Review: python-logfire 5.2.0-3
Package Information
| Description | Python SDK for the Logfire observability platform python3-logfire is the Python SDK for Logfire, the observability platform from Pydantic. The package offers an API for manual tracing, a logging handler and auto-instrumentation for other Python packages, http clients, LLM frameworks, etc. The package also ships a CLI tool (logfire) for authentication and project setup, running Python scripts or modules with instrumentation, managing prompts and read tokens, etc. |
|---|---|
| Maintainer | Debian Python Team <team+python@tracker.debian.org> |
| Changed By | Pieter Lenaerts <plenae@disroot.org> |
| Sponsor | jcfp@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/python-team/packages/python-logfire.git (browse) |
| Tracker | https://tracker.debian.org/pkg/python-logfire |
| Uploaded | 18 hours ago |
| Supersedes | 5.2.0-2, 5.2.0-1 |
New Package Report
.changes
| Version | 5.2.0-3 |
|---|---|
| Changed-By | Pieter Lenaerts <plenae@disroot.org> |
| Architecture | source all |
| Distribution | unstable |
| Date | Sat, 07 Nov 2026 07:47:49 +0000 |
| Source | python-logfire |
Changelog
python-logfire (5.2.0-3) unstable; urgency=medium
.
* d/README.Debian: remove obsolete dependency analysis
* d/control: package descriptions describe the packages, not the online
service.
* d/p/support_old_protobuf*: explain why I would not forward.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | python3-logfire deb python optional arch=all python3-logfire-api deb python optional arch=all |
| Section | python |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/pydantic/logfire
Upstream-Name: logfire
Upstream-Contact: Pydantic Team <engineering@pydantic.dev>
Files:
*
Copyright:
2023-2026 Pydantic Services inc.
License: Expat
Files:
logfire/_internal/formatter.py
Copyright:
2023-2026 Pydantic Services inc.
2001-2023 Python Software Foundation
License: Expat and PSF-2.0
Comment:
Formatter._vformat_chunks is copied from string.Formatter._vformat in
CPython 3.11.4 (Lib/string.py) and then altered.
Files:
logfire/_internal/metrics.py
Copyright:
2023-2026 Pydantic Services inc.
The OpenTelemetry Authors
License: Expat and Apache-2.0
Comment:
The proxy meter and instrument classes are adapted from the OpenTelemetry
Python SDK/API.
Files:
debian/*
Copyright:
2026 Pieter Lenaerts <plenae@disroot.org>
License: Expat
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache License, Version 2.0
can be found in "/usr/share/common-licenses/Apache-2.0".
License: PSF-2.0
PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2
--------------------------------------------
.
1. This LICENSE AGREEMENT is between the Python Software Foundation
("PSF"), and the Individual or Organization ("Licensee") accessing and
otherwise using this software ("Python") in source or binary form and
its associated documentation.
.
2. Subject to the terms and conditions of this License Agreement, PSF
hereby grants Licensee a nonexclusive, royalty-free, world-wide
license to reproduce, analyze, test, perform and/or display publicly,
prepare derivative works, distribute, and otherwise use Python alone
or in any derivative version, provided, however, that PSF's License
Agreement and PSF's notice of copyright, i.e., "Copyright (c) 2001-2023
Python Software Foundation; All Rights Reserved" are retained in Python
alone or in any derivative version prepared by Licensee.
.
3. In the event Licensee prepares a derivative work that is based on
or incorporates Python or any part thereof, and wants to make
the derivative work available to others as provided herein, then
Licensee hereby agrees to include in any such work a brief summary of
the changes made to Python.
.
4. PSF is making Python available to Licensee on an "AS IS"
basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND
DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT
INFRINGE ANY THIRD PARTY RIGHTS.
.
5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON,
OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
.
6. This License Agreement will automatically terminate upon a material
breach of its terms and conditions.
.
7. Nothing in this License Agreement shall be deemed to create any
relationship of agency, partnership, or joint venture between PSF and
Licensee. This License Agreement does not grant permission to use PSF
trademarks or trade name in a trademark sense to endorse or promote
products or services of Licensee, or any third party.
