DFSG NEW Queue

DFSG, Licensing & New Packages Team

pipewire 1.6.11-1

Package Information

Descriptionlibraries for the PipeWire multimedia server

PipeWire is a server and user space API to deal with multimedia pipelines. This includes:

- Making available sources of audio and video (such as from a capture devices or application provided streams) and multiplexing this with clients. - Accessing sources of audio and video for consumption. - Generating graphs for audio and video processing.

MaintainerUtopia Maintenance Team <pkg-utopia-maintainers@alioth-lists.debian.net>
Changed ByDylan Aïssi <daissi@debian.org>
Sponsordaissi@debian.org
Distributionunstable
Architectureany all
VCSgit: https://salsa.debian.org/utopia-team/pipewire.git (browse)
Closes#1130264
Popcon Installs138748
Binary NEWYes (new binary packages of a source already in sid)
Trackerhttps://tracker.debian.org/pkg/pipewire
Uploaded6 hours ago

New Package Report

.changes◂
DateMon, 09 Nov 2026 17:44:30 +0100
Sourcepipewire
Version1.6.11-1
Changed-ByDylan Aïssi <daissi@debian.org>
Architecturesource amd64 all
Distributionunstable
Changelog◂
pipewire (1.6.11-1) unstable; urgency=medium
 .
   * New upstream release
   * Move some modules into optional packages (Closes: #1130264)
     - libpipewire-0.3-modules-extra:
       * libpipewire-module-ffado-driver
     - libspa-0.2-modules-extra:
       * libspa-filter-graph-plugin-ebur128
       * libspa-filter-graph-plugin-onnx
       * libspa-filter-graph-plugin-lv2
       * libspa-filter-graph-plugin-sofa
   * Disable onnxruntime on i386
.dsc◂
Sectionlibs
Priorityoptional
Componentmain
Package-Listgstreamer1.0-pipewire deb libs optional arch=any
libpipewire-0.3-0t64 deb libs optional arch=any
libpipewire-0.3-common deb libs optional arch=all
libpipewire-0.3-dev deb libdevel optional arch=any
libpipewire-0.3-modules deb libs optional arch=any
libpipewire-0.3-modules-extra deb libs optional arch=any
libpipewire-0.3-modules-x11 deb libs optional arch=any
libspa-0.2-bluetooth deb libs optional arch=any
libspa-0.2-dev deb libdevel optional arch=any
libspa-0.2-jack deb libs optional arch=any
libspa-0.2-libcamera deb video optional arch=alpha,amd64,arm64,armel,armhf,hppa,i386,ia64,mips64el,mipsel,powerpc,ppc64,ppc64el,riscv64,s390x,sh4,sparc64,x32
libspa-0.2-modules deb libs optional arch=any
libspa-0.2-modules-extra deb libs optional arch=any
pipewire deb video optional arch=any
pipewire-alsa deb sound optional arch=any
pipewire-audio deb sound optional arch=all
pipewire-audio-client-libraries deb oldlibs optional arch=all
pipewire-bin deb video optional arch=any
pipewire-doc deb doc optional arch=all profile=!nodoc profile:v1=!nodoc
pipewire-jack deb sound optional arch=any
pipewire-libcamera deb oldlibs optional arch=all
pipewire-pulse deb sound optional arch=any
pipewire-system-services deb libs optional arch=all
pipewire-tests deb misc optional arch=any profile=!noinsttest profile:v1=!noinsttest
pipewire-v4l2 deb video optional arch=any
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: pipewire
Source: https://gitlab.freedesktop.org/pipewire/pipewire
License: Expat and LGPL-2.1+

Files: *
Copyright: 2009 Lennart Poettering
           2010 David Henningsson
           2013 Inigo Quilez
           2015-2022 Wim Taymans
           2016-2021 Axis Communications
           2018-2022 Collabora Ltd.
           2020 Konsulko Group
           2020 Sergey Bugaev
           2020 Georges Basile Stavracas Neto
           2021 jothepro
           2019-2021 Red Hat, Inc.
           2021 Arun Raghavan
           2013 The Chromium OS Authors.
           2010 Google Inc.
           2017 HiFi-LoFi
           2000-2002 Richard W.E. Furse, Paul Barton-Davis
           2021 Sanchayan Maity
           2021 Pauli Virtanen
           2021 Florian Hülsmann
License: Expat

