DFSG NEW review for python-opentelemetry-contrib version 0.65b0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 2 found

Licensing

debian/copyright is in DEP-5 format and matches the tree. The catch-all is Apache-2.0; separate stanzas cover every file whose header names another holder (Amazon in sdk-extension/.../sampler/ and botocore bedrock.py, Google LLC in the GCP credential provider, gRPC authors in tests/protobuf/test_server.proto, Datadog in LICENSE.BSD3), and the later sampler/init.py + data/* stanza correctly overrides the Amazon stanza for the OTel-only files. The only non-Apache licence is BSD-3-clause on LICENSE.BSD3, its full text is reproduced, Apache-2.0 points at /usr/share/common-licenses; there are no non-free terms, no unexplained third-party code and no built artifacts without their sources. The two files the scan flagged are the upstream text changelog and an SQLite test fixture, neither a licensing problem.

Packaging

14 Architecture: all packages are built from the monorepo with debhelper compat 14, pybuild's --name staging each sub-project into its own debian/python3-, and dh_python3 generating the runtime dependencies; sibling dependencies are mapped in py3dist-overrides and the remaining ones resolve to packages in Build-Depends-Indep. Build/test dependencies, patches (DEP-3, applied, consistent order), autopkgtest blocks for every binary, changelog, Vcs-*, upstream metadata and Standards-Version are all in order, and the rules' test loop honours nocheck. No dependency names a package that does not exist, and no file or package split is missing.

Issues

None.

Verified

• Read every file under debian/ except debian/watch (excluded by the instructions): control, rules, changelog, copyright, gbp.conf, py3dist-overrides, README.Debian, salsa-ci.yml, source/{format,options,lintian-overrides}, tests/{control,run-unittests}, upstream/metadata and all five patches with series.
• Licensing inventory of the whole tree (1638 files, searches run with gitignore off): Copyright, (C), ©, SPDX-License-Identifier, GNU/Lesser/Mozilla Public, MIT/ISC/PSF wording, public domain, All rights reserved, non-commercial/no-derivative/field-of-use terms. Every SPDX tag is Apache-2.0; the only non-Apache licence is LICENSE.BSD3 (BSD-3-clause, Datadog).
• Holders found are each covered by a matching stanza: OpenTelemetry (catch-all), Amazon (sdk-extension/opentelemetry-sdk-extension-aws//sampler/ and botocore/extensions/bedrock.py, whose headers say Includes work from: Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.), Google LLC (exporter/opentelemetry-exporter-credential-provider-gcp/src/opentelemetry/gcp_credential_provider/init.py and tests/test_credential_provider.py), gRPC authors (instrumentation/opentelemetry-instrumentation-grpc/tests/protobuf/test_server.proto), Datadog (LICENSE.BSD3).
• Stanza patterns read with copyright-format 6.9 semantics: * matches at any depth and the last matching stanza wins, so sdk-extension/opentelemetry-sdk-extension-aws/*/sampler/* covers src/.../sampler and tests/trace/sampler, and the following .../sampler/__init__.py and tests/trace/sampler/data/* stanza lowers those OTel-only files to the OTel holder alone. The gRPC and Google stanzas match exactly the files that carry those notices.
• Licence files read or classified: root LICENSE and LICENSE.Apache (Apache-2.0), every per-subproject LICENSE copy (Apache-2.0), LICENSE.BSD3 (Datadog BSD-3), instrumentation-genai/opentelemetry-instrumentation-langchain/NOTICE (Apache-2.0 derivation from Traceloop OpenLLMetry). BSD-3 text is reproduced in full in debian/copyright; Apache-2.0 refers to /usr/share/common-licenses/Apache-2.0.
• No images, fonts, PDFs, built HTML, archives, .so/.pyc or similar in the tree (glob over those extensions, gitignore off); the only generated code, instrumentation/opentelemetry-instrumentation-grpc/tests/protobuf/test_server_pb2.py and _pb2_grpc.py, has its generator input tests/protobuf/test_server.proto in the tree.
• CHANGELOG.md: upstream towncrier-generated Markdown changelog (2708 lines, # Changelog plus release notes); no NUL bytes; the scan flagged it because some byte in the file is not valid UTF-8. It is text, not a build artifact, and is covered by the Files: * Apache-2.0 stanza.
• instrumentation/opentelemetry-instrumentation-sqlite3/tests/testdb: an SQLite database shipped upstream as test data; nothing in the tree references it (test_sqlite3.py uses sqlite3.connect(':memory:')). Covered by Files: *; it ships only in the source, since that instrumentation is not built by this package.
• Generated README/metapackage sources are present (scripts/generate_instrumentation_readme.py, scripts/generate_instrumentation_metapackage.py); docs/ holds only reStructuredText sources and conf.py, no built documentation.
• Build and test dependencies checked with apt-cache: python3-httpx2 2.15.1-1, python3-respx 0.22.0-3, python3-pytest-aiohttp 1.1.1-1, python3-opentelemetry-test-utils 1.45.1-2, python3-opentelemetry-api/semantic-conventions/sdk 1.45.1-2, python3-flask 3.1.3-4 (Depends python3-werkzeug) all exist; the 14 binary names of this source exist in no other package, so no Breaks/Replaces is needed.
• Install layout verified against the helper sources rather than assumed: /usr/share/dh-python/pybuild:284-286 sets destdir to debian/python3- when --name is given and no destdir option was passed, and /usr/share/perl5/Debian/Debhelper/Buildsystem/pybuild.pm omits --dest-dir when dh_auto_install's destdir is debian/tmp; debian/rules' loop therefore lands each sub-project in its own package directory, and dh_missing has no debian/tmp contents to complain about.
• Dependency generation checked in /usr/share/dh-python/dhpython/pydist.py: py3dist-overrides is <distribution> <Debian package> with an empty version range matching all interpreters, so the five entries map the sibling distributions (instrumentation, asgi, wsgi, propagator-aws-xray, util-http) to this source's binaries; the remaining Requires-Dist names resolve by dpkg -S to packages in Build-Depends-Indep (opentelemetry-api, semantic-conventions, wrapt, packaging, psutil).
• debian/rules package lists, debian/control Package stanzas and debian/tests/control Test-Command blocks agree on the same 14 packages, with no missing or extra entry.
• Patches: five files, all applied in the tree, DEP-3 headers with From/Author, Date, Subject/Description, Forwarded and a reason; the series order is consistent (skip-aiohttp-client-tests-for-newer-aiohttp's pre-image 447fb7d is skip-needing-http-server-mock's post-image).
• Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match); debhelper-compat 14 with dh-sequence-python3, dh_python3's ${python3:Depends} and ${misc:Depends} added by dh_gencontrol at that level, so no Depends field is needed in the stanzas that lack one.
• The build-test override checks DEB_BUILD_OPTIONS for nocheck itself and dh additionally skips dh_auto_test overrides at compat 13+, so a nocheck build runs no tests; the test loops collect failures and fail the build at the end.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.16.0, packaged 0.65b0), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• The contents of the binary SQLite fixture instrumentation/opentelemetry-instrumentation-sqlite3/tests/testdb were not inspected; only its role as unused test data is established.
• File modes could not be checked with the read-only tools, in particular that debian/tests/run-unittests is executable; a lintian run, done separately, would have covered that.
• The build and autopkgtest suites were not run: dependency completeness was established by reading dh_python3/pybuild/debhelper's code and the packages' pyproject files, not by a build.

Proposed changes

None.