python-orfdata 0.52.0+ds1-1
Package Information
| Description | command-line tools for ORF catalogues and proteomes orfdata builds protein references from annotated proteins and noncanonical open reading frames (ORFs) supported by ribosome profiling or mass spectrometry. It retains the source, genomic coordinates, transcript association and evidence for each ORF. This package provides the orfdata command for evidence filtering, sequence export, reference proteome construction, coordinate liftover and access to species-specific RNA, ribosome and protein measurement datasets. |
|---|---|
| Maintainer | Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org> |
| Changed By | Steffen Moeller <moeller@debian.org> |
| Sponsor | moeller@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/med-team/python-orfdata.git (browse) |
| Closes | #1151088 |
| Tracker | https://tracker.debian.org/pkg/python-orfdata |
| Uploaded | 2 hours ago |
New Package Report
.changes
| Source | python-orfdata |
|---|---|
| Version | 0.52.0+ds1-1 |
| Changed-By | Steffen Moeller <moeller@debian.org> |
| Architecture | source all |
| Distribution | unstable |
| Date | Sat, 14 Nov 2026 22:42:33 +0100 |
Changelog
python-orfdata (0.52.0+ds1-1) unstable; urgency=medium
.
* Initial release (Closes: #1151088).
* Drop pyensembl-reference-metadata.patch: upstream now handles reference
strain taxonomy and current PyEnsembl assembly metadata, with regression
coverage for species, strain and reference validation.
* Check reference-table text columns with pandas is_string_dtype so the
schema test works with both pandas 2 and pandas 3 string storage..dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | orfdata deb science optional arch=all python3-orfdata deb python optional arch=all |
| Section | science |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/openvax/orfdata
Upstream-Name: orfdata
Upstream-Contact: OpenVax <https://github.com/openvax/orfdata/issues>
Files-Excluded:
orfdata.egg-info/*
tests/data/openprot/*.zip
tests/data/peptideatlas/atlas_build.tsv.zip
Files: *
Copyright: 2026 OpenVax contributors
License: Apache-2.0
Files: orfdata/data/orf-evidence/*
orfdata/data/uorf-evidence/*
Copyright: 2025 Leron Kok
2026 Aaron Wacholder and the community assessment authors
2026 OpenVax contributors
License: Apache-2.0 and Expat and CC-BY-4.0 and Ensembl
Comment:
The GENCODE models and HLA mapping/count data are from
https://github.com/VanHeeschLab/deutsch_kok_et_al_2024 at commit
b65ae0c09a53e9efe083d806d617581e6139bdde (Expat).
Community spectrum reviews are from the version 1 dataset at
https://doi.org/10.6084/m9.figshare.30131869.v1 (CC-BY-4.0).
Initiation-context sequences are from Ensembl release 101.
OpenVax selected models, normalized coordinates and source metadata,
joined peptide observations and reviews, calculated peptide intervals
and extracted initiation-context sequences. The distributed NOTICE.txt
and manifest.json files retain attribution, checksums and changes.
Files: orfdata/data/ires/*
Copyright: 2026 Rfam contributors
License: CC0-1.0
Comment:
Human IRES seed sequences from Rfam 15.1, selected and merged by OpenVax.
Source attribution and checksums are embedded in the JSON resource.
Files: orfdata/data/viral/*
tests/data/viral/*
Copyright: NCBI and the submitters of RefSeq NC_001526.4
License: NCBI
Comment:
OpenVax extracted nine CDS annotations and reference sequences from
NC_001526.4 and added native and GDC placements. The source record is
retained in tests/data/viral/NC_001526.4.gb.gz. Attribution, changes and
checksums are recorded in orfdata/data/viral/NOTICE.md.
Files: tests/data/copy/*
Copyright: 2016 Lawless et al.
License: CC-BY-4.0
Comment:
Selected supplemental data from https://doi.org/10.1074/mcp.M115.054288.
GEO RNA data and source metadata are subject to the NCBI terms below.
OpenVax selected table rows and retained the complete RNA worksheet and
calibration FASTA; changes and attribution are in NOTICE.md.
Files: tests/data/wang/*
Copyright: 2019 Wang et al.