Files: include/valgrind/*
Copyright: 2000-2017 Julian Seward.
License: BZIP2

Files: pipewire-jack/jack/*
Copyright: 2000-2013 Paul Davis
           2003-2004 Jack OQuin
           2002 Kai Vehmanen
           2011-2014 David Robillard
           2004 Ian Esten
           2004-2012 Grame
           2003 Rohan Drape
           2010 Torben Hohn
           2004 Rui Nuno Capela, Lee Revell
License: LGPL-2.1+

Files: pipewire-jack/jack/control.h
Copyright: 2008 Nedko Arnaudov
           2008 GRAME
License: GPL-2

Files: spa/plugins/alsa/90-pipewire-alsa.rules
       spa/plugins/alsa/acp/*
       spa/plugins/alsa/mixer/paths/*
       spa/plugins/alsa/mixer/profile-sets/*
       spa/plugins/alsa/mixer/samples/*
Copyright: 1999 Tom Tromey
           2000 Red Hat, Inc.
           2004-2009 Lennart Poettering
           2006 Pierre Ossman
           2006 Pierre Ossman for Cendio AB
           2011 Intel Corporation
           2011 Collabora Multimedia
           2011 Arun Raghavan
           2011 Wolfson Microelectronics PLC
           2012 Feng Wei, Freescale Ltd.
           2015-2022 Wim Taymans
License: LGPL-2.1+

Files: spa/plugins/alsa/acp/acp.c
       spa/plugins/alsa/acp/acp.h
       spa/plugins/alsa/acp/array.h
       spa/plugins/alsa/acp/dynarray.h
       spa/plugins/alsa/acp/hashmap.h
       spa/plugins/alsa/acp/idxset.h
       spa/plugins/alsa/acp/proplist.h
Copyright: 2018-2020 Wim Taymans
License: Expat

Files: spa/plugins/bluez5/*
Copyright: 2004-2010 Marcel Holtmann
           2006-2010 Nokia Corporation
           2016-2017 Arkadiusz Bokowy
           2018-2022 Wim Taymans
           2018-2022 Collabora Ltd.
           2018 Pali Rohár
           2021-2022 Pauli Virtanen
           2013 Julien Pommier
License: Expat

Files: spa/plugins/bluez5/a2dp-codec-caps.h
       spa/plugins/bluez5/rtp.h
Copyright: 2006-2010 Nokia Corporation
           2004-2010 Marcel Holtmann <marcel@holtmann.org>
           2018 Pali Rohár <pali.rohar@gmail.com>
License: LGPL-2.1+

Files: spa/plugins/filter-graph/ladspa.h
Copyright: 2000-2002 Richard W.E. Furse, Paul Barton-Davis
License: LGPL-2.1+

Files: spa/plugins/filter-graph/pffft.*
Copyright: 2013 Julien Pommier
           2004 The University Corporation for Atmospheric Research
License: FFTPACK

Files: src/modules/module-portal.c
Copyright: 2016 Wim Taymans
           2019 Red Hat Inc.
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

License: LGPL-2.1+
 This package is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 2.1 of the License, or (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 Lesser General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU Lesser General
 Public License can be found in "/usr/share/common-licenses/LGPL-2.1".

License: FFTPACK
 Redistribution and use of the Software in source and binary forms,
 with or without modification, is permitted provided that the
 following conditions are met:
 .
 - Neither the names of NCAR's Computational and Information Systems
   Laboratory, the University Corporation for Atmospheric Research,
   nor the names of its sponsors or contributors may be used to
   endorse or promote products derived from this Software without
   specific prior written permission.
 .
 - Redistributions of source code must retain the above copyright
   notices, this list of conditions, and the disclaimer below.
 .
 - Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions, and the disclaimer below in the
   documentation and/or other materials provided with the
   distribution.
 .
 THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 NONINFRINGEMENT. IN NO EVENT SHALL THE CONTRIBUTORS OR COPYRIGHT
 HOLDERS BE LIABLE FOR ANY CLAIM, INDIRECT, INCIDENTAL, SPECIAL,
 EXEMPLARY, OR CONSEQUENTIAL DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE
 SOFTWARE.

