pipewire 1.6.11-1
Package Information
| Description | libraries for the PipeWire multimedia server PipeWire is a server and user space API to deal with multimedia pipelines. This includes: - Making available sources of audio and video (such as from a capture devices or application provided streams) and multiplexing this with clients. - Accessing sources of audio and video for consumption. - Generating graphs for audio and video processing. |
|---|---|
| Maintainer | Utopia Maintenance Team <pkg-utopia-maintainers@alioth-lists.debian.net> |
| Changed By | Dylan Aïssi <daissi@debian.org> |
| Sponsor | daissi@debian.org |
| Distribution | unstable |
| Architecture | any all |
| VCS | git: https://salsa.debian.org/utopia-team/pipewire.git (browse) |
| Closes | #1130264 |
| Popcon Installs | 138748 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/pipewire |
| Uploaded | 6 hours ago |
New Package Report
.changes
| Date | Mon, 09 Nov 2026 17:44:30 +0100 |
|---|---|
| Source | pipewire |
| Version | 1.6.11-1 |
| Changed-By | Dylan Aïssi <daissi@debian.org> |
| Architecture | source amd64 all |
| Distribution | unstable |
Changelog
pipewire (1.6.11-1) unstable; urgency=medium
.
* New upstream release
* Move some modules into optional packages (Closes: #1130264)
- libpipewire-0.3-modules-extra:
* libpipewire-module-ffado-driver
- libspa-0.2-modules-extra:
* libspa-filter-graph-plugin-ebur128
* libspa-filter-graph-plugin-onnx
* libspa-filter-graph-plugin-lv2
* libspa-filter-graph-plugin-sofa
* Disable onnxruntime on i386.dsc
| Section | libs |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | gstreamer1.0-pipewire deb libs optional arch=any libpipewire-0.3-0t64 deb libs optional arch=any libpipewire-0.3-common deb libs optional arch=all libpipewire-0.3-dev deb libdevel optional arch=any libpipewire-0.3-modules deb libs optional arch=any libpipewire-0.3-modules-extra deb libs optional arch=any libpipewire-0.3-modules-x11 deb libs optional arch=any libspa-0.2-bluetooth deb libs optional arch=any libspa-0.2-dev deb libdevel optional arch=any libspa-0.2-jack deb libs optional arch=any libspa-0.2-libcamera deb video optional arch=alpha,amd64,arm64,armel,armhf,hppa,i386,ia64,mips64el,mipsel,powerpc,ppc64,ppc64el,riscv64,s390x,sh4,sparc64,x32 libspa-0.2-modules deb libs optional arch=any libspa-0.2-modules-extra deb libs optional arch=any pipewire deb video optional arch=any pipewire-alsa deb sound optional arch=any pipewire-audio deb sound optional arch=all pipewire-audio-client-libraries deb oldlibs optional arch=all pipewire-bin deb video optional arch=any pipewire-doc deb doc optional arch=all profile=!nodoc profile:v1=!nodoc pipewire-jack deb sound optional arch=any pipewire-libcamera deb oldlibs optional arch=all pipewire-pulse deb sound optional arch=any pipewire-system-services deb libs optional arch=all pipewire-tests deb misc optional arch=any profile=!noinsttest profile:v1=!noinsttest pipewire-v4l2 deb video optional arch=any |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: pipewire
Source: https://gitlab.freedesktop.org/pipewire/pipewire
License: Expat and LGPL-2.1+
Files: *
Copyright: 2009 Lennart Poettering
2010 David Henningsson
2013 Inigo Quilez
2015-2022 Wim Taymans
2016-2021 Axis Communications
2018-2022 Collabora Ltd.
2020 Konsulko Group
2020 Sergey Bugaev
2020 Georges Basile Stavracas Neto
2021 jothepro
2019-2021 Red Hat, Inc.
