Review: pupnp 1:22.1.8-1
Package Information
| Description | Portable SDK for UPnP Devices, version 1.14 (development files) The Portable SDK for UPnP Devices (libupnp) provides developers with an API and open source code for building control points, devices, and bridges that are compliant with Version 1.0 of the Universal Plug and Play Device Architecture Specification - see http://www.upnp.org/ for specifications. This package contains the header files, documentation and debug versions of libraries needed for development of programs using uPnP. |
|---|---|
| Maintainer | Debian Multimedia Maintainers <debian-multimedia@lists.debian.org> |
| Changed By | Sebastian Ramacher <sramacher@debian.org> |
| Sponsor | sramacher@debian.org |
| Distribution | experimental |
| Architecture | any all |
| VCS | git: https://salsa.debian.org/multimedia-team/pupnp.git (browse) |
| Closes | #1151082 |
| Popcon Installs | 48082 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/pupnp |
| Uploaded | 21 days ago |
New Package Report
.changes
| Changed-By | Sebastian Ramacher <sramacher@debian.org> |
|---|---|
| Architecture | all amd64 source |
| Distribution | experimental |
| Date | Sat, 17 Oct 2026 18:38:31 +0200 |
| Source | pupnp |
| Version | 1:22.1.8-1 |
Changelog
pupnp (1:22.1.8-1) experimental; urgency=medium
.
* New upstream version 22.1.8
- Fixes CVE-2026-77630, CVE-2026-57488, CVE-2026-57487, CVE-2026-57486,
and CVE-2026-55862 (Closes: #1151082)
* SONAME bump:
- libupnp20 -> libupnp22
- libixml11 -> libixml22
* debian/control:
- Bump debhelper compat to 14
- Bump Standards-Version
* debian/copyright: Update copyright info for 22.1.8.dsc
| Section | libs |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | libixml22 deb libs optional arch=any libupnp-dev deb libdevel optional arch=any libupnp-doc deb doc optional arch=all libupnp22 deb libs optional arch=any |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0
Upstream-Name: pupnp
Upstream-Contact: Marcelo Roberto Jimenez <mroberto@users.sourceforge.net>
Source: https://github.com/pupnp/pupnp
Files: *
Copyright:
2000-2003 Intel Corporation - All Rights Reserved.
2005-2007 Rémi Turboult <r3mi@users.sourceforge.net>
2006 Michel Pfeiffer and others <virtual_worlds@gmx.de>
2006 Alexander Chemeris
2007-2020 Marcelo Roberto Jimenez <mroberto@users.sourceforge.net>
2011-2012 France Telecom
License: BSD-3-clause-Intel
Files: cmake/CmDaB.cmake
Copyright: 2021, Vollstrecker <werner@vollstreckernet.de>
License: GPL-3
Files: debian/*
Copyright:
2005-2007 Steve McIntyre <93sam@debian.org>
2008-2012 Nick Leverton <nick@leverton.org>
2017 James Cowgill <jcowgill@debian.org>
2023-2026 Sebastian Ramacher
License: BSD-3-clause-Intel
Files: ixml/test/testdata/xml.ascc.net/*
Copyright: 1998 Academia Sinica, http://xml.ascc.net/
License: Academia-Sinicai-XML-Now
Unless otherwise stated, permission is granted to use, copy, link to,
translate and republish in any form, including for commercial use,
providing due acknowledgement of the copyright holder and the Chinese
XML Now! website is made.
Files: upnp/src/inc/md5.h
upnp/src/uuid/md5.c
Copyright: none
License: public-domain
This code was written by Colin Plumb in 1993, no copyright is claimed.
This code is in the public domain; do with it what you wish.
Files: upnp/m4/libupnp.m4
Copyright: 2003-2008 aMule Team <admin@amule.org>
License: GPL-2+
Files: upnp/test/test_connect_high_fd.c
upnp/test/test_gena_granted_timeout.c
upnp/test/test_gena_notify_sid.c
upnp/test/test_sock_io.c
upnp/test/test_ssdp_req_port.c
Copyright: 2026 The pupnp contributors
License: BSD-2-clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
- Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Files: upnp/test/test_log.c
Copyright: 2018 Jean-Francois Dockes <jfd@recoll.org>
License: BSD-3-clause-Intel
Files:
upnp/src/inc/sysdep.h
upnp/src/inc/uuid.h
upnp/src/uuid/sysdep.c
upnp/src/uuid/uuid.c
Copyright: 1990- 1993, 1996 Open Software Foundation, Inc.