License: BZIP2
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 .
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 .
 2. The origin of this software must not be misrepresented; you must
    not claim that you wrote the original software.  If you use this
    software in a product, an acknowledgment in the product
    documentation would be appreciated but is not required.
 .
 3. Altered source versions must be plainly marked as such, and must
    not be misrepresented as being the original software.
 .
 4. The name of the author may not be used to endorse or promote
    products derived from this software without specific prior written
    permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
 OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
 GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: GPL-2
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; version 2 of the License.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 On Debian systems you can find the full text of the GNU General Public
 License version 2 at /usr/share/common-licenses/GPL-2.

DFSG Assistant LLM REVIEW 3 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 4 hours ago.

Report◂

DFSG NEW review for pipewire version 1.6.11-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 3 blocker, 0 important, 0 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 3 found

Licensing

Every licence I found in the tree is free and DFSG-compliant: the bulk is MIT/Expat, with LGPL-2.1+ (PulseAudio-derived alsa/acp and mixer data, JACK headers), GPL-2 (pipewire-jack/jack/control.h), BSD-style (Chromium/WebKit biquad and crossover), public domain (SpanDSP g722), FFTPACK/NCAR, BZIP2 (valgrind headers) and Takuya Ooura's permission notice; no non-commercial, no-modification or field-of-use terms anywhere. debian/copyright is nevertheless materially inaccurate: it names only holders up to 2022, so the 2023-2026 contributions of Kebag-Logic, Canonical Ltd., Asymptotic Inc., Carlos Rafael Giani, the wlroots contributors, Nicolas Seriot and others are unrecorded; and it declares several third-party files as Expat when their own notices say otherwise (Chromium/WebKit's BSD-licensed biquad/crossover, SpanDSP's public-domain G722 code, Ooura's dbesi0.c), whose required notices and conditions are therefore missing from the source package.

Packaging

The packaging is of good quality and I found nothing a sponsor would need fixed. It uses debhelper compat 13 with a plain dh $@ sequence, hardening=+all, a DEP-3 CVE patch that is still needed, arch restrictions that agree with the Build-Depends and the rules options, correct module split with the new libpipewire-0.3-modules-extra/libspa-0.2-modules-extra packages and their Breaks/Replaces, a sysusers user that matches the @pipewire group of the limits.d file, and three autopkgtests.

Issues

blocker licensing 1. Files: * omits the copyright holders of the code added in 2023-2026 (Kebag-Logic, Canonical Ltd., Asymptotic Inc., Carlos Rafael Giani, Nicolas Seriot, ...) ◂
  • Files: debian/copyright:6-26 (Files: * stanza), src/modules/module-avb/aecp-aem-cmds-resps/cmd-available.c:2-3, src/modules/module-protocol-pulse/snap-policy.c:2, spa/include/spa/param/audio/compressed.h:3, spa/plugins/alsa/alsa-compress-offload-device.c:2, spa/plugins/vulkan/pixel-formats.c:2, spa/plugins/vulkan/dmabuf.h:1, src/modules/module-rtp/ptp.h:2, spa/plugins/audioconvert/fmt-ops-rvv.c:2, spa/plugins/control/test-mixer-ump-sort.c:2, test/data/test-spa-json.txt:1-6