.
8. By copying, installing or otherwise using Python, Licensee
agrees to be bound by the terms and conditions of this License
Agreement.
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 17 hours ago.
Report
DFSG NEW review for python-logfire version 5.2.0-3
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
debian/copyright is DEP-5 and matches the tree. The only licence text in the source is LICENSE (Expat/MIT, "Copyright (c) 2023 - present Pydantic Services inc."), which the Files: * stanza reproduces, and the two files that contain third-party code each have their own stanza with the right licence and full text: logfire/_internal/formatter.py is copied from CPython 3.11.4 string.Formatter._vformat and listed as Expat and PSF-2.0 (its own docstring at formatter.py:160 says so), logfire/_internal/metrics.py is adapted from the OpenTelemetry SDK (metrics.py:33) and listed as Expat and Apache-2.0 with a pointer to /usr/share/common-licenses/Apache-2.0. A tree-wide search for copyright notices, SPDX tags, licence names and non-free wording found nothing else, and there is no vendored third-party code; all third-party modules are imported from Debian packages. The combinations Expat+PSF-2.0 and Expat+Apache-2.0 are compatible for distribution. The prescan's author check found every holder it detected named in debian/copyright.
Packaging
Careful, conventional packaging. debhelper compat 14 with dh-sequence-python3; pybuild's --name is used to install each upstream sub-project directly into its binary package (python3-logfire, python3-logfire-api), which is how logfire/.agents ends up movable and logfire_api separate; dependencies come from the wheel METADATA and are resolved by dh_python3 (I checked the fallback dist-name list and how py3dist-overrides is normalised, and that pybuild's suggest_pkg_name yields debian/python3-). The upstream suite is run at build time per supported Python version and again in autopkgtest against the installed packages, with the two ignore lists kept in sync; ten DEP-3 patches, each with a stated reason and Forwarded field, skip only tests that cannot pass in Debian. Standards-Version 4.7.4 is current against Policy 4.7.4.1, and Vcs-*, gbp.conf, upstream/metadata and salsa-ci.yml are all present and consistent. I found nothing a sponsor would require changing.
Issues
None.
Verified ◂
- Prescan author check: 805 files scanned, 4 declared holders, every holder found is named; nothing needed accounting for.
- Root LICENSE is the MIT/Expat text, "Copyright (c) 2023 - present Pydantic Services inc.", matching
Files: *(Copyright 2023-2026 Pydantic Services inc., License: Expat). logfire/_internal/formatter.py:160says "Copied fromstring.Formatter._vformathttps://github.com/python/cpython/blob/v3.11.4/Lib/string.py#L198-L247 then altered", matching the formatter.py stanza; PSF-2.0 is not in /usr/share/common-licenses and its full text is in debian/copyright.logfire/_internal/metrics.py:33says "The following proxy classes are adapted from OTEL's SDK", matching the metrics.py stanza (Expat and Apache-2.0, pointer to /usr/share/common-licenses/Apache-2.0).- Tree-wide greps for Copyright, (C), (c), SPDX-License-Identifier, "Licensed under", "Permission is hereby granted", GNU General/Lesser, Apache License, Mozilla Public, public domain, All rights reserved, MIT/BSD/ISC/CC/MPL/GPL/AGPL and non-commercial/no-derivatives wording found notices only in LICENSE, pyproject.toml/logfire-api/pyproject.toml (
license = "MIT") and debian/. - No vendored third-party code: logfire and logfire-api import opentelemetry, protobuf, requests, rich, executing, typing_extensions, pydantic and friends from the archive; nothing under logfire/ is a copy of another project except the two files named above.
