Review: python-netmap 0.7.0.2-1

Package Information

Description	Python interface to the Nmap network scanner This library runs Nmap scans and parses their XML output to provide access to discovered hosts, port states, service versions, operating system matches and script results. It supports asynchronous scans with callbacks for each host and can export scan results in CSV format.
Maintainer	Home Assistant Team <team+homeassistant@tracker.debian.org>
Changed By	Edward Betts <edward@4angle.com>
Sponsor	edward@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/homeassistant-team/deps/python-netmap.git (browse)
Closes	#1153451
Tracker	https://tracker.debian.org/pkg/python-netmap
Uploaded	3 hours ago

New Package Report

.changes◂

Source	python-netmap
Version	0.7.0.2-1
Changed-By	Edward Betts <edward@4angle.com>
Architecture	all source
Distribution	unstable
Date	Sun, 08 Nov 2026 17:41:55 +0000

Changelog◂

python-netmap (0.7.0.2-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1153451)

.dsc◂

Component	main
Package-List	python3-netmap deb python optional arch=all
Section	python
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: netmap
Upstream-Contact: Alexandre Norman <norman@xael.org>
Source: https://github.com/home-assistant-libs/python-nmap

Files: *
Copyright: Alexandre Norman <norman@xael.org>
License: GPL-3+

Files: debian/*
Copyright: 2026 Edward Betts <edward@4angle.com>
License: GPL-3+


License: GPL-3+
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU General
 Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".

DFSG Assistant LLM REVIEW 1 blocker, 2 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for python-netmap version 0.7.0.2-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 1 blocker, 2 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The upstream code is a single GPL-3+ project: the headers of nmap/nmap.py, nmap/init.py, nmap/test_nmap.py, example.py, webpage.org and docs/conf.py all state 'GPL v3 or any later version' by Alexandre Norman, the licence text and the pointer to /usr/share/common-licenses/GPL-3 are present, and nothing in the tree carries non-free terms, so the licensing itself is DFSG-compliant. debian/copyright is DEP-5 with the correct Format URL, but it is not accurate for every file: gpl-3.0.txt is the GPL-3 text, Copyright 2007 FSF, and is swept into the catch-all Files: * stanza, which names Alexandre Norman and GPL-3+ instead. That is the holder the prescan reported, and it is a real (mechanical) inaccuracy.

Packaging

Mostly conventional packaging (compat 14, pybuild, DEP-5, valid Standards-Version 4.7.4, autodep8 pybuild testsuite), but the binary installs the top-level 'nmap' module, which the existing python3-nmap package (source python-nmap 0.7.1) already owns, and it declares no Replaces/Conflicts/Provides, so dpkg cannot unpack both. It also omits the runtime dependency on the nmap program it drives (PortScanner() raises without it), and debian/rules has two defects: dh_auto_build $@ hands pybuild an argument it rejects, and the Sphinx build runs even under the nodoc profile although sphinx is only a <!nodoc> build dependency.

Issues

Files: debian/copyright:6-8, gpl-3.0.txt:4
Basis: checked, in the package or with a reference tool
Evidence: gpl-3.0.txt:4: Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>, with changing it is not allowed (line 6). debian/copyright: Files: * / Copyright: Alexandre Norman <norman@xael.org> / License: GPL-3+.
Problem: Files: * matches every path in the source (copyright-format 1.0 section 6.9), so the shipped copy of the GNU GPL version 3 is described with the wrong copyright holder and with a licence it does not carry (the text permits only verbatim copying and modification is forbidden). The copyright file therefore does not accurately describe the copyright and licence of every file, as Policy section 12.5 requires. This is the FSF holder the prescan reported.
Fix:

Add a stanza for the licence text (position after Files: *), e.g.
```
Files: gpl-3.0.txt
Copyright: 2007 Free Software Foundation, Inc. <https://fsf.org/>
License: GPL-3+
```
Optionally add a Comment: noting that the document may only be copied verbatim.

important packaging 2. python3-netmap installs the top-level nmap module that python3-nmap already ships, with no Replaces/Conflicts ◂

