DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: pupnp 1:22.1.8-1

Package Information

DescriptionPortable SDK for UPnP Devices, version 1.14 (development files)

The Portable SDK for UPnP Devices (libupnp) provides developers with an API and open source code for building control points, devices, and bridges that are compliant with Version 1.0 of the Universal Plug and Play Device Architecture Specification - see http://www.upnp.org/ for specifications.

This package contains the header files, documentation and debug versions of libraries needed for development of programs using uPnP.

MaintainerDebian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Changed BySebastian Ramacher <sramacher@debian.org>
Sponsorsramacher@debian.org
Distributionexperimental
Architectureany all
VCSgit: https://salsa.debian.org/multimedia-team/pupnp.git (browse)
Closes#1151082
Popcon Installs48082
Binary NEWYes (new binary packages of a source already in sid)
Trackerhttps://tracker.debian.org/pkg/pupnp
Uploaded21 days ago

New Package Report

.changes◂
DateSat, 17 Oct 2026 18:38:31 +0200
Sourcepupnp
Version1:22.1.8-1
Changed-BySebastian Ramacher <sramacher@debian.org>
Architectureall amd64 source
Distributionexperimental
Changelog◂
pupnp (1:22.1.8-1) experimental; urgency=medium
 .
   * New upstream version 22.1.8
     - Fixes CVE-2026-77630, CVE-2026-57488, CVE-2026-57487, CVE-2026-57486,
       and CVE-2026-55862 (Closes: #1151082)
   * SONAME bump:
     - libupnp20 -> libupnp22
     - libixml11 -> libixml22
   * debian/control:
     - Bump debhelper compat to 14
     - Bump Standards-Version
   * debian/copyright: Update copyright info for 22.1.8
.dsc◂
Sectionlibs
Priorityoptional
Componentmain
Package-Listlibixml22 deb libs optional arch=any
libupnp-dev deb libdevel optional arch=any
libupnp-doc deb doc optional arch=all
libupnp22 deb libs optional arch=any
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0
Upstream-Name: pupnp
Upstream-Contact: Marcelo Roberto Jimenez <mroberto@users.sourceforge.net>
Source: https://github.com/pupnp/pupnp

Files: *
Copyright:
 2000-2003 Intel Corporation - All Rights Reserved.
 2005-2007 Rémi Turboult <r3mi@users.sourceforge.net>
 2006 Michel Pfeiffer and others <virtual_worlds@gmx.de>
 2006 Alexander Chemeris
 2007-2020 Marcelo Roberto Jimenez <mroberto@users.sourceforge.net>
 2011-2012 France Telecom
License: BSD-3-clause-Intel

Files: cmake/CmDaB.cmake
Copyright: 2021, Vollstrecker <werner@vollstreckernet.de>
License: GPL-3

Files: debian/*
Copyright:
 2005-2007 Steve McIntyre <93sam@debian.org>
 2008-2012 Nick Leverton <nick@leverton.org>
 2017 James Cowgill <jcowgill@debian.org>
 2023-2026 Sebastian Ramacher
License: BSD-3-clause-Intel

Files: ixml/test/testdata/xml.ascc.net/*
Copyright: 1998 Academia Sinica, http://xml.ascc.net/
License: Academia-Sinicai-XML-Now
 Unless otherwise stated, permission is granted to use, copy, link to,
 translate and republish in any form, including for commercial use,
 providing due acknowledgement of the copyright holder and the Chinese
 XML Now! website is made.

Files: upnp/src/inc/md5.h
       upnp/src/uuid/md5.c
Copyright: none
License: public-domain
 This code was written by Colin Plumb in 1993, no copyright is claimed.
 This code is in the public domain; do with it what you wish.

Files: upnp/m4/libupnp.m4
Copyright: 2003-2008 aMule Team <admin@amule.org>
License: GPL-2+

Files: upnp/test/test_connect_high_fd.c
       upnp/test/test_gena_granted_timeout.c
       upnp/test/test_gena_notify_sid.c
       upnp/test/test_sock_io.c
       upnp/test/test_ssdp_req_port.c
Copyright: 2026 The pupnp contributors
License: BSD-2-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 - Redistributions of source code must retain the above copyright notice,
 this list of conditions and the following disclaimer.
 - Redistributions in binary form must reproduce the above copyright notice,
 this list of conditions and the following disclaimer in the documentation
 and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR
 CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Files: upnp/test/test_log.c
Copyright: 2018 Jean-Francois Dockes <jfd@recoll.org>
License: BSD-3-clause-Intel