License: CC-BY-4.0 and Ensembl
Comment:
Selected source cells from https://doi.org/10.15252/msb.20188503,
re-encoded as small workbooks by OpenVax, plus Ensembl 83 reference
records. NOTICE.md and expected.json retain attribution and changes.
Files: tests/data/pfizer/*
tests/data/kaabinejadian/*
Copyright: 2026 Oziolor et al.
2026 Kaabinejadian et al.
License: CC0-1.0
Comment:
Selected numeric data from MassIVE MSV000099729, MSV000099754 and
MSV000099744, and PRIDE PXD074485, respectively. The original deposits
are CC0. Original row numbers and source hashes are recorded in the
fixtures; NOTICE.md or README.md records the selection.
Files: tests/data/pfizer/*/search.fasta
tests/data/search_reference/dog.fasta
Copyright: UniProt Consortium
License: CC-BY-4.0
Comment:
Unchanged native UniProt FASTA records selected by OpenVax from
the deposited search references. See the adjacent NOTICE.md files.
Files: tests/data/ingolia/*
tests/data/regions/*
tests/data/pfizer_rna/*
Copyright: 2009 Ingolia et al.
2026 Oziolor et al.
License: NCBI
Comment:
Factual slices from GEO GSE13750 and GSE325522/GSE325523/GSE325525.
The Pfizer sample workbook is a newly encoded container of factual
sample rows; the original article supplement is not redistributed.
Ensembl annotation slices retain the Ensembl terms below.
NOTICE.md and fixture manifests record sources and transformations.
Files: tests/data/ncorf_mammals/S3.xlsx
tests/data/riborf/SD3.xlsx
Copyright: 2025 Chang et al.
2024 Yang et al.
License: CC-BY-4.0
Comment:
Selected supplemental rows from https://doi.org/10.7554/eLife.109128
and https://doi.org/10.1038/s41467-024-46240-9, respectively.
OpenVax re-encoded the selected rows; adjacent README.md files retain
source attribution and document the selections.
Files: tests/data/ncorf_mammals/*.bed
tests/data/ncorf_mammals/*.pep.fa
Copyright: 2025 Chang et al.
License: Expat
Comment:
Selected ORFs from https://github.com/gxelab/ncorf_mammals at commit
9a7baa318fd53f4faf7fa8fe0030e1e2b0d44ee0 (MIT License).
Files: tests/data/references/*.json
tests/data/*/ensembl*.gz
tests/data/ncorf_mammals/*ensembl*.gz
tests/data/riborf/*ensembl*.gz
tests/data/pfizer_rna/*annotation.gtf.gz
tests/data/wang/annotation.gtf.gz
Copyright: Ensembl/EMBL-EBI and the original data contributors
License: Ensembl
Comment:
Small canonical sequence and annotation slices; source URLs and checksums
are retained in the fixtures and adjacent README.md or NOTICE.md files.
The reference JSON files also contain source facts and OpenVax metadata.
Files: debian/*
Copyright: 2026 Steffen Moeller <moeller@debian.org>
License: Apache-2.0
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Comment:
On Debian systems, the complete text of the Apache version 2.0 license
can be found in "/usr/share/common-licenses/Apache-2.0".
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
License: CC-BY-4.0
On Debian systems, the complete text of the Creative Commons Attribution
4.0 International license can be found in
"/usr/share/common-licenses/CC-BY-4.0".
License: CC0-1.0
On Debian systems, the complete text of the Creative Commons CC0 1.0
Universal license can be found in "/usr/share/common-licenses/CC0-1.0".
License: Ensembl
Ensembl imposes no restrictions on access to, or use of, the data provided
and the software used to analyse and present it. Ensembl data generated by
members of the project are available without restriction.
Comment:
https://www.ensembl.org/info/about/legal/disclaimer.html
License: NCBI
Databases of molecular data on the NCBI Web site include such examples
as nucleotide sequences (GenBank), protein sequences, macromolecular
structures, molecular variation, gene expression, and mapping data. They
are designed to provide and encourage access within the scientific
community to sources of current and comprehensive information. Therefore,
NCBI itself places no restrictions on the use or distribution of the
data contained therein. Nor do we accept data when the submitter has
requested restrictions on reuse or redistribution. However, some
submitters of the original data (or the country of origin of such data)
may claim patent, copyright, or other intellectual property rights in
all or a portion of the data (that has been submitted). NCBI is not in
a position to assess the validity of such claims and since there is
no transfer of rights from submitters to NCBI, NCBI has no rights to
transfer to a third party. Therefore, NCBI cannot provide comment or
unrestricted permission concerning the use, copying, or distribution
of the information contained in the molecular databases.