2021 Arun Raghavan
2013 The Chromium OS Authors.
2010 Google Inc.
2017 HiFi-LoFi
2000-2002 Richard W.E. Furse, Paul Barton-Davis
2021 Sanchayan Maity
2021 Pauli Virtanen
2021 Florian Hülsmann
License: Expat
Files: include/valgrind/*
Copyright: 2000-2017 Julian Seward.
License: BZIP2
Files: pipewire-jack/jack/*
Copyright: 2000-2013 Paul Davis
2003-2004 Jack OQuin
2002 Kai Vehmanen
2011-2014 David Robillard
2004 Ian Esten
2004-2012 Grame
2003 Rohan Drape
2010 Torben Hohn
2004 Rui Nuno Capela, Lee Revell
License: LGPL-2.1+
Files: pipewire-jack/jack/control.h
Copyright: 2008 Nedko Arnaudov
2008 GRAME
License: GPL-2
Files: spa/plugins/alsa/90-pipewire-alsa.rules
spa/plugins/alsa/acp/*
spa/plugins/alsa/mixer/paths/*
spa/plugins/alsa/mixer/profile-sets/*
spa/plugins/alsa/mixer/samples/*
Copyright: 1999 Tom Tromey
2000 Red Hat, Inc.
2004-2009 Lennart Poettering
2006 Pierre Ossman
2006 Pierre Ossman for Cendio AB
2011 Intel Corporation
2011 Collabora Multimedia
2011 Arun Raghavan
2011 Wolfson Microelectronics PLC
2012 Feng Wei, Freescale Ltd.
2015-2022 Wim Taymans
License: LGPL-2.1+
Files: spa/plugins/alsa/acp/acp.c
spa/plugins/alsa/acp/acp.h
spa/plugins/alsa/acp/array.h
spa/plugins/alsa/acp/dynarray.h
spa/plugins/alsa/acp/hashmap.h
spa/plugins/alsa/acp/idxset.h
spa/plugins/alsa/acp/proplist.h
Copyright: 2018-2020 Wim Taymans
License: Expat
Files: spa/plugins/bluez5/*
Copyright: 2004-2010 Marcel Holtmann
2006-2010 Nokia Corporation
2016-2017 Arkadiusz Bokowy
2018-2022 Wim Taymans
2018-2022 Collabora Ltd.
2018 Pali Rohár
2021-2022 Pauli Virtanen
2013 Julien Pommier
License: Expat
Files: spa/plugins/bluez5/a2dp-codec-caps.h
spa/plugins/bluez5/rtp.h
Copyright: 2006-2010 Nokia Corporation
2004-2010 Marcel Holtmann <marcel@holtmann.org>
2018 Pali Rohár <pali.rohar@gmail.com>
License: LGPL-2.1+
Files: spa/plugins/filter-graph/ladspa.h
Copyright: 2000-2002 Richard W.E. Furse, Paul Barton-Davis
License: LGPL-2.1+
Files: spa/plugins/filter-graph/pffft.*
Copyright: 2013 Julien Pommier
2004 The University Corporation for Atmospheric Research
License: FFTPACK
Files: src/modules/module-portal.c
Copyright: 2016 Wim Taymans
2019 Red Hat Inc.
License: Expat
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
License: LGPL-2.1+
This package is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
.
This package is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
.
On Debian systems, the complete text of the GNU Lesser General
Public License can be found in "/usr/share/common-licenses/LGPL-2.1".
License: FFTPACK
Redistribution and use of the Software in source and binary forms,
with or without modification, is permitted provided that the
following conditions are met:
.
- Neither the names of NCAR's Computational and Information Systems
Laboratory, the University Corporation for Atmospheric Research,
nor the names of its sponsors or contributors may be used to
endorse or promote products derived from this Software without
specific prior written permission.
.
- Redistributions of source code must retain the above copyright
notices, this list of conditions, and the disclaimer below.
.
- Redistributions in binary form must reproduce the above copyright
notice, this list of conditions, and the disclaimer below in the
documentation and/or other materials provided with the
distribution.