  • Basis: checked, in the package or with a reference tool

  • Evidence:

    src/modules/module-avb/aecp-aem-cmds-resps/cmd-available.c:2  /* SPDX-FileCopyrightText: Copyright © 2025 Kebag-Logic */
    src/modules/module-protocol-pulse/snap-policy.c:2               /* SPDX-FileCopyrightText: Copyright © 2022 Canonical Ltd. */
    spa/include/spa/param/audio/compressed.h:3                     /* SPDX-FileCopyrightText: Copyright © 2022 Asymptotic Inc. */
    spa/plugins/alsa/alsa-compress-offload-device.c:2              /* SPDX-FileCopyrightText: Copyright @ 2023 Carlos Rafael Giani */
    spa/plugins/vulkan/dmabuf.h:1                                  // Copyright (c) 2023 The wlroots contributors
    spa/plugins/vulkan/pixel-formats.c:2                           /* SPDX-FileCopyrightText: Copyright © 2023 columbarius */
    src/modules/module-rtp/ptp.h:2                                 /* SPDX-FileCopyrightText: Copyright © 2024 Dmitry Sharshakov */
    spa/plugins/audioconvert/fmt-ops-rvv.c:2                       /* SPDX-FileCopyrightText: Copyright (c) 2023 Institue of Software Chinese Academy of Sciences (ISCAS). */
    test/data/test-spa-json.txt:5                                  Copyright (c) 2016 Nicolas Seriot
    

    The Files: * Copyright list runs from 2009 Lennart Poettering to 2021 Florian Hülsmann; none of the entities above appears in any stanza, and their files are matched only by Files: *. The same goes for the translator copyrights in po/*.po (e.g. po/bg.po:2 Copyright (C) 2023 Alexander Shopov, po/hr.po:2 Copyright (c) 2010 Rosetta Contributors and Canonical Ltd 2010), all of which say 'distributed under the same license as the pipewire package' (MIT).

  • Problem: Files: * is the only stanza covering these files, so debian/copyright asserts a copyright statement for them that does not name their holders. Policy 12.5 requires the copyright and distribution licence of each file to be recorded, and the missing entities include the companies and authors of whole new subsystems (module-avb AECP commands, parametric equalizer, snap policy, vulkan helpers, compressed-audio params).

  • Fix: Add these holders to the Files: * Copyright list, or add a stanza for the affected groups, e.g. 2022 Asymptotic Inc., 2022 Canonical Ltd., 2023-2025 Carlos Rafael Giani, 2022-2024 columbarius, 2024 Dmitry Sharshakov, 2023 The wlroots contributors, 2023 ISCAS, 2025-2026 Kebag-Logic, 2025-2026 Alexandre/Alex Malki <alexandre.malki@kebag-logic.com>, 2025 Simon Gapp <simon.gapp@kebag-logic.com>, 2016 Nicolas Seriot, and the po/*.po translators (or a Files: po/* stanza naming them). spa/plugins/control/test-mixer-ump-sort.c attributes copyright to Claude Code, which is not a legal entity; the holder needs clarifying with upstream.

blocker licensing 2. Chromium/WebKit biquad and crossover files are BSD-licensed, but Files: * declares them Expat and their BSD terms are nowhere in the package ◂
  • Files: spa/plugins/audioconvert/biquad.c:1-8, spa/plugins/audioconvert/biquad.h:1-3, spa/plugins/audioconvert/crossover.c:1-3, spa/plugins/audioconvert/crossover.h:1-3, spa/plugins/filter-graph/biquad.h:1-3, debian/copyright:6-26

  • Basis: checked, in the package or with a reference tool

  • Evidence:

    spa/plugins/audioconvert/biquad.c:1  /* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
    spa/plugins/audioconvert/biquad.c:2   * Use of this source code is governed by a BSD-style license that can be
    spa/plugins/audioconvert/biquad.c:3   * found in the LICENSE file.
    spa/plugins/audioconvert/biquad.c:6  /* Copyright (C) 2010 Google Inc. All rights reserved.
    spa/plugins/audioconvert/biquad.c:7   * Use of this source code is governed by a BSD-style license that can be
    spa/plugins/audioconvert/biquad.c:8   * found in the LICENSE.WEBKIT file.
    

    Files: * gives them License: Expat. The package contains only LICENSE and COPYING, both of which hold the MIT/Expat text; there is no LICENSE.WEBKIT and no BSD text in debian/copyright.

