Review: python-opentelemetry-contrib 0.66b2-1

Package Information

Description	OpenTelemetry Python Contrib documentation OpenTelemetry is an observability framework – an API, SDK, and tools that are designed to aid in the generation and collection of application telemetry data such as metrics, logs, and traces. This package contains the API reference of the OpenTelemetry Python Contrib packages that are available in Debian: the base instrumentation package, the instrumentations and the AWS X-Ray propagator.
Maintainer	Debian Python Team <team+python@tracker.debian.org>
Changed By	Pieter Lenaerts <plenae@disroot.org>
Sponsor	zigo@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/python-team/packages/python-opentelemetry-contrib.git (browse)
Popcon Installs	6
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/python-opentelemetry-contrib
Uploaded	5 days ago

New Package Report

.changes◂

Changed-By	Pieter Lenaerts <plenae@disroot.org>
Architecture	source all
Distribution	unstable
Date	Sun, 01 Nov 2026 19:16:15 +0100
Source	python-opentelemetry-contrib
Version	0.66b2-1

Changelog◂

python-opentelemetry-contrib (0.66b2-1) unstable; urgency=medium
 .
   * d/watch: ignore the old 1.16.0 tag.
   * New upstream version 0.66b2
   * d/patches: rebase to 0.66b2
   * d/README.Debian: add rationale for autopkgtest structure
   * Generate manual pages for opentelemetry-bootstrap and
     opentelemetry-instrument with help2man.
   * Build the python-opentelemetry-contrib-doc package, following
     python-opentelemetry-doc.
   * d/salsa-ci.yml: enable the nodoc and nocheck,nodoc build profile tests

.dsc◂

Component	main
Package-List	python-opentelemetry-contrib-doc deb doc optional arch=all python3-opentelemetry-instrumentation deb python optional arch=all python3-opentelemetry-instrumentation-aiohttp-client deb python optional arch=all python3-opentelemetry-instrumentation-aiohttp-server deb python optional arch=all python3-opentelemetry-instrumentation-asgi deb python optional arch=all python3-opentelemetry-instrumentation-aws-lambda deb python optional arch=all python3-opentelemetry-instrumentation-django deb python optional arch=all python3-opentelemetry-instrumentation-fastapi deb python optional arch=all python3-opentelemetry-instrumentation-flask deb python optional arch=all python3-opentelemetry-instrumentation-httpx deb python optional arch=all python3-opentelemetry-instrumentation-requests deb python optional arch=all python3-opentelemetry-instrumentation-system-metrics deb python optional arch=all python3-opentelemetry-instrumentation-wsgi deb python optional arch=all python3-opentelemetry-propagator-aws-xray deb python optional arch=all python3-opentelemetry-util-http deb python optional arch=all
Section	doc
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/open-telemetry/opentelemetry-python-contrib/
Upstream-Name: OpenTelemetry Python Contrib
Upstream-Contact: OpenTelemetry Contributors <cncf-opentelemetry-contributors@lists.cncf.io>

Files:
 *
Copyright:
 The OpenTelemetry Authors
License: Apache-2.0

Files:
 sdk-extension/opentelemetry-sdk-extension-aws/*/sampler/*
 instrumentation/opentelemetry-instrumentation-botocore/src/opentelemetry/instrumentation/botocore/extensions/bedrock.py
Copyright:
 The OpenTelemetry Authors
 Amazon.com, Inc. or its affiliates. All Rights Reserved.
License: Apache-2.0

Files:
 sdk-extension/opentelemetry-sdk-extension-aws/*/sampler/__init__.py
 sdk-extension/opentelemetry-sdk-extension-aws/tests/trace/sampler/data/*
Copyright:
 The OpenTelemetry Authors
License: Apache-2.0

Files:
 exporter/opentelemetry-exporter-credential-provider-gcp/src/opentelemetry/gcp_credential_provider/__init__.py
 exporter/opentelemetry-exporter-credential-provider-gcp/tests/test_credential_provider.py
Copyright:
 2023, 2025 Google LLC
License: Apache-2.0

Files:
 instrumentation/opentelemetry-instrumentation-grpc/tests/protobuf/test_server.proto
Copyright:
 2019 gRPC authors.
License: Apache-2.0

Files:
 LICENSE.BSD3
Copyright:
 2016 Datadog <info@datadoghq.com>
License: BSD-3-clause

Files:
 debian/*
Copyright:
 2026 Pieter Lenaerts <plenae@disroot.org>
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
     * Redistributions of source code must retain the above copyright
       notice, this list of conditions and the following disclaimer.
     * Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in the
       documentation and/or other materials provided with the distribution.
     * Neither the name of Datadog nor the
       names of its contributors may be used to endorse or promote products
       derived from this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL DATADOG BE LIABLE FOR ANY
 DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 5 days ago.