.
THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE CONTRIBUTORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES OR OTHER LIABILITY, WHETHER IN AN
ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE
SOFTWARE.
License: BZIP2
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
.
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
.
2. The origin of this software must not be misrepresented; you must
not claim that you wrote the original software. If you use this
software in a product, an acknowledgment in the product
documentation would be appreciated but is not required.
.
3. Altered source versions must be plainly marked as such, and must
not be misrepresented as being the original software.
.
4. The name of the author may not be used to endorse or promote
products derived from this software without specific prior written
permission.
.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: GPL-2
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; version 2 of the License.
.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
On Debian systems you can find the full text of the GNU General Public
License version 2 at /usr/share/common-licenses/GPL-2.
DFSG Assistant LLM REVIEW 3 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 4 hours ago.
Report
DFSG NEW review for pipewire version 1.6.11-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 3 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 3 found
Licensing
Every licence I found in the tree is free and DFSG-compliant: the bulk is MIT/Expat, with LGPL-2.1+ (PulseAudio-derived alsa/acp and mixer data, JACK headers), GPL-2 (pipewire-jack/jack/control.h), BSD-style (Chromium/WebKit biquad and crossover), public domain (SpanDSP g722), FFTPACK/NCAR, BZIP2 (valgrind headers) and Takuya Ooura's permission notice; no non-commercial, no-modification or field-of-use terms anywhere. debian/copyright is nevertheless materially inaccurate: it names only holders up to 2022, so the 2023-2026 contributions of Kebag-Logic, Canonical Ltd., Asymptotic Inc., Carlos Rafael Giani, the wlroots contributors, Nicolas Seriot and others are unrecorded; and it declares several third-party files as Expat when their own notices say otherwise (Chromium/WebKit's BSD-licensed biquad/crossover, SpanDSP's public-domain G722 code, Ooura's dbesi0.c), whose required notices and conditions are therefore missing from the source package.
Packaging
The packaging is of good quality and I found nothing a sponsor would need fixed. It uses debhelper compat 13 with a plain dh $@ sequence, hardening=+all, a DEP-3 CVE patch that is still needed, arch restrictions that agree with the Build-Depends and the rules options, correct module split with the new libpipewire-0.3-modules-extra/libspa-0.2-modules-extra packages and their Breaks/Replaces, a sysusers user that matches the @pipewire group of the limits.d file, and three autopkgtests.
Issues
blocker licensing 1. Files: * omits the copyright holders of the code added in 2023-2026 (Kebag-Logic, Canonical Ltd., Asymptotic Inc., Carlos Rafael Giani, Nicolas Seriot, ...) ◂
-
Files:
debian/copyright:6-26 (Files: * stanza),src/modules/module-avb/aecp-aem-cmds-resps/cmd-available.c:2-3,src/modules/module-protocol-pulse/snap-policy.c:2,spa/include/spa/param/audio/compressed.h:3,spa/plugins/alsa/alsa-compress-offload-device.c:2,spa/plugins/vulkan/pixel-formats.c:2,spa/plugins/vulkan/dmabuf.h:1,src/modules/module-rtp/ptp.h:2,spa/plugins/audioconvert/fmt-ops-rvv.c:2,spa/plugins/control/test-mixer-ump-sort.c:2,test/data/test-spa-json.txt:1-6 -
Basis: checked, in the package or with a reference tool
-
Evidence:
src/modules/module-avb/aecp-aem-cmds-resps/cmd-available.c:2 /* SPDX-FileCopyrightText: Copyright © 2025 Kebag-Logic */ src/modules/module-protocol-pulse/snap-policy.c:2 /* SPDX-FileCopyrightText: Copyright © 2022 Canonical Ltd. */ spa/include/spa/param/audio/compressed.h:3 /* SPDX-FileCopyrightText: Copyright © 2022 Asymptotic Inc. */ spa/plugins/alsa/alsa-compress-offload-device.c:2 /* SPDX-FileCopyrightText: Copyright @ 2023 Carlos Rafael Giani */ spa/plugins/vulkan/dmabuf.h:1 // Copyright (c) 2023 The wlroots contributors spa/plugins/vulkan/pixel-formats.c:2 /* SPDX-FileCopyrightText: Copyright © 2023 columbarius */ src/modules/module-rtp/ptp.h:2 /* SPDX-FileCopyrightText: Copyright © 2024 Dmitry Sharshakov */ spa/plugins/audioconvert/fmt-ops-rvv.c:2 /* SPDX-FileCopyrightText: Copyright (c) 2023 Institue of Software Chinese Academy of Sciences (ISCAS). */ test/data/test-spa-json.txt:5 Copyright (c) 2016 Nicolas SeriotThe
Files: *Copyright list runs from2009 Lennart Poetteringto2021 Florian Hülsmann; none of the entities above appears in any stanza, and their files are matched only byFiles: *. The same goes for the translator copyrights inpo/*.po(e.g.po/bg.po:2Copyright (C) 2023 Alexander Shopov,po/hr.po:2Copyright (c) 2010 Rosetta Contributors and Canonical Ltd 2010), all of which say 'distributed under the same license as the pipewire package' (MIT). -
Problem:
Files: *is the only stanza covering these files, sodebian/copyrightasserts a copyright statement for them that does not name their holders. Policy 12.5 requires the copyright and distribution licence of each file to be recorded, and the missing entities include the companies and authors of whole new subsystems (module-avb AECP commands, parametric equalizer, snap policy, vulkan helpers, compressed-audio params). -
Fix: Add these holders to the
Files: *Copyright list, or add a stanza for the affected groups, e.g.2022 Asymptotic Inc.,2022 Canonical Ltd.,2023-2025 Carlos Rafael Giani,2022-2024 columbarius,2024 Dmitry Sharshakov,2023 The wlroots contributors,2023 ISCAS,2025-2026 Kebag-Logic,2025-2026 Alexandre/Alex Malki <alexandre.malki@kebag-logic.com>,2025 Simon Gapp <simon.gapp@kebag-logic.com>,2016 Nicolas Seriot, and thepo/*.potranslators (or aFiles: po/*stanza naming them).spa/plugins/control/test-mixer-ump-sort.cattributes copyright toClaude Code, which is not a legal entity; the holder needs clarifying with upstream.
blocker licensing 2. Chromium/WebKit biquad and crossover files are BSD-licensed, but Files: * declares them Expat and their BSD terms are nowhere in the package ◂
-
Files:
spa/plugins/audioconvert/biquad.c:1-8,spa/plugins/audioconvert/biquad.h:1-3,spa/plugins/audioconvert/crossover.c:1-3,spa/plugins/audioconvert/crossover.h:1-3,spa/plugins/filter-graph/biquad.h:1-3,debian/copyright:6-26 -
Basis: checked, in the package or with a reference tool
-
Evidence:
spa/plugins/audioconvert/biquad.c:1 /* Copyright (c) 2013 The Chromium OS Authors. All rights reserved. spa/plugins/audioconvert/biquad.c:2 * Use of this source code is governed by a BSD-style license that can be spa/plugins/audioconvert/biquad.c:3 * found in the LICENSE file. spa/plugins/audioconvert/biquad.c:6 /* Copyright (C) 2010 Google Inc. All rights reserved. spa/plugins/audioconvert/biquad.c:7 * Use of this source code is governed by a BSD-style license that can be spa/plugins/audioconvert/biquad.c:8 * found in the LICENSE.WEBKIT file.Files: *gives themLicense: Expat. The package contains onlyLICENSEandCOPYING, both of which hold the MIT/Expat text; there is noLICENSE.WEBKITand no BSD text indebian/copyright. -
Problem:
biquad.c/biquad.h/crossover.c/crossover.handspa/plugins/filter-graph/biquad.hare used (biquad.c is built into libspa-audioconvert and the filter-graph plugins), yetdebian/copyrightcalls them Expat. Their own notices say the licence is BSD-style and lives in files that are not shipped, so neither the copyright file nor the source package reproduces the conditions those files require; Policy 12.5 requires the licence text for licences not in /usr/share/common-licenses to be indebian/copyright. -
Fix: Add a
Files:stanza for those five paths, keep the holders (2013 The Chromium OS Authors.,2010 Google Inc.) and give the actual BSD licences (BSD-2-Clause from WebKit's LICENSE.WEBKIT for the Google code, BSD-3-Clause from Chromium's LICENSE for the Chromium OS code) as stand-alone License paragraphs, with their full clause text; the header summary atdebian/copyright:4must name them too.