Comment:
https://www.ncbi.nlm.nih.gov/home/about/policies/
DFSG Assistant LLM REVIEW 3 blocker, 0 important, 4 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 1 hour ago.
Report
DFSG NEW review for python-orfdata version 0.52.0+ds1-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 3 blocker, 0 important, 4 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 122 found, 13 not mentioned in this report (43 not listed by the scan, so not checked)
Licensing
debian/copyright is DEP-5, and the upstream code, tests, tools and docs are genuinely Apache-2.0 (top-level LICENSE), with most bundled data groups given their own stanzas and the NC/ND sources excluded. But Files: * (OpenVax contributors, Apache-2.0) sweeps in third-party data that no later stanza reaches: the Ensembl 115 rCRS records that are installed into python3-orfdata, and five groups of test fixtures that are Ensembl, GENCODE, GenBank/RefSeq, UCSC or GEO/PRIDE. UniProt CC-BY-4.0 data is further labelled Ensembl and CC0-1.0, and the UniProt Consortium is not named for it. No DFSG-violating terms and no unlicensed file were found.
Packaging
The packaging is conventional and in good shape: debhelper 13 with pybuild, a shared pytest argument file used by both the build and autopkgtest, a correct script/library split with Breaks/Replaces, a DEP-3 patch forwarded upstream, autopkgtests for the library and for the command, Vcs-* fields and upstream/metadata, Standards-Version 4.7.4 against Policy 4.7.4.1. The remaining faults are minor: two test imports are not in Build-Depends, the manual page carries the old 0.34.0 version, and the changelog keeps a 0.34.0 entry below an entry that calls itself the initial release.
Issues
blocker licensing 1. Files: * claims Apache-2.0 and OpenVax copyright for the Ensembl 115 rCRS records installed into the binary package ◂
- Files:
debian/copyright:10-12,orfdata/data/genomes/rcrs-ensembl115.cdna.fa.gz,orfdata/data/genomes/rcrs-ensembl115.gtf.gz,orfdata/data/genomes/rcrs-ensembl115.pep.fa.gz,tools/build_rcrs_mitochondrion.py:9-13 - Basis: checked, in the package or with a reference tool
- Evidence: debian/copyright:
Files: */Copyright: 2026 OpenVax contributors/License: Apache-2.0; tools/build_rcrs_mitochondrion.py: "This copies Ensembl GRCh38 release 115's MT records (37 genes...) and names the contigNC_012920.1". - Problem: The three files are Ensembl 115 GTF/cDNA/peptide records, and they are shipped: pyproject.toml lists
"data/genomes/*.gz"as package data and debian/python3-orfdata.install installsusr/lib/python3*, so they are in python3-orfdata. No stanza afterFiles: *matchesorfdata/data/genomes/, so the copyright file asserts a holder (OpenVax) and a licence (Apache-2.0) that are neither the holder nor the licence of the data; the file's ownLicense: Ensemblparagraph is the right text. A wrong licence and a wrong holder are as serious as a missing licence, because the source package and the binary are both distributed. - Fix: Add a stanza
Files: orfdata/data/genomes/*withCopyright: Ensembl/EMBL-EBIandLicense: Ensembl, and a Comment naming tools/build_rcrs_mitochondrion.py and Ensembl release 115 as the source.