Report◂

DFSG NEW review for python-opentelemetry-contrib version 0.66b2-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 1 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 1 found

Licensing

debian/copyright is DEP-5, its Format line is the 1.0 URL, and it describes the tree accurately apart from one gap: every file is Apache-2.0 (The OpenTelemetry Authors) except the root LICENSE.BSD3 (Datadog, BSD-3-Clause), the Amazon.com files in the AWS sampler and botocore bedrock extension, the two Google LLC files of the gcp credential provider and the gRPC test .proto, and each of those has the right stanza. The Files: patterns, including the override stanza for sampler/__init__.py and tests/trace/sampler/data/*, match what the files themselves say. The defect is the protobuf-generated modules of the OpAMP client and the Prometheus remote-write exporter: they were generated from .proto files that the generation scripts clone from three other repositories and that are not in the tarball, so their source form and their copyright are not in the package, and the blanket Apache-2.0 claim for them cannot be checked. Nothing here is non-free and no binary package contains them, so the rest of the licensing is sound.

Packaging

The packaging is careful and unusually well documented: one sub-project per binary package built through pybuild --name, dependencies generated by dh_python3 with a small py3dist-overrides, DEP-3 patches with Forwarded fields, one autopkgtest per binary, a sphinxdoc package built like python-opentelemetry's, help2man man pages, and a README.Debian that explains the structure and its limits. Build-dependency names, compat level 14, Standards-Version 4.7.4 (Policy here is 4.7.4.1), the changelog and the descriptor all check out. The only defect is that debian/rules looks for nodoc in DEB_BUILD_OPTIONS while the build-dependencies are gated on the nodoc build profile, so a profile-aware build runs help2man and the test suites without the packages those gates remove.

Issues

important licensing 1. Generated protobuf modules of the OpAMP client and the Prometheus remote-write exporter have no .proto sources in the tarball ◂

Files: opamp/opentelemetry-opamp-client/src/opentelemetry/_opamp/proto/opamp_pb2.py, opamp/opentelemetry-opamp-client/src/opentelemetry/_opamp/proto/anyvalue_pb2.py, opamp/opentelemetry-opamp-client/src/opentelemetry/_opamp/proto/opamp_pb2.pyi, opamp/opentelemetry-opamp-client/src/opentelemetry/_opamp/proto/anyvalue_pb2.pyi, exporter/opentelemetry-exporter-prometheus-remote-write/src/opentelemetry/exporter/prometheus_remote_write/gen/remote_pb2.py, exporter/opentelemetry-exporter-prometheus-remote-write/src/opentelemetry/exporter/prometheus_remote_write/gen/types_pb2.py, exporter/opentelemetry-exporter-prometheus-remote-write/src/opentelemetry/exporter/prometheus_remote_write/gen/gogoproto/gogo_pb2.py, scripts/opamp_proto_codegen.sh:49, exporter/opentelemetry-exporter-prometheus-remote-write/proto/generate-proto-py.sh:17,28,36,54
Basis: checked, in the package or with a reference tool
Evidence: opamp_pb2.py:2-3 says # Generated by the protocol buffer compiler. DO NOT EDIT! / # source: opamp.proto, and gogo_pb2.py:3 # source: opentelemetry/exporter/prometheus_remote_write/gen/gogoproto/gogo.proto. The generators fetch the inputs: git clone https://github.com/open-telemetry/opamp-spec.git (opamp_proto_codegen.sh:49, pinned to v0.12.0), git clone ... https://github.com/prometheus/prometheus.git and git clone ... https://github.com/gogo/protobuf.git, then protoc -I . --python_out=../src .../gogoproto/gogo.proto .../remote.proto .../types.proto (generate-proto-py.sh:17,28,54). The only *.proto in the whole source is instrumentation/opentelemetry-instrumentation-grpc/tests/protobuf/test_server.proto.
Problem: These modules are not written, they are compiled from .proto definitions that live in three other projects and are absent here, so the source package does not carry the preferred form for modifying them and cannot regenerate them (DFSG, Social Contract point 2: the source must be included). It also means the Files: * stanza's License: Apache-2.0 cannot be checked for these files: their input comes from prometheus/prompb, open-telemetry/opamp-spec and gogo/protobuf, and the licence of the gogo.proto input is stated nowhere in the package. No binary package in this source installs these modules (opamp and the remote-write exporter are not built), so installed files are unaffected, but the tarball that is uploaded contains them.
Fix: Either add the .proto files the scripts use (opamp-spec v0.12.0, prometheus prompb v2.39.0, gogoproto/gogo.proto v1.3.2) to the package, with their copyright holders and licences added to debian/copyright, and regenerate the _pb2.py/_pb2.pyi from them; or repack the orig tarball to exclude opamp/ and exporter/opentelemetry-exporter-prometheus-remote-write/, which build no binary package here.