blocker licensing 3. spa/plugins/bluez5/g722/* is public domain and spa/plugins/audioconvert/dbesi0.c carries Takuya Ooura's permission notice, but both are declared Expat ◂
-
Files:
spa/plugins/bluez5/g722/g722_encode.c:1-24,spa/plugins/bluez5/g722/g722_enc_dec.h:1-21,spa/plugins/audioconvert/dbesi0.c:1-6,debian/copyright:77-86 (Files: spa/plugins/bluez5/*),debian/copyright:6-26 (Files: *) -
Basis: checked, in the package or with a reference tool
-
Evidence:
g722_encode.c:10-15 All rights reserved. * Despite my general liking of the GPL, I place my own contributions * to this code in the public domain ... ***** Copyright (c) CMU 1993 ***** g722_enc_dec.h:12 Written by Steve Underwood <steveu@coppice.org> g722_enc_dec.h:14 Copyright (C) 2005 Steve Underwood dbesi0.c:1 /* Copyright(C) 1996 Takuya OOURA dbesi0.c:3-4 You may use, copy, modify this code for any purpose and without fee.Both paths are covered only by
Files: spa/plugins/bluez5/*/Files: *, each of which saysLicense: Expat. -
Problem: The SpanDSP G722 codec files are a public-domain dedication (with a CMU 1993 copyright line) and
dbesi0.cis under Ooura's non-Expat permission notice;debian/copyrightcalls both Expat, and neither notice (nor Steve Underwood, the CMU copyright or Takuya Ooura as holder) appears in it. The files are compiled into libspa-bluetooth and libspa-audioconvert, so the packages ship code the copyright file misdescribes and whose notice it does not reproduce. -
Fix: Add stanzas for
spa/plugins/bluez5/g722/*(Copyright: 2005 Steve Underwood; 1993 CMU,License: public-domain) andspa/plugins/audioconvert/dbesi0.c(Copyright: 1996 Takuya Ooura, with the 'You may use, copy, modify this code for any purpose and without fee' notice as its License text); removedbesi0.c/g722/*from the Expat stanzas' reach or let the later stanzas override them, and name them in the header summary atdebian/copyright:4.