blocker licensing 2. Files: * claims Apache-2.0/OpenVax for Ensembl, GENCODE, GenBank/RefSeq, UCSC and GEO/PRIDE fixtures that no stanza reaches ◂
- Files:
debian/copyright:10-12,tests/data/ensembl/rna.gz,tests/data/ensembl/protein.gz,tests/data/ensembl/ncrna.gz,tests/data/ensembl/gtf.gz,tests/data/ensembl/internal-stop/rna.gz,tests/data/ensembl/internal-stop/protein.gz,tests/data/ensembl/internal-stop/ncrna.gz,tests/data/ensembl/internal-stop/gtf.gz,tests/data/riborf/gencodeM25.gtf.gz,tests/data/riborf/gencodeM25.rna.fa.gz,tests/data/t2t/NC_012920.1.fasta,tests/data/t2t/hs1.chromAlias.txt,tests/data/t2t/GCA_009914755.4_T2T-CHM13v2.0_assembly_report.txt,tests/data/t2t/GCA_009914755.2_T2T-CHM13v1.0_assembly_report.txt,tests/data/viral_records/X70828.1.gb.gz,tests/data/viral_records/X04615.1.gb.gz,tests/data/viral_records/KF006398.1.gb.gz,tests/data/viral_records/KC108721.1.gb.gz,tests/data/viral_records/HPV16REF.json.gz,tests/data/viral_records/AJ507799.2.gb.gz,tests/data/viral_records/AF033817.1.gb.gz,tests/data/mammary_stroma/geo.soft.gz,tests/data/mammary_stroma/rna.csv.gz,tests/data/mammary_stroma/proteinGroups.txt,tests/data/mammary_stroma/peptides.txt,tests/data/mammary_stroma/project.json,tests/data/mammary_stroma/manifest.json - Basis: checked, in the package or with a reference tool
- Evidence: tests/data/ensembl/README.md: "Exact source records ... from the full human Ensembl 115 GTF, cDNA, ncRNA and peptide files"; tests/data/riborf/README.md: "GENCODE/EMBL-EBI data-use terms and Ensembl data-use terms apply to their reference data"; tests/data/t2t/NC_012920.1.fasta starts
>NC_012920.1 Homo sapiens mitochondrion, complete genomeand hs1.chromAlias.txt is UCSC's# ucsc genbank refseq assembly ncbitable; tests/data/mammary_stroma/NOTICE.md: "GEO numerical data and factual metadata are publicly distributed under: https://www.ncbi.nlm.nih.gov/geo/info/disclaimer.html" and "PRIDE explicitly declares CC0 for PXD023023". - Problem: The patterns meant for these do not match them:
tests/data/*/ensembl*.gzneeds a file whose basename begins withensembl(in tests/data/ensembl/ the directory is named ensembl and the files are rna.gz, gtf.gz, ...),tests/data/viral/*does not matchtests/data/viral_records/, and nothing names tests/data/t2t, gencodeM25.* or tests/data/mammary_stroma. Under copyright-format 6.9*matches/, soFiles: *is what applies: the copyright file states OpenVax as the holder and Apache-2.0 as the licence for Ensembl, GENCODE, GenBank/RefSeq, UCSC and GEO/PRIDE data. Wrong licence text and wrong holder are graded as seriously as a missing licence wherever the file is, since the source package is distributed. - Fix: Add stanzas for
tests/data/ensembl/*andtests/data/ensembl/internal-stop/*(Ensembl/EMBL-EBI, License: Ensembl),tests/data/riborf/gencodeM25.*(GENCODE/EMBL-EBI plus Ensembl terms),tests/data/t2t/NC_012920.1.fastaand the two assembly reports (NCBI),tests/data/t2t/hs1.chromAlias.txt(UCSC, with its data-use terms),tests/data/viral_records/*(NCBI and the submitters), andtests/data/mammary_stroma/*(NCBI GEO plus PRIDE CC0-1.0).