Files: setup.py:58-67, debian/control:23-27
Basis: inferred from what was read, not seen directly
Evidence: setup.py: packages=['nmap'], and the module is imported as nmap (nmap/init.py, nmap/test_nmap.py). apt-cache show python3-nmap: Source: python-nmap, Version: 0.7.1-0.2, Description-en: Python3 interface to the Nmap port scanner; the source under review is that same library (nmap/nmap.py:3 Source code : https://bitbucket.org/xael/python-nmap), and the reviewing system even has nmap-stubs for module nmap. debian/control declares no Conflicts/Replaces/Provides.
Problem: Policy section 6.6: "It is an error for a package to contain files which are on the system in another package, unless Replaces is used." Both packages would own /usr/lib/python3/dist-packages/nmap/init.py and .../nmap/nmap.py, so installing python3-netmap over python3-nmap (or vice versa) makes dpkg refuse to unpack, and import nmap is served by two different Debian packages. Packaging a fork of an existing Debian library under a new source name without a transition is also a duplicate-source concern.
Fix: Either package the existing python-nmap source instead of the fork, or make this a proper replacement: add Replaces: python3-nmap, Breaks: python3-nmap (<< ...) and Provides: python3-nmap to python3-netmap and arrange with the python-nmap maintainers for that package to be removed/transitioned, so that only one binary owns nmap/.

important packaging 3. python3-netmap has no dependency on the nmap program it runs ◂

Files: debian/control:23-27, nmap/nmap.py:136-137
Basis: checked, in the package or with a reference tool
Evidence: nmap/nmap.py:136: raise PortScannerError(f"nmap program was not found in path. PATH is : {os.getenv('PATH')}") in PortScanner().init; the binary stanza in debian/control contains no Depends at all. Policy section 7.2: Depends is to be used when the depended-on package is "required for the depending package to provide a significant amount of functionality". The existing python3-nmap declares Depends: nmap.
Problem: The package's stated purpose is to run Nmap scans (debian/control Description: "This library runs Nmap scans and parses their XML output"); installed without the nmap package, PortScanner() raises immediately and even the XML-parsing helpers are only usable by passing data in. A user installing python3-netmap alone gets a library whose main function does not work.
Fix: Add Depends: nmap to the python3-netmap stanza (dh_gencontrol adds ${python3:Depends} itself at compat 14, so no substvar is needed). If parsing saved XML without nmap is meant to be a supported use, Recommends: nmap would be the minimum.

minor packaging 4. dh_auto_build $@ in debian/rules passes the target name override_dh_auto_build to pybuild ◂

Files: debian/rules:6
Basis: checked, in the package or with a reference tool
Evidence: debian/rules:6 dh_auto_build $@ --buildsystem=pybuild. In a recipe $@ is the target name. debhelper forwards non-option arguments to the build system (Dh_Buildsystems::buildsystems_do calls $buildsystem->$step(@_, @{$dh{U_PARAMS}}), and Dh_Getopt puts leftover arguments into U_PARAMS), while pybuild's parser defines no positional argument (dh-python, dhpython/build/options.py, build_parser).
Problem: The command becomes pybuild --build -i python{version} -p 3.x override_dh_auto_build --parallel=N; pybuild's argparse rejects the extra positional with "unrecognized arguments", so dh_auto_build exits non-zero and the build stops before the Sphinx step.
Fix: Remove $@: dh_auto_build --buildsystem=pybuild.

minor packaging 5. Sphinx documentation is built unconditionally although python3-sphinx and dh-sequence-sphinxdoc are restricted to <!nodoc> ◂

Files: debian/rules:6-7, debian/control:10, debian/control:16
Basis: checked, in the package or with a reference tool
Evidence: debian/rules:7 always runs sphinx-build -bhtml -d _build/doctrees . _build/html; debian/control:10 dh-sequence-sphinxdoc <!nodoc>, and :16 python3-sphinx <!nodoc>,. debhelper only skips override targets of dh_auto_test/dh_dwz/dh_strip for nocheck/nostrip; nothing skips override_dh_auto_build under nodoc (verified with the debhelper tool, compat 14).
Problem: With DEB_BUILD_OPTIONS=nodoc or DEB_BUILD_PROFILES=nodoc neither python3-sphinx nor dh-sequence-sphinxdoc is installed (the package itself declares that restriction), but dh still runs override_dh_auto_build, so sphinx-build is not found and the build fails. The nodoc restriction in Build-Depends therefore does not hold.