Files:
 upnp/src/inc/sysdep.h
 upnp/src/inc/uuid.h
 upnp/src/uuid/sysdep.c
 upnp/src/uuid/uuid.c
Copyright: 1990- 1993, 1996 Open Software Foundation, Inc.
           1989 Hewlett-Packard Company, Palo Alto, Ca. &
                   Digital Equipment Corporation, Maynard, Mass.
           1998 Microsoft.
License: MIT-like
 To anyone who acknowledges that this file is provided "AS IS"
 without any express or implied warranty: permission to use, copy,
 modify, and distribute this file for any purpose is hereby
 granted without fee, provided that the above copyright notices and
 this notice appears in all source code copies, and that none of
 the names of Open Software Foundation, Inc., Hewlett-Packard
 Company, or Digital Equipment Corporation be used in advertising
 or publicity pertaining to distribution of the software without
 specific, written prior permission.  Neither Open Software
 Foundation, Inc., Hewlett-Packard Company, Microsoft, nor Digital Equipment
 Corporation makes any representations about the suitability of
 this software for any purpose.

Files: upnp/src/inet_pton.c
Copyright: 1996-1999 Internet Software Consortium.
License: ISC
 Permission to use, copy, modify, and distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
 ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
 OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
 CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
 DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
 PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
 ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 SOFTWARE.

License: GPL-2+
 This program is free software; you can redistribute it and/or
 modify it under the terms of the GNU General Public License as
 published by the Free Software Foundation; either version 2 of the
 License, or (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 General Public License for more details.
 .
 You should have received a copy of the GNU General Public License along
 with this program.  If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU General
 Public License can be found in `/usr/share/common-licenses/GPL-2'.

License: GPL-3
 This program is free software; you can redistribute it and/or
 modify it under the terms of the GNU General Public License version 3 as
 published by the Free Software Foundation.
 .
 This program is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 General Public License for more details.
 .
 You should have received a copy of the GNU General Public License along
 with this program.  If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU General
 Public License can be found in `/usr/share/common-licenses/GPL-3'.

License: BSD-3-clause-Intel
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 - Redistributions of source code must retain the above copyright notice,
 this list of conditions and the following disclaimer.
 - Redistributions in binary form must reproduce the above copyright notice,
 this list of conditions and the following disclaimer in the documentation
 and/or other materials provided with the distribution.
 - Neither name of Intel Corporation nor the names of its contributors
 may be used to endorse or promote products derived from this software
 without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR
 CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 21 days ago.

Proposes a replacement debian/copyright: debian/copyright Format field

Report◂

DFSG NEW review for pupnp version 1:22.1.8-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 1 blocker, 1 important, 1 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable, without the current Format URL
  • Scan before the review: 1 found

Licensing

The licences themselves are free and debian/copyright is an accurate DEP-5 file: the main code is BSD-3-clause-Intel, with correctly stanned exceptions for the BSD-2 test files, public-domain MD5, MIT-like UUID code, ISC inet_pton, the GPL-2+ m4 macro, the GPL-3 CMake module and the Academia Sinica test data, and every non-common licence text is reproduced. The source package nevertheless ships docs/UPnP_Programming_Guide.pdf, a prebuilt PDF whose source is not in the package, so the source is not in its preferred form for modification.

Packaging

The packaging is in good shape: compat 14 with cmake+ninja, Build-Depends/Build-Depends-Indep split correctly, hardening=+all, updated symbols files for the new SONAMEs, a working not-installed list, and an autopkgtest that builds and runs a small program against libupnp-dev. The only real defect is a stale long description in libupnp-dev.

