DFSG NEW review for python-newspaper version 0.2.8-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All source is free: the newspaper modules and data carry MIT (Expat) by Lucas Ou-Yang 2013/2014, mislabelled only parsers.py and extractors.py as python-goose-derived Apache-2.0 (Xavier Grangier), and resources/text stopword lists are attributed to the Apache Software Foundation under Apache-2.0. debian/copyright is in valid DEP-5 (Format: 1.0) with complete Expat text and Apache-2.0 referred to common-licenses. Both licences are DFSG-free and compatible. No minified, compiled, or binary files; no Files-Excluded needed. One minor under-attribution of further goose-derived modules is noted.

Packaging

Clean, modern single-binary python-pure package: debhelper compat 14 via Build-Depends, dh-sequence-python3/pybuild with PYBUILD_SYSTEM=pyproject, Architecture all, Standards-Version 4.7.4, sane patch set with DEP-3 headers (icu substitution for tinysegmenter; distutils drop), py3dist-overrides mapping jieba3k to python3-jieba. Explicit Depends on python3-lxml-html-clean and python3-icu are the two modules dh_python3 cannot map; the rest of the runtime closure (bs4, lxml, requests, feedparser, tldextract, PIL, nltk, jieba, dateutil) is added by dh_python3 at compat 14. Only a Vcs-Browser URL typo.

Issues

1. [minor] [licensing] Goose-derived modules covered only by the Expat catch-all

• Files: debian/copyright (Files: * stanza), newspaper/cleaners.py, newspaper/outputformatters.py, newspaper/videos/extractors.py
• Basis: inferred from what was read, not seen directly
• Evidence: parsers.py header states 'Newspaper uses a lot of python-goose's parsing code...'; cleaners.py (DocumentCleaner) and outputformatters.py (OutputFormatter) and videos/extractors.py (VideoExtractor) mirror the python-goose class/API structure exactly, yet debian/copyright attributes only parsers.py and extractors.py as goose-derived Apache-2.0 and lets the others fall under Files: * ... 2013 Lucas Ou-Yang Expat.
• Problem: If these modules are derived from python-goose (Apache-2.0, as the structure strongly suggests), their holder/licence in debian/copyright should attribute Grangier/ASF under Apache-2.0 rather than Lucas Ou-Yang/Expat. Not a DFSG problem (Apache-2.0 is free), but a copyright-accuracy risk. I could not confirm goose origin against external source.
• Fix: Extend the goose-derived Apache-2.0 stanza (or add a Comment) to cover cleaners.py, outputformatters.py and videos/extractors.py, or verify they are original work.

2. [minor] [packaging] Vcs-Browser URL misspells package name

• Files: debian/control
• Basis: checked, in the package or with a reference tool
• Evidence: Vcs-Browser: https://salsa.debian.org/python-team/packages/python3-newpaper while Vcs-Git uses python3-newspaper.git.
• Problem: Vcs-Browser points to a non-existent page (missing 's' in 'newspaper'); the repository link is dead.
• Fix: Change to .../packages/python3-newspaper.

Verified

• Prescan: author-check scanned 74 files; every holder found is named in debian/copyright; no built/minified/binary files flagged.
• debian/copyright is valid DEP-5 with Format 1.0; Files: * (Expat), Files: newspaper/parsers.py newspaper/extractors.py (Apache-2.0, Grangier), Files: newspaper/resources/text/* (ASF 2001-2025, Apache-2.0), debian/* (Expat); full Expat text and Apache-2.0 -> /usr/share/common-licenses included.
• All newspaper/.py and newspaper/videos/.py carry __copyright__ = 'Copyright 2014, Lucas Ou-Yang' with MIT header; LICENSE is MIT 2013 Lucas Ou-Yang (year drift is minor). Covered by Files: * Expat.
• Of the stopword files, only resources/text/stopwords-fr.txt carries the ASF Apache header; the others are word lists without headers but are all attributed to ASF/Apache-2.0 (maintainer assertion for Lucene/Snowball origin).
• resources/misc (useragents.txt, google_sources.txt, popular_sources.txt, stopwords-nlp-en.txt) are plain word/string data, free.
• Whole tree enumerated (gitignore:false, hidden:true): only upstream files plus .egg-info sdist metadata; no minified JS/CSS, .jar, .pyc, firmware, or generated-code-without-source.
• Expat and Apache-2.0 are both DFSG-free and compatible when combined.
• requirements.txt extra deps (PyYAML, feedfinder2, tinysegmenter) are not imported anywhere in newspaper/; jieba3k and tinysegmenter are handled by py3dist-overrides and the icu patch respectively, so no Build/Depends gap.
• Patches applied: replace-tinysegmenter-by-icu.patch and drop-distutils.patch, both with DEP-3 headers; Build-Depends include the needed python3-icu (Depends present) and the removed tinysegmenter is not required.
• Binary Depends lists only python3-lxml-html-clean and python3-icu (the two modules dh_python3 cannot map); at compat 14 the remaining runtime closure comes from ${python3:Depends}/${misc:Depends} substvars automatically.
• uscan found the packaged version as the newest upstream release (upstream 0.2.8, packaged 0.2.8).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Whether cleaners.py/outputformatters.py/videos/extractors.py are actually derived from python-goose (and so Apache-2.0) or are original work - external goose source was not read; reported as minor above on structural evidence.

Proposed changes

None.