- Generated files all have their source in the package: logfire-api/logfire_api/*.pyi are stubgen output over logfire's annotated sources (Makefile
generate-stubs), logfire/version.py reads the installed dist metadata, and no compiled, minified, archived or PDF artifacts exist in the tree. - The only binary/opaque files are docs screenshots and logos under docs/images/ (including docs/images/integrations/llms/*.svg and docs/images/compliance/soc2_logo.png); they are not installed in any binary package and carry no separate copyright/licence metadata in the tree, so
Files: *is the only statement about them. debian/control: debhelper-compat 14, dh-sequence-python3, pybuild-plugin-pyproject, python3-all and python3-hatchling are right for two arch:all Python packages; test-only dependencies are in Build-Depends-Indep with <!nocheck>, as the rules run the suite at build time.- Every Build-Depends-Indep name I spot-checked exists in the archive: python3-protobuf 7.36.2-3/3.21.12-17, python3-opentelemetry-api/sdk/instrumentation 1.45.2/0.65b0, python3-httpx2 2.15.1-1, python3-inline-snapshot 0.36.0-2, python3-pydantic-handlebars 0.2.1-2, python3-pytest-examples 0.0.18-1, python3-beartype, python3-opentelemetry-instrumentation-aws-lambda and -aiohttp-server 0.65b0, python3-dirty-equals, python3-django, python3-sqlmodel.
debian/rules: dh_auto_build/dh_auto_install run pybuild once per sub-project with--name=logfire[-api]; the wheel contents are copied into .pybuild/dist-packages/build, which is the PYTHONPATH for the build-time tests, soimportlib.metadata.version('logfire')in logfire/version.py resolves. dh_auto_test is guarded by DEB_BUILD_OPTIONS=nocheck and dh skips overrides under nocheck at compat 14 anyway.debian/py3dist-overrideskeyopentelemetry_instrumentationnormalises toopentelemetry-instrumentationin dh-python's pydist loader, so the override works (and the fallback list already maps every other distribution name, so a nocheck build also gets its Depends).debian/tests/controland debian/tests/upstream-testsuite: the 18 integration modules listed in the script are the same 18 as LOGFIRE_INTEGRATION_TESTS in rules, and both ignore tests/test_variable_composition.py; the script copies only read-only inputs and writes under $AUTOPKGTEST_TMP, and runs pytest with -p no:cacheprovider.- All ten files in debian/patches/ are in series, each with From/Date/Subject, a Forwarded field and a reason; none of them changes runtime behaviour except support-old-protobuf-MessageToJson.patch, whose rationale is given in the patch and the changelog.
- debian/changelog is well-formed (5.2.0-1 initial, Closes: #1143122), distribution unstable, Maintainer/Uploaders consistent with debian/control; source format 3.0 (quilt); debian/gbp.conf, debian/upstream/metadata and debian/source/format are all sane.
- uscan found upstream releases with
debian/watch; a newer upstream version is available (upstream5.5.0, packaged5.2.0), which is not a fault of the package. - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- tests/test_variable_composition.py is excluded from both the build-time run and autopkgtest with no stated reason (debian/rules and debian/tests/upstream-testsuite are the only places it is mentioned; README.Debian documents every other exclusion). Its only non-base imports are pydantic_handlebars and logfire internals, and pydantic-handlebars is in Build-Depends-Indep; a test run would show whether it fails against Debian's pydantic-handlebars 0.2.1, which would itself matter for logfire.variables.
- debian/README.Debian's Docs section and the commented-out mkdocs blocks in debian/control and debian/rules still describe an MkDocs build with a missing pydantic_docs package, while upstream's Makefile says "Logfire docs are built by pydantic/unified-docs; this repo no longer runs MkDocs". Stale prose only; no doc package is built either way.
- debian/salsa-ci.yml disables the arch:all, arch:any and i386 build jobs and enables only the build-profiles job with BUILD_PROFILES=nocheck, so as far as I can tell no job runs the test suite or a non-nocheck build in CI; the README explains only the i386 job.
- I could not check the executable bit of debian/tests/upstream-testsuite (the file listings show no modes); if it is not executable autopkgtest would not run it.
Proposed changes ◂
None.
Review Information
accepted — allocated to awm 16 hours ago, started 16 hours ago, completed 16 hours ago.