1989 Hewlett-Packard Company, Palo Alto, Ca. &
Digital Equipment Corporation, Maynard, Mass.
1998 Microsoft.
License: MIT-like
To anyone who acknowledges that this file is provided "AS IS"
without any express or implied warranty: permission to use, copy,
modify, and distribute this file for any purpose is hereby
granted without fee, provided that the above copyright notices and
this notice appears in all source code copies, and that none of
the names of Open Software Foundation, Inc., Hewlett-Packard
Company, or Digital Equipment Corporation be used in advertising
or publicity pertaining to distribution of the software without
specific, written prior permission. Neither Open Software
Foundation, Inc., Hewlett-Packard Company, Microsoft, nor Digital Equipment
Corporation makes any representations about the suitability of
this software for any purpose.
Files: upnp/src/inet_pton.c
Copyright: 1996-1999 Internet Software Consortium.
License: ISC
Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
.
THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
SOFTWARE.
License: GPL-2+
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License as
published by the Free Software Foundation; either version 2 of the
License, or (at your option) any later version.
.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
.
You should have received a copy of the GNU General Public License along
with this program. If not, see <https://www.gnu.org/licenses/>.
.
On Debian systems, the complete text of the GNU General
Public License can be found in `/usr/share/common-licenses/GPL-2'.
License: GPL-3
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License version 3 as
published by the Free Software Foundation.
.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
.
You should have received a copy of the GNU General Public License along
with this program. If not, see <https://www.gnu.org/licenses/>.
.
On Debian systems, the complete text of the GNU General
Public License can be found in `/usr/share/common-licenses/GPL-3'.
License: BSD-3-clause-Intel
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
- Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
- Neither name of Intel Corporation nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
DFSG Assistant LLM REVIEW 1 blocker, 1 important, 1 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 21 days ago.
Proposes a replacement debian/copyright:
debian/copyright Format field
Report
DFSG NEW review for pupnp version 1:22.1.8-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 1 blocker, 1 important, 1 minor
- debian/watch: version 5
- debian/copyright: machine-readable, without the current Format URL
- Scan before the review: 1 found
Licensing
The licences themselves are free and debian/copyright is an accurate DEP-5 file: the main code is BSD-3-clause-Intel, with correctly stanned exceptions for the BSD-2 test files, public-domain MD5, MIT-like UUID code, ISC inet_pton, the GPL-2+ m4 macro, the GPL-3 CMake module and the Academia Sinica test data, and every non-common licence text is reproduced. The source package nevertheless ships docs/UPnP_Programming_Guide.pdf, a prebuilt PDF whose source is not in the package, so the source is not in its preferred form for modification.
Packaging
The packaging is in good shape: compat 14 with cmake+ninja, Build-Depends/Build-Depends-Indep split correctly, hardening=+all, updated symbols files for the new SONAMEs, a working not-installed list, and an autopkgtest that builds and runs a small program against libupnp-dev. The only real defect is a stale long description in libupnp-dev.
Issues
blocker licensing 1. Prebuilt PDF documentation is shipped without its source ◂
- Files:
docs/UPnP_Programming_Guide.pdf,README.md:75 - Basis: inferred from what was read, not seen directly
- Evidence:
docs/containsUPnP_Programming_Guide.pdf(364.7 kB) and no LaTeX/Word/other source;README.md:75says the PDF "is from version 1.2 and is outdated". - Problem: The PDF is a generated document rather than its preferred form for modification, and the input it was generated from is absent from the package. Shipping it in the source package fails DFSG 2 (source code / preferred form); it is not installed by any binary package, but it is still part of the source distributed by Debian.
- Fix: Remove the PDF (exclude it with
Files-Excludedand repack the upstream tarball), or ship the source it was generated from.
important licensing 2. debian/copyright does not declare the current copyright-format 1.0 URL ◂
- Files:
debian/copyright:1 - Basis: found by the review tooling's own checks
- Evidence:
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0 - Problem: The first field must be exactly
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/(copyright-format 1.0, "Format" field). Anything else, including thehttp://form and the URLs of the drafts that preceded 1.0, does not declare the file to be in the current format, and a file written to a draft may also use field names and licence short names that 1.0 changed. - Fix: Replace the line as shown under Proposed changes, then check the rest of the file against copyright-format 1.0 (for example
Upstream-Name,Upstream-ContactandSourcein the header, notNameorMaintainer).
