenses/LGPL-3".

DFSG Assistant LLM REVIEW 0 blocker, 2 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for php-structures-graph version 1.2.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 0 blocker, 2 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The licensing itself is DFSG-free: the library is under the GNU LGPL (no non-free terms anywhere, no vendored third-party code, no built or unclear-provenance files), and every copyright holder in the tree is named in debian/copyright. But debian/copyright is not accurate: it states LGPL-3.0+ for all files while every PHP source file carries the LGPL-2.1-or-later notice, and it has no Files: debian/* stanza, so Files: * wrongly claims Sérgio Carvalho's 2003 copyright over the Debian packaging written in 2026.

Packaging

The packaging is close to the pkg-php-pear template and mostly sound (compat 14, quilt source format, autopkgtest, generated files documented and regenerable), but the binary's Depends resolves to php-common alone although the shipped classes unconditionally require_once 'PEAR.php', which php-pear ships. The autopkgtest also runs the test suite against the unpacked source tree rather than the installed package.

Issues

important licensing 1. debian/copyright states LGPL-3.0+ while every source file carries the LGPL-2.1-or-later notice ◂

Files: debian/copyright:8-10, Structures/Graph.php:9-11, Structures/Graph/Node.php:9-11, Structures/Graph/Manipulator/AcyclicTest.php:9-11, Structures/Graph/Manipulator/TopologicalSorter.php:9-11, tests/BasicGraphTest.php:9-11
Basis: checked, in the package or with a reference tool
Evidence: debian/copyright: License: LGPL-3.0+ with the complete text of the GNU Lesser General Public License can be found in "/usr/share/common-licenses/LGPL-3"; every PHP file header: It under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version.
Problem: The License field must record the licence the files actually carry (copyright-format 6.7, short names 7.1). The per-file notices grant LGPL-2.1 or any later version, so a recipient may use LGPL-2.1; describing the work as LGPL-3.0+ only understates the grant and does not match the notices in the files. README.md, package.xml and LICENSE say LGPL-3.0+ and upstream's 1.1.0 notes claim Change license from LGPL-2.1+ to LGPL-3.0+, but the file headers were never updated, and they are the grant a redistributor relies on.
Fix: Record the licence as LGPL-2.1+ for these files (pointing at /usr/share/common-licenses/LGPL-2.1), or state both grants and explain the discrepancy in a Comment: field of the Files: * stanza.

important packaging 2. Depends resolves to php-common only, but the classes require PEAR.php, which is shipped by php-pear ◂

Files: debian/control:14, debian/php-structures-graph.substvars-static:3, Structures/Graph.php:33, Structures/Graph/Node.php:35, Structures/Graph/Manipulator/AcyclicTest.php:35, Structures/Graph/Manipulator/TopologicalSorter.php:32
Basis: inferred from what was read, not seen directly
Evidence: debian/control: Depends: ${misc:Depends}, ${phpcomposer:Debian-require} with phpcomposer:Debian-require=php-common, php-common in debian/php-structures-graph.substvars-static; every class does require_once 'PEAR.php';.
Problem: php-common is only the common files for PHP packages (the PEAR registry/directory scaffolding); PEAR.php, 'the PEAR base class', is shipped by php-pear, which in unstable (1:1.10.18+submodules+notgz-1, apt-cache) still Provides: php-structures-graph. With Depends reduced to php-common, installing php-structures-graph alone leaves require_once 'PEAR.php' unresolvable and any use of the library fails, even though debian/tests/control correctly pulls in php-pear for the test.
Fix: Depend on php-pear: either put php-pear, php-common into the committed phppear:Debian-Depends/phpcomposer:Debian-require value (regenerating it with pkg-php-tools, and correcting the mapping used for pear/pear-core-minimal), or add php-pear to the Depends field of the binary package.

minor licensing 3. No Files: debian/* stanza: the packaging's own copyright is attributed to Sérgio Carvalho by Files: * ◂

Files: debian/copyright:6-8, debian/rules:1, debian/autoload.php.tpl:1, debian/patches/0001-The-class-name-match-should-match-the-file-name.patch:1
Basis: checked, in the package or with a reference tool
Evidence: Files: * / Copyright: 2003 Sérgio Gonçalves Carvalho <sergiosgc@gmail.com> with no later stanza covering debian/*, although debian/rules, debian/autoload.php.tpl, debian/README.source and the patch (From: David Prévot <david@tilapin.org>) are Debian work from 2026.
Problem: Under copyright-format 6.9 the last matching stanza applies, so Files: * claims that Sérgio Carvalho holds a 2003 copyright on the Debian packaging files; that is wrong, and the packaging's copyright holder and licence are nowhere recorded, so debian/copyright does not accurately describe the tree.
Fix: Add a Files: debian/* stanza with Copyright: 2026 David Prévot <taffit@debian.org> and a License: field for the packaging (the upstream licence, or Expat as is usual).

minor packaging 4. Autopkgtest runs the tests against the unpacked source tree, not the installed library ◂