  • Problem: biquad.c/biquad.h/crossover.c/crossover.h and spa/plugins/filter-graph/biquad.h are used (biquad.c is built into libspa-audioconvert and the filter-graph plugins), yet debian/copyright calls them Expat. Their own notices say the licence is BSD-style and lives in files that are not shipped, so neither the copyright file nor the source package reproduces the conditions those files require; Policy 12.5 requires the licence text for licences not in /usr/share/common-licenses to be in debian/copyright.

  • Fix: Add a Files: stanza for those five paths, keep the holders (2013 The Chromium OS Authors., 2010 Google Inc.) and give the actual BSD licences (BSD-2-Clause from WebKit's LICENSE.WEBKIT for the Google code, BSD-3-Clause from Chromium's LICENSE for the Chromium OS code) as stand-alone License paragraphs, with their full clause text; the header summary at debian/copyright:4 must name them too.

blocker licensing 3. spa/plugins/bluez5/g722/* is public domain and spa/plugins/audioconvert/dbesi0.c carries Takuya Ooura's permission notice, but both are declared Expat ◂
  • Files: spa/plugins/bluez5/g722/g722_encode.c:1-24, spa/plugins/bluez5/g722/g722_enc_dec.h:1-21, spa/plugins/audioconvert/dbesi0.c:1-6, debian/copyright:77-86 (Files: spa/plugins/bluez5/*), debian/copyright:6-26 (Files: *)

  • Basis: checked, in the package or with a reference tool

  • Evidence:

    g722_encode.c:10-15  All rights reserved.
                        *  Despite my general liking of the GPL, I place my own contributions
                        *  to this code in the public domain ...
                        *****    Copyright (c) CMU    1993      *****
    g722_enc_dec.h:12   Written by Steve Underwood <steveu@coppice.org>
    g722_enc_dec.h:14   Copyright (C) 2005 Steve Underwood
    dbesi0.c:1          /*  Copyright(C) 1996 Takuya OOURA
    dbesi0.c:3-4        You may use, copy, modify this code for any purpose and
                        without fee.
    

    Both paths are covered only by Files: spa/plugins/bluez5/* / Files: *, each of which says License: Expat.

  • Problem: The SpanDSP G722 codec files are a public-domain dedication (with a CMU 1993 copyright line) and dbesi0.c is under Ooura's non-Expat permission notice; debian/copyright calls both Expat, and neither notice (nor Steve Underwood, the CMU copyright or Takuya Ooura as holder) appears in it. The files are compiled into libspa-bluetooth and libspa-audioconvert, so the packages ship code the copyright file misdescribes and whose notice it does not reproduce.

  • Fix: Add stanzas for spa/plugins/bluez5/g722/* (Copyright: 2005 Steve Underwood; 1993 CMU, License: public-domain) and spa/plugins/audioconvert/dbesi0.c (Copyright: 1996 Takuya Ooura, with the 'You may use, copy, modify this code for any purpose and without fee' notice as its License text); remove dbesi0.c/g722/* from the Expat stanzas' reach or let the later stanzas override them, and name them in the header summary at debian/copyright:4.