Fix:

Guard the doc build, e.g.

ifeq ($(filter nodoc,$(DEB_BUILD_OPTIONS) $(DEB_BUILD_PROFILES)),)
	cd docs; ... sphinx-build ...
endif

Verified ◂

debian/copyright read in full: DEP-5 with the exact Format URL; stanzas Files: * (Alexandre Norman, GPL-3+) and Files: debian/* (2026 Edward Betts, GPL-3+); the stand-alone License: GPL-3+ paragraph carries the v3-or-later boilerplate and points to /usr/share/common-licenses/GPL-3.
Licence evidence across the whole tree: nmap/nmap.py:24, nmap/init.py:24, nmap/test_nmap.py:33, example.py:9, webpage.org:153 and docs/conf.py:49 all state GPL v3 or later by Alexandre Norman, consistent with Files: *; no non-free wording (non-commercial, no-modification, field-of-use) anywhere in the tree.
gpl-3.0.txt is a verbatim copy of the GNU GPL version 3 (only referenced by setup.py's license=; not installed in the binary); its FSF copyright is the reported issue.
nmap.html is pydoc-generated HTML of nmap/nmap.py (its own header says version 0.6.4, so it is stale); its source is nmap/nmap.py in the package, it is not installed, and it is not a licensing problem.
webpage.org is the org-mode source of the upstream web page (its License section gives GPL-3+) and MANIFEST is a distutils-generated file list naming a setup.cfg that is not shipped; both are inert upstream files under the GPL-3+ stanza.
scanme_output-6.40.xml, scanme_output-7.01.xml, scanme_output-7.70.xml, scanme_output-7.91.xml, osmatch_output.xml and nmap_output.xml are nmap XML scan outputs used as fixtures by nmap/test_nmap.py (the last one only by example.py); no separate licence applies to them.
.github/workflows/pythonpublish.yml, .github/workflows/release-drafter.yml, .github/release-drafter.yml, docker/docker-precommit.yml, .flake8, .black, .flakehell.toml, .pre-commit-config.yaml, .gitignore, tox.ini, requirements.in and TODO are configuration/boilerplate with no separate copyright claim; they are covered by the GPL-3+ catch-all.
All files under debian/ read. Compat 14; Standards-Version 4.7.4 has the same first two components as Policy 4.7.4.1, so it is current; Testsuite: autopkgtest-pkg-pybuild is a real autodep8 test (/usr/share/autodep8/support/pybuild/generate). The binary stanza has no Depends field, which is correct at compat 14 (dh_gencontrol adds the substvars itself) apart from the missing nmap dependency reported above.
debian/pybuild.testfiles copies nmap/test_nmap.py to nmap/test_nmap.py under pybuild's build directory and the XML fixtures to its root, matching DATA_DIR = Path(__file__).parent.parent in the patched test file; debian/clean removes docs/_build/; debian/python3-netmap.docs installs README.rst and docs/_build/html, which matches the doc-base Index path.
debian/patches/dgit-changes is the whole Debian delta (nose to pytest conversion of nmap/test_nmap.py, tests marked skip for live scans) and is the only entry in series; no obsolete or unforwardable patch was found.
Coverage: all of debian/ read in full; headers and licence notices of every source file read and the whole tree grepped for copyright/licence wording; nmap/nmap.py read in part (header, PortScanner, scan); binary files and .pc/ were not opened.
uscan found the packaged version as the newest upstream release (upstream 0.7.0.2, packaged 0.7.0.2).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed ◂

No build could be run here; the dh_auto_build argument error at debian/rules:6 is derived from debhelper's and dh-python's own sources (non-option arguments go to U_PARAMS; pybuild defines no positional argument), not from a build log.
python3-nmap's file list is not visible through the tools used (apt-cache shows source, version and homepage only); that both packages own /usr/lib/python3/dist-packages/nmap/ is inferred from python3-nmap being the same xael/python-nmap library, as the reviewed sources state in nmap/nmap.py:3 and as the nmap-stubs package on the reviewing system implies.
Whether bug #1153451 closed by debian/changelog is the ITP for this package could not be checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 1 hour ago, started 1 hour ago, completed 1 hour ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Back to Dashboard | View all reviews for this package