Review: python-logfire 5.2.0-2

New Package Report

.changes◂

Source	python-logfire
Version	5.2.0-2
Changed-By	Pieter Lenaerts <plenae@disroot.org>
Architecture	source all
Distribution	unstable
Date	Tue, 03 Nov 2026 20:14:01 +0000

Changelog◂

python-logfire (5.2.0-2) unstable; urgency=medium
 .
   * d/copyright: correct to Pydantic Services inc and add specific licenses
     for adapted files

.dsc◂

Package-List	python3-logfire deb python optional arch=all python3-logfire-api deb python optional arch=all
Section	python
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/pydantic/logfire
Upstream-Name: logfire
Upstream-Contact: Pydantic Team <engineering@pydantic.dev>

Files:
 *
Copyright:
 2023-2026 Pydantic Services inc.
License: Expat

Files:
 logfire/_internal/formatter.py
Copyright:
 2023-2026 Pydantic Services inc.
 2001-2023 Python Software Foundation
License: Expat and PSF-2.0
Comment:
 Formatter._vformat_chunks is copied from string.Formatter._vformat in
 CPython 3.11.4 (Lib/string.py) and then altered.

Files:
 logfire/_internal/metrics.py
Copyright:
 2023-2026 Pydantic Services inc.
 The OpenTelemetry Authors
License: Expat and Apache-2.0
Comment:
 The proxy meter and instrument classes are adapted from the OpenTelemetry
 Python SDK/API.

Files:
 debian/*
Copyright:
 2026 Pieter Lenaerts <plenae@disroot.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: PSF-2.0
 PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2
 --------------------------------------------
 .
 1. This LICENSE AGREEMENT is between the Python Software Foundation
 ("PSF"), and the Individual or Organization ("Licensee") accessing and
 otherwise using this software ("Python") in source or binary form and
 its associated documentation.
 .
 2. Subject to the terms and conditions of this License Agreement, PSF
 hereby grants Licensee a nonexclusive, royalty-free, world-wide
 license to reproduce, analyze, test, perform and/or display publicly,
 prepare derivative works, distribute, and otherwise use Python alone
 or in any derivative version, provided, however, that PSF's License
 Agreement and PSF's notice of copyright, i.e., "Copyright (c) 2001-2023
 Python Software Foundation; All Rights Reserved" are retained in Python
 alone or in any derivative version prepared by Licensee.
 .
 3. In the event Licensee prepares a derivative work that is based on
 or incorporates Python or any part thereof, and wants to make
 the derivative work available to others as provided herein, then
 Licensee hereby agrees to include in any such work a brief summary of
 the changes made to Python.
 .
 4. PSF is making Python available to Licensee on an "AS IS"
 basis.  PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
 IMPLIED.  BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND
 DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
 FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT
 INFRINGE ANY THIRD PARTY RIGHTS.
 .
 5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
 FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
 A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON,
 OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
 .
 6. This License Agreement will automatically terminate upon a material
 breach of its terms and conditions.
 .
 7. Nothing in this License Agreement shall be deemed to create any
 relationship of agency, partnership, or joint venture between PSF and
 Licensee.  This License Agreement does not grant permission to use PSF
 trademarks or trade name in a trademark sense to endorse or promote
 products or services of Licensee, or any third party.
 .
 8. By copying, installing or otherwise using Python, Licensee
 agrees to be bound by the terms and conditions of this License
 Agreement.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 4 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for python-logfire version 5.2.0-2

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 4 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the correct Format line, and its four stanzas match the tree: everything is Pydantic Services' MIT/Expat (upstream LICENSE: 'Copyright (c) 2023 - present Pydantic Services inc.'), except logfire/_internal/formatter.py, which contains code copied from CPython's Lib/string.py and is correctly attributed to the Python Software Foundation with the full PSF-2.0 text, and logfire/_internal/metrics.py, adapted from the OpenTelemetry SDK and correctly attributed to The OpenTelemetry Authors with Apache-2.0. Searching the whole tree (outside .pc/ and debian/) for SPDX tags, GPL/LGPL/MPL/CC wording, non-commercial/no-modification terms and further copyright notices found nothing else; the only LICENSE/COPYING/NOTICE/AUTHORS file is the top-level LICENSE. All three licences are free and mutually compatible, and the prescan's author check found every holder it detected already named.