Verified ◂
  • Read every file under debian/ in full (control, rules, changelog head, copyright, all .install/.links/.manpages/.docs/.lintian-overrides, the symbols file, both shlibs.local, .maintscript, sysusers, doc-base, README.Debian, gbp.conf, source/format, upstream/metadata, tests/*, patches/series and the patch); compat level is 13 and the patch is applied.
  • pipewire-bin.install uses ${env:UDEVRULESDIR} without a #! line because debhelper itself expands ${env:VAR}, ${DEB_HOST_*} and the built-in escapes in non-executable config files from compat 13 (Dh_Lib::filedoublearray -> _variable_substitution, /usr/share/perl5/Debian/Debhelper/Dh_Lib.pm:1765,1898); libspa-0.2-modules-extra.install does use dh-exec for its [!i386], which matches -Donnxruntime=disabled on i386 in rules.
  • dh_installsysusers is pulled in by dh-sequence-installsysusers (provided by debhelper 14.5) and adds systemd | systemd-standalone-sysusers | systemd-sysusers to ${misc:Depends} itself (/usr/bin/dh_installsysusers:104), so no explicit dependency is needed; pipewire.sysusers' u pipewire matches the @pipewire group that src/modules/module-rt/25-pw-rlimits.conf.in gets from meson's default rlimits-match.
  • override_dh_installsystemd limited to -ppipewire-system-services does not skip the user units in pipewire/pipewire-pulse: dh_installsystemd only scans /usr/lib/systemd/system (/usr/bin/dh_installsystemd:259), and those packages ship units in /usr/lib/systemd/user.
  • Build-Depends spot-checked in the archive: libcamera-dev 0.7.2 (satisfies >= 0.6.0), libroc-dev 0.4.0 (satisfies >= 0.4.0), libonnxruntime-dev 1.27.1, wireplumber-system-services 0.5.18; dh-sequence-installsysusers comes from debhelper 14.5.
  • Standards-Version 4.7.4 against Policy 4.7.4.1: the first two components match, so it is current.
  • debian/patches/0001-CVE-2026-14330.patch has DEP-3 headers (From, Date, Subject, Origin, Bug-Debian, Signed-off-by) and is still needed: spa/include/spa/utils/defs.h in pipewire_1.6.11.orig.tar.gz has no spa_alloca.
  • spa/plugins/vulkan/shaders/filter.spv and main.spv are precompiled GLSL compute shaders; their sources are filter.comp (including filter-color.comp) and main.comp (including disk-intersection.comp, MIT, Inigo Quilez) in the same directory. rules passes -Dvulkan=disabled, and meson installs nothing from that directory, so neither the shaders nor the plugin reach a binary package.
  • test/data/test-spa-json.txt is the JSONTestSuite corpus (its first lines carry the MIT licence, Copyright (c) 2016 Nicolas Seriot); the non-UTF-8 content the scan noticed is the deliberately invalid encoding of individual JSON test cases. Test data, not code.
  • Licence sweep of the whole tree found no non-free terms (searches for Good, not Evil, non-commercial, NoDerivatives, 'not be used for commercial' and 'All rights reserved' outside the BSD/valgrind notices returned nothing); the licences present are MIT, LGPL-2.1+, GPL-2 (only pipewire-jack/jack/control.h), BSD-style (Chromium/WebKit), public domain (g722), FFTPACK/NCAR, BZIP2 (valgrind headers) and Ooura's notice, all DFSG-free.
  • spa/plugins/alsa/acp/* and spa/plugins/bluez5/* were checked file by file against their stanzas: the PulseAudio-derived files are LGPL-2.1+, the listed Wim Taymans rewrites (acp.c/acp.h/array.h/dynarray.h/hashmap.h/idxset.h/proplist.h) are MIT, and only a2dp-codec-caps.h and rtp.h in bluez5 are LGPL-2.1+, as the copyright file says.
  • po/*.po headers state 'distributed under the same license as the pipewire package', i.e. MIT; their translator copyright lines are part of the holder omission reported above.
  • uscan found the packaged version as the newest upstream release (upstream 1.6.11, packaged 1.6.11).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2, LGPL-2.1).
Not confirmed ◂
  • The exact BSD variant of spa/plugins/audioconvert/biquad.*, crossover.* and spa/plugins/filter-graph/biquad.h: the notices point to Chromium's LICENSE and WebKit's LICENSE.WEBKIT, neither of which is in the tarball (the only licence files are the MIT LICENSE and COPYING), so I could not read the clause text to say BSD-2-Clause or BSD-3-Clause with certainty.
  • Whether the CMU 1993 portion of spa/plugins/bluez5/g722/* has a separate licence: the files carry only Steve Underwood's public-domain dedication plus the CMU copyright line, with no CMU terms.
Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until , because the review found serious issues.

Back to Dashboard | View all reviews for this package