Issues

blocker licensing 1. Prebuilt PDF documentation is shipped without its source ◂
  • Files: docs/UPnP_Programming_Guide.pdf, README.md:75
  • Basis: inferred from what was read, not seen directly
  • Evidence: docs/ contains UPnP_Programming_Guide.pdf (364.7 kB) and no LaTeX/Word/other source; README.md:75 says the PDF "is from version 1.2 and is outdated".
  • Problem: The PDF is a generated document rather than its preferred form for modification, and the input it was generated from is absent from the package. Shipping it in the source package fails DFSG 2 (source code / preferred form); it is not installed by any binary package, but it is still part of the source distributed by Debian.
  • Fix: Remove the PDF (exclude it with Files-Excluded and repack the upstream tarball), or ship the source it was generated from.
important licensing 2. debian/copyright does not declare the current copyright-format 1.0 URL ◂
  • Files: debian/copyright:1
  • Basis: found by the review tooling's own checks
  • Evidence: Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0
  • Problem: The first field must be exactly Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ (copyright-format 1.0, "Format" field). Anything else, including the http:// form and the URLs of the drafts that preceded 1.0, does not declare the file to be in the current format, and a file written to a draft may also use field names and licence short names that 1.0 changed.
  • Fix: Replace the line as shown under Proposed changes, then check the rest of the file against copyright-format 1.0 (for example Upstream-Name, Upstream-Contact and Source in the header, not Name or Maintainer).
minor packaging 3. libupnp-dev description is stale and describes files the package does not ship ◂
  • Files: debian/control:25, debian/control:32
  • Basis: checked, in the package or with a reference tool
  • Evidence: Description: Portable SDK for UPnP Devices, version 1.14 (development files) and This package contains the header files, documentation and debug versions of libraries needed for development ....
  • Problem: This source/package version is 22.1.8, the HTML documentation is shipped by libupnp-doc (only under the libupnp-dev doc directory), and no debug libraries are shipped. Both the synopsis and the long description are user-visible and inaccurate.
  • Fix: Drop the version 1.14 phrase and describe only what libupnp-dev ships (headers, pkg-config/CMake files and the unversioned .so symlinks), leaving documentation to libupnp-doc.
Verified ◂
  • Read debian/copyright in full: it is DEP-5 with a Files: * catch-all and specific stanzas for cmake/CmDaB.cmake (GPL-3), debian/*, ixml/test/testdata/xml.ascc.net/* (Academia-Sinicai-XML-Now), the two public-domain MD5 files, upnp/m4/libupnp.m4 (GPL-2+), five BSD-2-clause 2026 test files, upnp/test/test_log.c, the OSF/HP/DEC/Microsoft UUID files, and upnp/src/inet_pton.c (ISC).
  • Copyright and licence headers were grepped across the whole tree (337 files): the holders named in file notices appear in debian/copyright; the prescan's only candidate, ixml/test/test_document.c:4 R?mi Turboult, is a mojibake spelling of Rémi Turboult, who is named.
  • Full licence text is present for every licence not in /usr/share/common-licenses (BSD-3-clause-Intel, BSD-2-clause, MIT-like, ISC, Academia-Sinicai-XML-Now); GPL-2+ and GPL-3 refer to /usr/share/common-licenses/GPL-2 and GPL-3.
  • No third-party library is vendored: gtest/ contains only pupnp's own tests, cmake/CmDaB.cmake is a configure-time helper that is not linked into any binary, and upnp/m4/libupnp.m4 is not used by the CMake build.
  • ixml/test/testdata/xml.ascc.net/ is test data under the Academia Sinica permission quoted in debian/copyright; its files carry the 1998 Academia Sinica copyright notices.
  • site/ assets (index.html, index.css, app.js, LICENSE, and the images) are covered by site/LICENSE, which is the same BSD-3-clause-Intel text as COPYING; none of them is installed.
  • Build system and packaging: debian/rules uses dh $@ -Scmake+ninja (valid -S form, cmake+ninja exists in this debhelper), compat 14, hardening=+all, static libraries disabled, and the Doxygen build only in the indep path; debian/not-installed matches the sample files that upstream installs.
  • debian/libupnp22.symbols and debian/libixml22.symbols name libupnp.so.22/libixml.so.22 and carry a 1:22.1.8 tag for the newly added UpnpSetMaxHeaderSize.
  • debian/tests/build is a real autopkgtest: it compiles pupnp-test.c both directly with -lupnp and via pkg-config, then runs both binaries.
  • uscan found the packaged version as the newest upstream release (upstream 22.1.8, packaged 22.1.8).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2, GPL-3).
Not confirmed ◂
  • ixml/test/testdata/xmlconf/{014,040,059,111,element}.xml carry no copyright or licence notice. Their numeric names and content resemble the W3C XML conformance test suite; if they derive from it, the Files: * attribution in debian/copyright would be incomplete and a W3C stanza would be needed. Nothing in the tree states their origin.
  • site/HTML5_Logo_32.png, site/vcss.png and site/jetbrains.svg are third-party logos; site/LICENSE (Intel BSD-3) is the only licence in that directory and their own terms are not stated. They are not installed, so this does not affect the binaries.
Proposed: debian/copyright Format field ◂

Replace line 1 of debian/copyright with:

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/

Review Information

accepted — allocated to awm 20 days ago, started 20 days ago, completed 20 days ago.

Final Comment

Hi,

The first line of a DEP-5 format copyright file needs to be exactly:

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/

Yours is missing a trailling '/' which, though trivial, causes some tools to fail to parse it.

The LLM Review identified a couple of other issues that you may, or may not consider worth looking at. FWIW, if there's no source for the PDF that it is grumpy about due to the vicissitudes of time, then I don't think removing it is necessarily the correct answer - if it provides value then it should remain as-is.

Thanks!

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
1:1.18.0-1 6cdc8443… 2026-02-12 04:34 2026-02-12 04:37 awm accepted VIEW

Back to Dashboard | View all reviews for this package