minor packaging 2. debian/rules tests DEB_BUILD_OPTIONS for nodoc while debian/control gates help2man and the test dependencies on the nodoc build profile ◂

Files: debian/rules:100, debian/rules:169, debian/control:8, debian/control:9, debian/control:28, debian/control:29
Basis: checked, in the package or with a reference tool
Evidence: ifeq (,$(filter nodoc,$(DEB_BUILD_OPTIONS))) guards the help2man calls at debian/rules:100-122, while debian/control:9 says help2man <!nodoc>, debian/control:8 dh-sequence-sphinxdoc <!nodoc> and debian/control:28-29 python3-opentelemetry-api <!nocheck> <!nodoc>, python3-opentelemetry-sdk <!nocheck> <!nodoc>. dpkg-buildpackage(1) lists the DEB_BUILD_OPTIONS options it knows (parallel, nocheck, noopt, nostrip, terse, ...), none of which is nodoc; build profiles are passed separately in DEB_BUILD_PROFILES / -P.
Problem: With the nodoc build profile active (dpkg-buildpackage -P nodoc, or sbuild -P nodoc which installs only the dependencies the profile leaves enabled), debian/rules still enters the man-page block and runs help2man, which debian/control:9 has just excluded from the build dependencies, and the test loop still runs without python3-opentelemetry-api/sdk, which debian/control:28-29 exclude under the same profile. The profile therefore cannot be built profile-aware, although debian/salsa-ci.yml enables a nodoc build-profile test. README.Debian's statement that the pages are skipped when nodoc is active only holds for DEB_BUILD_OPTIONS=nodoc.
Fix: Test the profile as well, e.g. ifneq (,$(filter nodoc,$(DEB_BUILD_OPTIONS) $(DEB_BUILD_PROFILES))) around both blocks (and mark it so under nocheck too), or let debhelper's profile handling decide and drop the make-level test: keep python3-opentelemetry-api/sdk out of <!nodoc> since the test suites need them.