Verified ◂
- Read every file under
debian/in full (control, rules, changelog head, copyright, all.install/.links/.manpages/.docs/.lintian-overrides, the symbols file, both shlibs.local,.maintscript, sysusers, doc-base, README.Debian, gbp.conf, source/format, upstream/metadata, tests/*, patches/series and the patch); compat level is 13 and the patch is applied. pipewire-bin.installuses${env:UDEVRULESDIR}without a#!line because debhelper itself expands${env:VAR},${DEB_HOST_*}and the built-in escapes in non-executable config files from compat 13 (Dh_Lib::filedoublearray->_variable_substitution,/usr/share/perl5/Debian/Debhelper/Dh_Lib.pm:1765,1898);libspa-0.2-modules-extra.installdoes use dh-exec for its[!i386], which matches-Donnxruntime=disabledon i386 inrules.dh_installsysusersis pulled in bydh-sequence-installsysusers(provided by debhelper 14.5) and addssystemd | systemd-standalone-sysusers | systemd-sysusersto${misc:Depends}itself (/usr/bin/dh_installsysusers:104), so no explicit dependency is needed;pipewire.sysusers'u pipewirematches the@pipewiregroup thatsrc/modules/module-rt/25-pw-rlimits.conf.ingets from meson's defaultrlimits-match.override_dh_installsystemdlimited to-ppipewire-system-servicesdoes not skip the user units inpipewire/pipewire-pulse: dh_installsystemd only scans/usr/lib/systemd/system(/usr/bin/dh_installsystemd:259), and those packages ship units in/usr/lib/systemd/user.- Build-Depends spot-checked in the archive:
libcamera-dev0.7.2 (satisfies>= 0.6.0),libroc-dev0.4.0 (satisfies>= 0.4.0),libonnxruntime-dev1.27.1,wireplumber-system-services0.5.18;dh-sequence-installsysuserscomes from debhelper 14.5. - Standards-Version 4.7.4 against Policy 4.7.4.1: the first two components match, so it is current.
debian/patches/0001-CVE-2026-14330.patchhas DEP-3 headers (From,Date,Subject,Origin,Bug-Debian,Signed-off-by) and is still needed:spa/include/spa/utils/defs.hinpipewire_1.6.11.orig.tar.gzhas nospa_alloca.spa/plugins/vulkan/shaders/filter.spvandmain.spvare precompiled GLSL compute shaders; their sources arefilter.comp(includingfilter-color.comp) andmain.comp(includingdisk-intersection.comp, MIT, Inigo Quilez) in the same directory.rulespasses-Dvulkan=disabled, and meson installs nothing from that directory, so neither the shaders nor the plugin reach a binary package.test/data/test-spa-json.txtis theJSONTestSuitecorpus (its first lines carry the MIT licence,Copyright (c) 2016 Nicolas Seriot); the non-UTF-8 content the scan noticed is the deliberately invalid encoding of individual JSON test cases. Test data, not code.- Licence sweep of the whole tree found no non-free terms (searches for
Good, not Evil, non-commercial, NoDerivatives, 'not be used for commercial' and 'All rights reserved' outside the BSD/valgrind notices returned nothing); the licences present are MIT, LGPL-2.1+, GPL-2 (onlypipewire-jack/jack/control.h), BSD-style (Chromium/WebKit), public domain (g722), FFTPACK/NCAR, BZIP2 (valgrind headers) and Ooura's notice, all DFSG-free. spa/plugins/alsa/acp/*andspa/plugins/bluez5/*were checked file by file against their stanzas: the PulseAudio-derived files are LGPL-2.1+, the listed Wim Taymans rewrites (acp.c/acp.h/array.h/dynarray.h/hashmap.h/idxset.h/proplist.h) are MIT, and onlya2dp-codec-caps.handrtp.hin bluez5 are LGPL-2.1+, as the copyright file says.po/*.poheaders state 'distributed under the same license as the pipewire package', i.e. MIT; their translator copyright lines are part of the holder omission reported above.- uscan found the packaged version as the newest upstream release (upstream
1.6.11, packaged1.6.11). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (GPL-2,LGPL-2.1).
Not confirmed ◂
- The exact BSD variant of
spa/plugins/audioconvert/biquad.*,crossover.*andspa/plugins/filter-graph/biquad.h: the notices point to Chromium'sLICENSEand WebKit'sLICENSE.WEBKIT, neither of which is in the tarball (the only licence files are the MITLICENSEandCOPYING), so I could not read the clause text to say BSD-2-Clause or BSD-3-Clause with certainty. - Whether the CMU 1993 portion of
spa/plugins/bluez5/g722/*has a separate licence: the files carry only Steve Underwood's public-domain dedication plus the CMU copyright line, with no CMU terms.
Proposed changes ◂
None.
Uploader's response to the LLM review
Waiting for the uploader's response until , because the review found serious issues.