DFSG NEW review for pyrtcm version 1.2.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 1 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: 11 found

Licensing

The whole tree is BSD-3-Clause — no other licence or restriction appears anywhere — so the licensing is DFSG-free and the full licence text is present in debian/copyright. The copyright file is DEP-5 but its Files: * stanza names the wrong holder: SEMU Consulting is only the upstream contact, while LICENSE, docs/conf.py and every source header name Steve Smith (semuadmin), and the LICENSE year is 2020. The file therefore does not accurately describe the copyright of the files.

Packaging

A clean 3.0 (quilt) package: debhelper compat 13 with pybuild, complete Build-Depends, the upstream pytest suite run at build time (pybuild auto-selects pytest because python3-pytest is in Build-Depends, and PYBUILD_TEST_ARGS clears the coverage addopts so pytest-cov is not needed), valid changelog, Vcs-* fields, Rules-Requires-Root: no and an autopkgtest smoke test. Standards-Version 4.7.0 matches the first two components of Policy 4.7.4.1. The only open point is the pynmeagps version gap recorded under Not confirmed.

Issues

1. [blocker] [licensing] Files: * names SEMU Consulting as copyright holder instead of Steve Smith (semuadmin)

• Files: debian/copyright:7, LICENSE:3, docs/conf.py:29, src/pyrtcm/__init__.py:5, examples/rtcmpoller.py:24
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: Copyright: 2022-2026 SEMU Consulting <info@semuconsulting.com>; LICENSE:3 Copyright (c) 2020, semuadmin (Steve Smith); src/pyrtcm/init.py:5 :copyright: semuadmin © 2022; docs/conf.py:29 copyright = "2021 semuadmin (Steve Smith)"; examples/rtcmpoller.py:24 :copyright: semuadmin © 2021
• Problem: Policy 12.5 requires a verbatim copy of the package's copyright information, and BSD-3-Clause requires the original copyright notice to be preserved. SEMU Consulting appears in the tree only as the upstream contact (debian/copyright:3 and the address in pyproject.toml), never as a copyright holder; every actual notice names Steve Smith (semuadmin), and the LICENSE year is 2020, not 2022. The stanza therefore names an entity that holds no copyright here and omits the holder who does.
• Fix: Use the holder from the file notices, e.g. Copyright: 2020-2026 Steve Smith (semuadmin) <semuadmin@semuconsulting.com> (2020 from LICENSE, 2021 from docs/conf.py and examples/rtcmpoller.py, 2022 from the source headers, 2024 from examples/msmparser.py). If SEMU Consulting is a separate rights holder, list it in addition, not instead; keep it in Upstream-Contact either way.

2. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Read debian/copyright in full: it is DEP-5 with the correct Format URL, Files: * and debian/* stanzas and a stand-alone BSD-3-Clause paragraph containing the full licence text; the licence is DFSG-free.
• Read every file under debian/ (changelog, control, copyright, gbp.conf, rules, source/format, tests/control), plus LICENSE, README.md, CITATION.cff, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, pyproject.toml, RELEASE_NOTES.md, docs/conf.py, docs/index.rst, the examples and the headers of all src/, examples/ and tests/ files.
• Searched the whole tree for Copyright, (C), ©, SPDX-License-Identifier, 'licensed under', 'permission is hereby granted', GPL/LGPL/Apache/MPL/MIT/public-domain/non-commercial/no-modification wording: only the BSD-3-Clause text and the semuadmin notices occur; no other licence, restriction or 'all rights reserved' condition is present.
• All 11 files the scan lists are RTCM3/NTRIP binary capture logs used as test fixtures by tests/test_stream.py: tests/pygpsdata-1230.bin (opened at line 92), tests/pygpsdata-RTCMMSM3.log (112), tests/pygpsdata-RTCM3.log (146, 165, 195, 224), tests/pygpsdata-NTRIP-USCL00CHL0.log (277), tests/pygpsdata-NTRIP-4076.log (306), tests/pygpsdata-1240-1264.log (335), tests/pygpsdata-NTRIP-1300-1302.log (366), tests/pygpsdata-MIXED-RTCM3BADCRC.log (430, 447, 468) and tests/pygpsdata-BADHDR.log (567). tests/pygpsdata-MIXED-RTCM3.log and tests/pygpsdata-MT1023.log are not referenced by any test but are upstream capture data. None is a built artifact, program or embedded third-party source; they are not installed in the binary package.
• The © 2016 RTCM lines (src/pyrtcm/rtcmtables.py:6, rtcmtypes_core.py:6, rtcmtypes_get.py:6, rtcmtypes_get_msm.py:4) say the message tables' information is sourced from RTCM STANDARD 10403.3. They are not a copyright claim on the Python files, whose own notices name semuadmin, and no RTCM document or licence text is included, so RTCM is not a holder to add.
• images/coverage.svg is a generated coverage badge, not a build artifact; the documentation sources (docs/*.rst, docs/conf.py) are present, so no documentation is shipped without its source.
• Packaging: debian/source/format is 3.0 (quilt) with no debian/patches; debhelper-compat (= 13) with dh $@ --buildsystem=pybuild; Build-Depends covers python3-all, dh-sequence-python3, setuptools (84.2.0 in the archive, satisfying pyproject's >=75.0.0), build, installer, wheel, pytest and pynmeagps.
• dh_auto_test runs the upstream suite: pybuild.pm adds --test-pytest when python3-pytest is in the build dependencies, and PYBUILD_TEST_ARGS = -o addopts="" disables pyproject.toml's coverage addopts, so pytest-cov is not required.
• Standards-Version 4.7.0 against Policy 4.7.4.1: the first two components match, so it is current (not an issue). Changelog is a valid unstable initial release closing #1151891; Vcs-Browser/Vcs-Git, Homepage and Rules-Requires-Root: no are present; there are no maintainer scripts.
• debian/tests/control is a single import pyrtcm smoke test; the full upstream pytest suite runs at build time.
• uscan found the packaged version as the newest upstream release (upstream 1.2.1, packaged 1.2.1).

Not confirmed

• pyproject.toml declares dependencies = ["pynmeagps >= 1.1.8"], but the archive has only python3-pynmeagps 1.1.7-1 and debian/control and Build-Depends carry no version constraint. pyrtcm imports SocketWrapper, ecef2llh and llh2ecef from pynmeagps (added in pyrtcm 1.1.10 per RELEASE_NOTES.md). If 1.1.7 lacks an API that 1.2.1 needs, import pyrtcm and the build's pytest run would fail; if the build does pass with 1.1.7, a patch or comment lowering the upstream constraint should record that. I could not inspect pynmeagps 1.1.7 offline.
• CODE_OF_CONDUCT.md is an adaptation of the Contributor Covenant v1.4, attributed in the file; it carries no licence statement of its own and debian/copyright treats it as BSD-3-Clause. I could not check the Covenant's own licence offline (the Covenant project publishes it under CC BY 4.0); if it is CC BY-SA, a separate Files stanza with that licence is needed.