Verified ◂

Read debian/ in full: control, rules, changelog, copyright, README.Debian, gbp.conf, salsa-ci.yml, py3dist-overrides, source/{format,options,lintian-overrides}, upstream/metadata, tests/{control,run-unittests}, doc-base, the manpages file, help2man-wrapper and both .h2m files, and all nine patches with debian/patches/series.
debian/copyright is DEP-5: Format is the 1.0 URL, Source/Upstream-Name/Upstream-Contact present, seven Files stanzas (catch-all, AWS sampler + botocore bedrock, the sampler override, Google, gRPC, LICENSE.BSD3, debian/*), Apache-2.0 by pointer to /usr/share/common-licenses/Apache-2.0, BSD-3-clause with its full text. No Files-Excluded, correct for a pristine tarball.
Holders checked against the tree: Copyright The OpenTelemetry Authors + SPDX-License-Identifier: Apache-2.0 is the header of essentially every source file; the root LICENSE and the LICENSE file of each of the ~60 sub-projects are all Apache-2.0 (only LICENSE.BSD3 is BSD-3-Clause, Datadog, a leftover of the removed Datadog exporter; no file in the tree is BSD-3).
Amazon: the twelve sdk-extension/opentelemetry-sdk-extension-aws/src/.../trace/sampler/*.py and the matching tests/trace/sampler/*.py carry Copyright Amazon.com, Inc. or its affiliates, and instrumentation/opentelemetry-instrumentation-botocore/src/.../extensions/bedrock.py says Includes work from: Copyright Amazon.com...; all are matched by the second stanza. sampler/__init__.py and tests/trace/sampler/data/*.json carry only the OpenTelemetry notice, so the third stanza that overrides them is right. No other file names Amazon.
Google: only exporter/opentelemetry-exporter-credential-provider-gcp/src/.../gcp_credential_provider/__init__.py (Copyright 2025 Google LLC) and tests/test_credential_provider.py (Copyright 2023 Google LLC), both matched by the Google stanza.
gRPC: instrumentation/opentelemetry-instrumentation-grpc/tests/protobuf/test_server.proto (Copyright 2019 gRPC authors, Apache-2.0) is the only .proto in the tree and is matched by its own stanza; its generated test_server_pb2.py/_pb2_grpc.py therefore have their input in the package.
Prescan binary instrumentation/opentelemetry-instrumentation-sqlite3/tests/testdb: a SQLite 3 database (8 KB, magic SQLite format 3), an upstream binary test fixture. Nothing in the package opens it (test_sqlite3.py connects to :memory:), the Debian build does not create it, it carries no licence header and is covered by the Files: * Apache-2.0 stanza. Its contents were not inspected; it ships in no binary package (the sqlite3 instrumentation is not built).
No other build products: no .pyc/.so/.whl/archives/PDFs, no images or fonts (the docs patches remove the remote badge images), no minified JS/CSS; the only HTML files are jinja2 test templates. uv.lock and the generated test-requirements*.txt are text.
No non-free wording: grep for non-commercial/NonCommercial/NoDerivatives/Good, not Evil/public domain/All rights reserved/CC BY/GPL/LGPL/MPL over the tree finds nothing but the Datadog BSD notice and the Apache licence texts. The OpenAI/AWS cassettes under instrumentation-genai and botocore are recorded test data, not licence terms.
Packaging: debian/control has 15 Arch: all binaries and debian/rules builds 14 sub-projects plus the docs; the sets match. pybuild's --name staging into debian/python3-<name> was confirmed in /usr/share/dh-python/pybuild (destdir = debian/ when --name is given), and dh_installman's nodoc handling in /usr/bin/dh_installman and the debhelper tool.
Build-Depends names checked against the archive: python3-httpx2 2.15.1-1, python3-respx 0.22.0-3, python3-pytest-aiohttp 1.1.1-1, python3-sphinx-autodoc-typehints 3.13.7-1, python3-sphinx-rtd-theme 3.1.0+dfsg-4, python-aiohttp-doc, python-wrapt-doc, python-opentelemetry-doc, python3-doc 3.14.8-1 and python3-opentelemetry-test-utils 1.45.1-2 all exist; the python3-opentelemetry-instrumentation* dependencies are binaries of this source.
Standards-Version 4.7.4 against Policy 4.7.4.1 is current; debhelper-compat (= 14) with dh-sequence-python3 and dh-sequence-sphinxdoc is the recommended level; Vcs-Git/Vcs-Browser point at salsa; the changelog is unstable, 0.66b2-1, with a correct date and a Closes in the initial entry.
Patches: nine patches, all with From/Date/Subject, a description body and a Forwarded field (one is Thomas Goirand's and says Forwarded: yes); they skip tests needing unpackaged modules (mocket, http_server_mock) with importorskip/skipif, skip four aiohttp-version tests and nine FastAPI tests, relax a whole-millisecond duration assertion, and replace the remote badge images and intersphinx URLs with local resources. None is obsolete against 0.66b2.
Autopkgtest: one Test-Command per binary running debian/tests/run-unittests on a copy of the sub-project's tests with every supported python3, with the instrumented frameworks in Depends; doc-base, the sphinxdoc package's Section/Multi-Arch and the ${sphinxdoc:Depends} use are correct.
python3-opentelemetry-util-http's hand-written Depends (python3-opentelemetry-instrumentation, python3-wrapt) is justified: its pyproject.toml declares no dependencies, and its httplib module imports both; the comment in debian/control says so.
uscan found the packaged version as the newest upstream release (upstream 0.66b2, packaged 0.66b2).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Sphinx is not installed on the review system, so I could not confirm that the sphinx HTML builder writes html/.nojekyll; debian/rules:155 removes that file without -f, so a sphinx that does not write it would fail the build there.
The licences of the .proto files behind the generated protobuf modules (opamp-spec, prometheus/prompb, gogo/protobuf) are not in the package and I may not fetch them; only the files' own absence from debian/copyright was checked.
The contents of instrumentation/opentelemetry-instrumentation-sqlite3/tests/testdb were not inspected (binary file, unreadable as text).

Proposed changes ◂

None.

Uploader's response to the LLM review

Hi,

For the first issue it looks like the LLM is right. There are .proto files missing.

Going forward:

I think it is easiest that I ask upstream to ship them again. They stopped doing so at some point. That will take a while.
Alternative would be to add extra sources, but one of them is rather big.

Do you agree with my proposed actions or do you have better suggestions? Do you agree to upload this while we wait for 1) before we decide to do 2)? How do you keep track of this? Should I open a bug? Should it be important?

The second reported issue looks like a false positive.

Br,

Pieter

— Pieter Lenaerts (plenae), 5 days ago

Review Information

accepted — allocated to eamanu 4 days ago, started 4 days ago, completed 4 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.65b0-1	9a5a0f4c…	2026-10-29 08:12	2026-10-29 08:13	awm	accepted	VIEW

Back to Dashboard | View all reviews for this package