minor packaging 3. libupnp-dev description is stale and describes files the package does not ship ◂
- Files:
debian/control:25,debian/control:32 - Basis: checked, in the package or with a reference tool
- Evidence:
Description: Portable SDK for UPnP Devices, version 1.14 (development files)andThis package contains the header files, documentation and debug versions of libraries needed for development .... - Problem: This source/package version is 22.1.8, the HTML documentation is shipped by
libupnp-doc(only under thelibupnp-devdoc directory), and no debug libraries are shipped. Both the synopsis and the long description are user-visible and inaccurate. - Fix: Drop the
version 1.14phrase and describe only whatlibupnp-devships (headers, pkg-config/CMake files and the unversioned.sosymlinks), leaving documentation tolibupnp-doc.
Verified ◂
- Read
debian/copyrightin full: it is DEP-5 with aFiles: *catch-all and specific stanzas forcmake/CmDaB.cmake(GPL-3),debian/*,ixml/test/testdata/xml.ascc.net/*(Academia-Sinicai-XML-Now), the two public-domain MD5 files,upnp/m4/libupnp.m4(GPL-2+), five BSD-2-clause 2026 test files,upnp/test/test_log.c, the OSF/HP/DEC/Microsoft UUID files, andupnp/src/inet_pton.c(ISC). - Copyright and licence headers were grepped across the whole tree (337 files): the holders named in file notices appear in
debian/copyright; the prescan's only candidate,ixml/test/test_document.c:4R?mi Turboult, is a mojibake spelling of Rémi Turboult, who is named. - Full licence text is present for every licence not in
/usr/share/common-licenses(BSD-3-clause-Intel, BSD-2-clause, MIT-like, ISC, Academia-Sinicai-XML-Now); GPL-2+ and GPL-3 refer to/usr/share/common-licenses/GPL-2andGPL-3. - No third-party library is vendored:
gtest/contains only pupnp's own tests,cmake/CmDaB.cmakeis a configure-time helper that is not linked into any binary, andupnp/m4/libupnp.m4is not used by the CMake build. ixml/test/testdata/xml.ascc.net/is test data under the Academia Sinica permission quoted indebian/copyright; its files carry the 1998 Academia Sinica copyright notices.site/assets (index.html,index.css,app.js,LICENSE, and the images) are covered bysite/LICENSE, which is the same BSD-3-clause-Intel text asCOPYING; none of them is installed.- Build system and packaging:
debian/rulesusesdh $@ -Scmake+ninja(valid-Sform,cmake+ninjaexists in this debhelper), compat 14,hardening=+all, static libraries disabled, and the Doxygen build only in the indep path;debian/not-installedmatches the sample files that upstream installs. debian/libupnp22.symbolsanddebian/libixml22.symbolsnamelibupnp.so.22/libixml.so.22and carry a1:22.1.8tag for the newly addedUpnpSetMaxHeaderSize.debian/tests/buildis a real autopkgtest: it compilespupnp-test.cboth directly with-lupnpand viapkg-config, then runs both binaries.- uscan found the packaged version as the newest upstream release (upstream
22.1.8, packaged22.1.8). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (GPL-2,GPL-3).
Not confirmed ◂
ixml/test/testdata/xmlconf/{014,040,059,111,element}.xmlcarry no copyright or licence notice. Their numeric names and content resemble the W3C XML conformance test suite; if they derive from it, theFiles: *attribution indebian/copyrightwould be incomplete and a W3C stanza would be needed. Nothing in the tree states their origin.site/HTML5_Logo_32.png,site/vcss.pngandsite/jetbrains.svgare third-party logos;site/LICENSE(Intel BSD-3) is the only licence in that directory and their own terms are not stated. They are not installed, so this does not affect the binaries.
Proposed: debian/copyright Format field ◂
Replace line 1 of debian/copyright with:
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Review Information
accepted — allocated to awm 20 days ago, started 20 days ago, completed 20 days ago.
Final Comment
Hi,
The first line of a DEP-5 format copyright file needs to be exactly:
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Yours is missing a trailling '/' which, though trivial, causes some tools to fail to parse it.
The LLM Review identified a couple of other issues that you may, or may not consider worth looking at. FWIW, if there's no source for the PDF that it is grumpy about due to the vicissitudes of time, then I don't think removing it is necessarily the correct answer - if it provides value then it should remain as-is.
Thanks!
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 1:1.18.0-1 | 6cdc8443… | 2026-02-12 04:34 | 2026-02-12 04:37 | awm | accepted | VIEW |