Packaging

Unusually careful packaging: pybuild builds each sub-project into its own binary, the upstream suite runs both at build time and in an autopkgtest kept in sync with debian/rules, debian/py3dist-overrides supplies the one mapping dh_python3 lacks (opentelemetry-instrumentation), every Build-Depends and generated runtime dependency name exists in the archive, Standards-Version 4.7.4 is current against Policy 4.7.4.1, and all ten patches carry DEP-3 headers and a stated reason. The issues found are documentation hygiene rather than broken packaging: the installed README.Debian keeps ~390 lines of an AI-generated analysis its author calls obsolete, its Docs section and the commented-out mkdocs block describe a documentation build upstream no longer has, the package descriptions describe the hosted service instead of the library, and the patch that fixes an upstream defect is marked not forwarded.

Issues

minor packaging 1. debian/README.Debian keeps ~390 lines of a generated dependency analysis the author calls obsolete, and dh_installdocs installs it ◂

Files: debian/README.Debian:196-586
Basis: checked, in the package or with a reference tool
Evidence: Below this marker is generated by Mistral Vibe. / I don't think this section below has much use anymore. (followed by This file was generated by Mistral Vibe., a Core Runtime Dependencies list, a Hard Dev Dependencies list with ruff/mypy/pyright/coverage, and a generated PyPI-to-Debian table)
Problem: dh_installdocs(1) installs debian/README.Debian as /usr/share/doc/python3-logfire/README.Debian for the first binary package; the useful maintainer notes end at line 195 and everything after is a stale machine-generated analysis of upstream's development environment that describes nothing Debian ships and that the author explicitly says is of no use.
Fix: Delete lines 196-586, keeping the hand-written sections.

minor packaging 2. README.Debian and debian/rules describe an MkDocs documentation build that upstream 5.2.0 no longer has (no mkdocs.yml in the tarball) ◂

Files: debian/README.Debian:20-28, debian/rules:130-142, debian/control:17-19
Basis: checked, in the package or with a reference tool
Evidence: README.Debian: Documentation is generated using mkdocs, but requires a pydantic_docs package.; debian/rules: # mkdocs build -d $(CURDIR)/build/html -f $(CURDIR)/mkdocs.yml; upstream Makefile:60-62: Logfire docs are built by pydantic/unified-docs; this repo no longer runs MkDocs.
Problem: There is no mkdocs.yml anywhere in the tree: I checked both the unpacked source and the member list of python-logfire_5.2.0.orig.tar.gz (root pydantic-logfire-4c98d5d), and the upstream Makefile says MkDocs is no longer used. The commented-out mkdocs/mkdocs-material/mkdocstrings Build-Depends in debian/control, the commented override_dh_auto_build/dh_installdocs block in debian/rules and the README's explanation for the missing -doc package therefore point at a file and a build that do not exist, and the stated blocker (mkdocs plus pydantic_docs) is not the reason there is no documentation package.
Fix: Delete the commented-out docs Build-Depends and rules block, and rewrite the README's Docs section: the docs are built by pydantic/unified-docs, which is unreleased, hence no python-logfire-doc.

minor packaging 3. Both binary descriptions describe the hosted Logfire service, not the Python modules the packages install ◂

Files: debian/control:77-84, debian/control:86-95
Basis: checked, in the package or with a reference tool
Evidence: Description: AI observability platform for production LLM and agent systems and Logfire is Pydantic’s end-to-end AI engineering platform. It shows you what your agents, services, applications, and hosts are actually doing (identical extended description in both stanzas)
Problem: Policy 3.4 requires the description to tell a user what the package provides so they can decide whether to install it. Neither stanza says that python3-logfire installs the Python logfire library with its logfire command, pytest plugin and pydantic entry point, or that python3-logfire-api installs the logfire_api stub module; a reader is told about a hosted platform they cannot install from Debian.
Fix: Write a synopsis such as Python observability SDK for LLM and agent applications and an extended description that names the modules, the command and plugin, the OpenTelemetry dependency, and that each optional integration needs its own python3 package.