Files: debian/tests/control:1, tests/helper.inc:2-6
Basis: checked, in the package or with a reference tool
Evidence: debian/tests/control: Test-Command: phpunit --bootstrap /usr/share/php/Structures/Graph/autoload.php, but tests/helper.inc has if ('@php_dir@' == '@'.'php_dir'.'@') { set_include_path(dirname(dirname(__FILE__)) ... ) } and then require_once 'Structures/Graph.php'; — the placeholder is never substituted in Debian, so the condition is true in the source tree.
Problem: autopkgtest runs with the unpacked source tree as cwd, and the tests must exercise the installed package (debian/tests/control specification, 'Control fields' / Overview). Because helper.inc prepends the tree root to include_path, the tests load Structures/Graph.php from the tree instead of /usr/share/php, so the test passes even if the binary package ships a broken or empty library.
Fix: Make the Debian test load the installed files: run phpunit against the installed autoloader only (drop or patch the include_path hack in helper.inc), or install the tests with @php_dir@ substituted as upstream's package.xml does and run those.

Verified ◂

Whole tree walked outside debian/ and .pc/: Structures/Graph.php, Structures/Graph/Node.php, Structures/Graph/Manipulator/{AcyclicTest,TopologicalSorter}.php, tests/{BasicGraphTest,AcyclicTestTest,TopologicalSorterTest}.php, tests/helper.inc, docs/tutorials/Structures_Graph/Structures_Graph.pkg, README.md, LICENSE, package.xml, composer.json, phpunit.xml.dist, .travis.yml, .gitattributes, .gitignore. All of them are free-licensed; none has non-free terms.
Files the scan listed — Structures/Graph.php, Structures/Graph/Node.php, Structures/Graph/Manipulator/AcyclicTest.php, Structures/Graph/Manipulator/TopologicalSorter.php, tests/BasicGraphTest.php — all print Copyright (c) 2003 Sérgio Gonçalves Carvalho, the holder already named in debian/copyright; the scan's S?rgio/Gon?alves are the same name in Latin-1 bytes (the file is not UTF-8, hence the source and binary national-encoding overrides), not another holder.
No missing copyright holder: package.xml and composer.json name only Sérgio Carvalho as lead; Brett Bieber appears only as PEAR 'helper' (an uploader role) and no copyright notice of his appears anywhere in the tree.
LICENSE is the complete LGPL-3 text; nothing in the tree requires a licence text that is absent from /usr/share/common-licenses and from the package (the LGPL-2.1 text, if the licence is recorded as 2.1+, is in /usr/share/common-licenses/LGPL-2.1).
No embedded third-party code, no fonts, images, sounds, archives, PDFs or compiled files; the only generated files are debian/autoload.php (phpab, from debian/autoload.php.tpl) and debian/structures_graph.reg (pear install of package.xml), both reproduced by debian/rules update and documented in debian/README.source, so nothing lacks its source.
tests/AcyclicTestTest.php and tests/TopologicalSorterTest.php carry no copyright or licence notice of their own; the package-level LGPL-3.0+ declared in README.md and package.xml covers them and no other holder is indicated, so this is not a missing licence.
Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool, table of contents): current, not an issue.
Compat 14 with php-pear <!nocheck> and phpunit <!nocheck>: dh skips override_dh_auto_test when DEB_BUILD_OPTIONS has nocheck (debhelper tool, compat 13 change), so the markers are correct and the override needs no nocheck test of its own; ${misc:Depends} is harmless at compat 14.
The ${phpcomposer:Debian-recommend}, -suggest, -replace, -conflict and -provide variables are undefined at build time; dpkg-gencontrol only warns and drops them (/usr/share/perl5/Dpkg/Substvars.pm, substvars: undefined becomes empty; /usr/bin/dpkg-gencontrol deletes empty dependency fields), so no literal substvar ends up in the control file.
debian/tests/control's Test-Command without Tests: is valid (autopkgtest specification: 'Either this field or Test-Command: must be present'), and Testsuite: autopkgtest is in the .dsc.
debian/patches/: one patch, 0001-... applying only to tests/BasicGraphTest.php; it renames the test class to match the file so PHPUnit finds it, and no patch is obsolete or a straggler.
debian/install, debian/docs, debian/clean, debian/gbp.conf, debian/upstream/metadata, debian/README.source and the update target of debian/rules read; they are consistent with the pkg-php-pear template and with each other.
uscan found the packaged version as the newest upstream release (upstream 1.2.0, packaged 1.2.0).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (LGPL-3).

Not confirmed ◂

The exact contents of the php-common binary package could not be listed with the tools available, so the Depends issue rests on php-common's description ('Common files for PHP packages') and on php-pear's description ('the PEAR base class'); if php-common did ship PEAR.php, that issue would not hold.
Whether cf. #1152703 in debian/changelog is the ITP (which an initial upload would normally close) or a php-pear bug this upload should not close could not be checked; no BTS access.
The committed generated files (debian/autoload.php, debian/structures_graph.reg, debian/php-structures-graph.substvars-static, debian/upstream/changelog) could not be regenerated and compared, because pkg-php-tools is not installed on the reviewing system; debian/upstream/changelog visibly repeats the 1.2.0 entry, which is cosmetic.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-03 20:03 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package