DFSG NEW review for python-h3 version 4.5.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The entire tree is Apache-2.0: the project LICENSE (full Apache 2.0 text) at the root, and a grep across src/, docs/, tests/ and the root files found no other licence text and no non-free terms. debian/copyright is in DEP-5 1.0 format with a Files: * catch-all (Uber Technologies), a debian/* stanza (Andreas Tille) and a full Apache-2.0 License paragraph pointing at /usr/share/common-licenses. The src/h3lib submodule is empty in both the source tree and the .orig tarball, so there is no bundled H3 core code to account for and no Files-Excluded is needed. No built/binary/minified files were found (only docs/logo.svg and docs/polygon_tutorial.ipynb, upstream docs assets). The only inaccuracy is that the Debian-added src/h3/_cy/cellsToMultiPoly.h (header copyright Andreas Tille) is covered by the Files: * stanza, which attributes it to Uber; all holders are nonetheless named in the file. License is fully free (Apache-2.0), so DFSG-compliant.

Packaging

Clean, modern packaging: 3.0 (quilt), debhelper compat 14, DEP-3-documented patchset (build against system libh3 via pkg-config, and a fixed build-dir patch for reproducibility), pybuild with PYBUILD_NAME=h3 and an -o addopts= override of the upstream pytest-cov addopts, autopkgtests via Testsuite autopkgtest-pkg-pybuild (pybuild-autopkgtest mechanism confirmed from its man page), current Standards-Version 4.7.4, arch-any binding with shlibs/tpython3 substvars. Build-Depends all exist in the archive (libh3-dev 4.5.0-1, python3-scikit-build-core, pybuild-plugin-pyproject, dh-sequence-python3). Linkage to the shared libh3 means Depends on libh3-1 will come from ${shlibs:Depends}; numpy is correctly optional at runtime (Suggests) and a <!nocheck> test-time build dep because the numpy import is lazy. Only nits: the long Description still says the core library is compiled into the extension modules, which is no longer true for this build (it links system libh3).

Issues

1. [minor] [licensing] debian/copyright attributes the Debian-added cellsToMultiPoly.h to Uber under Files: *

• Files: python-h3-4.5.0/debian/copyright:6-8, python-h3-4.5.0/src/h3/_cy/cellsToMultiPoly.h:2
• Basis: checked, in the package or with a reference tool
• Evidence: Files: * / Copyright: 2016-2026 Uber Technologies, Inc. covers src/h3/_cy/cellsToMultiPoly.h, whose own header reads Copyright 2026 Andreas Tille <tille@debian.org>; Andreas Tille is only named in the Files: debian/* stanza.
• Problem: The catch-all stanza misattributes the copyright holder of that one file; DEP-5 accuracy requires the holder of each file to appear in the stanza that matches it. Minor: every holder is still named in the file and the licence (Apache-2.0) is correct.
• Fix: Add a Files: src/h3/_cy/cellsToMultiPoly.h stanza with Copyright: 2026 Andreas Tille <tille@debian.org> and License: Apache-2.0 before the catch-all, or narrow Files: * to exclude it.

2. [minor] [packaging] long description says the H3 core library is compiled into the extension modules

• Files: python-h3-4.5.0/debian/control:31-32
• Basis: checked, in the package or with a reference tool
• Evidence: Description: The bindings are written in Cython; the H3 core library is compiled into the extension modules. but build-against-system-libh3.patch links the modules with pkg_check_modules(H3 REQUIRED IMPORTED_TARGET h3)/target_link_libraries(... PkgConfig::H3), i.e. the shared libh3 (Depends comes via ${shlibs:Depends} on libh3-1).
• Problem: The description is stale from upstream's static-build model and contradicts how this package actually links; users reading it will think the library is bundled.
• Fix: Reword to state that the bindings link against the system libh3 shared library.

Verified

• Every source/doc/test file in the tree is Apache-2.0; grep for Copyright/SPDX/(C)/©/Licensed under/GPL/LGPL/MIT/public-domain found only the Debian cellsToMultiPoly.h header and the project-level LICENSE; no other licence text exists.
• src/h3lib/ is empty in both the unpacked tree and python-h3_4.5.0.orig.tar.gz (uber-h3-py-2883945/src/h3lib), so there is no bundled H3 core code and no Files-Excluded is needed.
• No built, binary or minified files in the tree; only docs/logo.svg and docs/polygon_tutorial.ipynb (upstream documentation assets, Apache-2.0). No embedded third-party libraries.
• prescan author check: every holder found (75 files) is named in debian/copyright; the only mismatch is the stanza-level attribution of cellsToMultiPoly.h noted above.
• The Files: * catch-all correctly covers files that carry no individual notice (all upstream .py/.pyx/.pxd), governed by the project LICENSE.
• Testsuite: autopkgtest-pkg-pybuild is a recognised mechanism (lintian known-testsuites; pybuild-autopkgtest(1) man page confirms it generates debian/tests/control via autodep8 and reuses PYBUILD_* from debian/rules), so the lack of debian/tests/control is correct.
• Standards-Version 4.7.4 is current (Policy is 4.7.4.1); no issue.
• Build-Depends all resolve in the archive lists: libh3-dev 4.5.0-1 (satisfies >= 4.5.0), python3-scikit-build-core 0.12.2-1, pybuild-plugin-pyproject, dh-python/dh-sequence-python3, cython3, cmake, ninja-build, pkgconf.
• numpy runtime use is optional and lazy (import numpy as np inside numpy_int/_convert functions, no top-level import), so Suggests python3-numpy plus <!nocheck> build-time test dep is correct.
• The modules link the shared libh3 (DT_NEEDED on libh3.so.1) via the pkg-config patch, so ${shlibs:Depends} will carry the libh3-1 runtime dependency; explicit Depends/substvars at compat 14 are correct.
• PYBUILD_TEST_ARGS -o addopts= {dir}/tests correctly countermands the upstream [tool.pytest.ini_options] addopts = --cov-report=term-missing --durations=10, so pytest-cov is not needed.
• uscan found the packaged version as the newest upstream release (upstream 4.5.0, packaged 4.5.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Whether the Cython declarations in src/h3/_cy/*.pxd match the h3api.h exported by Debian's libh3-dev 4.5.0 exactly (libh3-dev is not installed on the reviewing system; a build would show any mismatch).
• Whether the fixed build-dir = 'build' from reproducible-build.patch is fully cleaned by dh clean so the source stays pristine.

Proposed changes

None.