minor packaging 4. The patch fixing an upstream protobuf incompatibility is marked Forwarded: not-needed although its own description says it could be forwarded ◂

Files: debian/patches/support-old-protobuf-MessageToJson.patch:1-12, debian/patches/normalize-unknown-service-name-python3.patch:1-16
Basis: inferred from what was read, not seen directly
Evidence: Forwarded: not-needed in the header, while the body says Upstream declares protobuf >= 4.23.4 in pyproject.toml, but protobuf 4.x lacks the new keyword too, so this could be forwarded.; the patch changes installed code in logfire/_internal/forwarding.py (the other patch touching installed code, in logfire/_internal/exporters/test.py, is Debian-specific)
Problem: This is one of only two patches that change shipped code for a real upstream defect (MessageToJson() raising TypeError on the keyword upstream uses), and it would benefit every distribution building against protobuf 4.x. Marking it not-needed while the description argues the opposite makes it a permanent fork: the change will need re-porting at every upstream release, which is what Forwarded: exists to prevent.
Fix: Send it upstream and record Forwarded: https://github.com/pydantic/logfire/pull/... (or Origin:), keeping Forwarded: not-needed only if upstream declines.

Verified ◂

The prescan listed no files: its author check scanned 805 files and reported every copyright holder found already named in debian/copyright.
debian/copyright read in full: DEP-5, Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/, stanzas for *, the two derived files and debian/*, standalone License paragraphs for Expat, Apache-2.0 (with a /usr/share/common-licenses reference) and the full PSF-2.0 text.
Upstream LICENSE read: MIT text, Copyright (c) 2023 - present Pydantic Services inc., i.e. Expat as declared for Files: *; it is the only LICENSE/COPYING/NOTICE/AUTHORS file in the tree.
logfire/_internal/formatter.py:160 says the code is Copied from string.Formatter._vformat ... CPython v3.11.4 ... then altered; debian/copyright names the Python Software Foundation, the 2001-2023 years and PSF-2.0 with full text, and the Comment records the change.
logfire/_internal/metrics.py:33 says The following proxy classes are adapted from OTEL's SDK; debian/copyright names The OpenTelemetry Authors and Apache-2.0. Expat, PSF-2.0 and Apache-2.0 are mutually compatible.
Greps over the tree (excluding .pc/ and debian/, gitignore off) for Copyright/(C)/©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GPL/LGPL/Affero, Apache, MPL, public domain, All rights reserved, CC, Unlicense, CC0, non-commercial and no-modification wording found nothing except LICENSE and base64 noise in test cassettes/uv.lock.
Greps for copied/adapted/derived code found only the two files above in shipped code; the remaining hits are references or inspiration in comments (config.py:1719 links to sentry-python, json_formatter.py:247 Inspired by a gist, integrations/logging.py:131 quotes CPython's logging), with no copied text.
docs/ images (~200 PNG/JPG/GIF and docs/integrations/llms/.svg plus languages/.svg): product screenshots and vendor logos, judged from path and name only (not opened); no separate notices; no binary package installs them and copyright does not exclude them.
tests/otel_integrations/cassettes/*.yaml are recorded HTTP fixtures, i.e. test data, not programs.
.github/workflows/claude.yml's first line says it was copied from the anthropics/claude-code-action examples; it is a CI configuration, installed nowhere, and recorded as under upstream's LICENSE as distributed.
uv.lock and pyproject.toml are upstream development metadata, not built output; no built, minified, generated or PDF files found in the tree.
logfire/.agents contains only skills/; nothing in logfire/ reads .agents, so moving it to /usr/share/doc/python3-logfire/agent-skills in debian/rules cannot break runtime code.
pybuild's --name is a real option (/usr/share/dh-python/pybuild:319) and sets the install destdir to debian/python3-, so the per-package build/install loops work as the README describes.
dh_python3's fallback pydist (/usr/share/dh-python/dist/cpython3_fallback) maps every Requires-Dist name of logfire (opentelemetry-api/sdk/semantic-conventions/exporter-otlp-proto-http, rich, requests, protobuf, typing-extensions, executing, tomli); opentelemetry-instrumentation is the only one missing, and debian/py3dist-overrides supplies it.
dh_python3's accept_upstream_versions defaults to False (/usr/share/dh-python/dhpython/options.py:32), so upstream's protobuf >= 4.23.4 does not become a versioned Depends that Debian's 3.21 could not satisfy.
apt-cache checked: pybuild-plugin-pyproject, python3-httpx2, python3-inline-snapshot, python3-beartype, python3-pytest-examples, python3-pydantic-handlebars, python3-sqlmodel, python3-typing-extensions, python3-opentelemetry-sdk 1.45.2, python3-opentelemetry-instrumentation 0.65b0, -aiohttp-server, -system-metrics, -aws-lambda, -exporter-http-transport, -exporter-otlp-common and python3-pyarrow (built for python3 >= 3.14 only) all exist; python3-logfire and python3-logfire-api are not in the archive, i.e. this upload is a NEW package, so no upgrade questions arise.
All ten patches read: each has From/Date/Subject/Forwarded; the test-only ones add skip marks with a specific reason or a skipif that re-enables the test once the package appears; the series order matches the index lines of the patches that touch the same file.
debian/tests/control and debian/tests/upstream-testsuite read: Depends: @, @builddeps@, Restrictions: allow-stderr; the 19-module integration list and the two ignores match LOGFIRE_INTEGRATION_TESTS/LOGFIRE_TEST_ARGS in debian/rules, as their comments require.
debian/control at compat 14: no explicit relationship substvars needed (dh_gencontrol adds them); the explicit nocheck guard in override_dh_auto_test only duplicates what dh does at compat 13+, which is harmless.
debian/changelog: unstable, 5.2.0-2, the ITP closed in 5.2.0-1; debian/source/format is 3.0 (quilt) and the .dsc matches debian/control; Standards-Version 4.7.4 against Policy 4.7.4.1.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 5.4.0, packaged 5.2.0), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

debian/salsa-ci.yml sets SALSA_CI_DISABLE_BUILD_PACKAGE_ALL, _ANY and _I386 to 1 and adds a custom test-build-profiles job extending .test-build-package-profiles; offline I could not confirm that SALSA_CI_ENABLE_BUILD_PACKAGE_PROFILES and that template name exist in the salsa-ci recipe, nor whether disabling build-all as well as build-any leaves CI with no ordinary build at all - the README only explains the i386 job.
The provenance of the vendor logos and the SOC 2 logo under docs/images and docs/integrations/llms is not verifiable from the package; I recorded them as covered by upstream's MIT LICENSE and did not open them.

Proposed changes ◂

None.

Uploader's response to the LLM review

Hi, thanks for this second review. Would have been nice to have these in the first review, but hey ;-)

Granted, removed.
Not sure where upstream is going. They use some pydantic_docs package, which looks a bit flaky right now. It refers to mkdocs, but mkdocs.yml is indeed missing. I need to start the real work on this with the next release 5.4.0 and decided not to package the docs yet.
Granted and updated.
I didn't send in the patch because I think upstream will just pull up the minimal version in pyproject.toml, which doesn't really help. So. Unless you disagree, I would keep it at this. I did clarify in the patch description.

I'll seek sponsorship for a new upload of 5.2.0-3.

Br,

Pieter

— Pieter Lenaerts (plenae), 1 day ago

Review Information

accepted — allocated to awm 16 hours ago, started 16 hours ago, completed 16 hours ago.

Final Comment

Superseded by review of later version

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
5.2.0-3	f3e3b13b…	2026-11-07 09:58	2026-11-07 09:58	awm	accepted	VIEW
5.2.0-1	e0e5df98…	2026-11-07 09:58	2026-11-07 09:58	awm	accepted	VIEW

Back to Dashboard | View all reviews for this package