blocker licensing 3. UniProt CC-BY-4.0 data is stated as Ensembl and as CC0-1.0, and the UniProt Consortium is not named ◂
- Files:
debian/copyright:66-70,debian/copyright:77-80,debian/copyright:117-124,tests/data/references/uniprot_literature.json:2,tests/data/pfizer/vendor/NOTICE.md,tests/data/pfizer/vendor/search-slice.fasta,tests/data/pfizer/vendor/membership-search-slice.fasta,tests/data/pfizer/vendor/parent-status-search-slice.fasta,tests/data/pfizer/vendor/psm-parent-sets-search-slice.fasta - Basis: checked, in the package or with a reference tool
- Evidence: uniprot_literature.json:2
"notice": "Facts from UniProt release 2026_03 and open-access papers ... UniProt data CC-BY-4.0."; tests/data/pfizer/vendor/NOTICE.md: "The FASTA entries in these slices are from the UniProt Consortium, distributed under CC BY 4.0 ... The deposit's CC0 terms do not replace the searched FASTA's UniProt license."; debian/copyright:Files: tests/data/references/*.json ... License: EnsemblandFiles: tests/data/pfizer/* ... License: CC0-1.0. - Problem:
tests/data/pfizer/*/search.fasta(line 77) matches only a file literally named search.fasta, so the four*-search-slice.fastafiles stay under the CC0-1.0 stanza at line 66, although their own NOTICE says UniProt's CC-BY-4.0 applies.tests/data/references/uniprot_literature.jsoncarries full UniProt protein sequences (P01189, P09038, ...) and its ownnoticefield declares UniProt CC-BY-4.0, but the Ensembl stanza at line 117 covers it and names only "Ensembl/EMBL-EBI and the original data contributors". In both cases the copyright file states a licence the material is not under and withholds the attribution the CC-BY-4.0 terms require. - Fix: Extend the existing UniProt stanza to
Files: tests/data/pfizer/*/*.fasta(or addtests/data/pfizer/vendor/*.fasta), and give tests/data/references/uniprot_literature.json a stanza withCopyright: UniProt ConsortiumandLicense: CC-BY-4.0of its own.
minor licensing 4. Stanzas for tests/data/ncorf_mammals and tests/data/wang omit the holders named in the fixtures' own notices ◂
- Files:
debian/copyright:58-60,debian/copyright:109-112,orfdata/data/catalogs.json:135,tests/data/ncorf_mammals/README.md:5-7,tests/data/wang/manifest.json:94-99 - Basis: checked, in the package or with a reference tool
- Evidence: orfdata/data/catalogs.json:135
"access_terms": "MIT License, Copyright (c) 2024 RNA GxE lab @ LZU (gxelab/ncorf_mammals)."; debian/copyright:Files: tests/data/ncorf_mammals/*.bed ... Copyright: 2025 Chang et al.andFiles: tests/data/wang/* ... Copyright: 2019 Wang et al., while wang/search.fasta.gz records"access_terms": "Ensembl-generated data available without restriction; retain Ensembl/EMBL-EBI attribution". - Problem: The bed and pep.fa files are the MIT-licensed gxelab files (the comment in the same stanza names that repository and commit), so the holder whose notice the Expat licence requires to be kept is not the one named; wang/search.fasta.gz is Ensembl data for which Ensembl/EMBL-EBI is not named. Policy 2.3 requires a file's notice in debian/copyright only when it is shipped in a binary package, and tests/ is not installed (the binary takes usr/lib/python3* only), so this is not a blocker; a complete copyright file would still name them.
- Fix: Name
2024 RNA GxE lab @ LZU (gxelab/ncorf_mammals)in the Expat stanza for the bed/pep.fa files and addEnsembl/EMBL-EBIto the tests/data/wang stanza's Copyright.
minor packaging 5. Build-Depends omits python3-argcomplete and python3-ahocorasick, which the test suite imports ◂
- Files:
debian/control:6-18,orfdata/cli.py:19,orfdata/sources/pfizer_vendor.py:147,tests/test_pfizer_vendor.py:115 - Basis: checked, in the package or with a reference tool
- Evidence:
import argcompleteat module level of orfdata/cli.py, imported by 39 test modules (tests/test_cli_dispatch.py:6, tests/test_cli_options.py:9, ...);import ahocorasickinside peptide_candidates, called by tests/test_pfizer_vendor.py:115. debian/control Build-Depends lists python3-pytest, python3-biopython, python3-datacache, python3-openpyxl, python3-pyarrow, python3-pyensembl and python3-requests but neither of these. - Problem: Neither module comes with another Build-Depends (python3-datacache's and python3-pyarrow's Depends were checked with apt-cache; neither depends on them), so in a chroot holding only Build-Depends the pybuild test run fails at import, before any test runs. A build or test failure is minor for this review, but the build daemons will meet it. If the pyensembl 2.33.2-1 upload in NEW happens to pull python3-argcomplete in, the argcomplete half would not bite; ahocorasick would still be absent.
- Fix: Add
python3-argcompleteandpython3-ahocorasickto Build-Depends; both are needed by the tests, so a plain entry (no <!nocheck>) is right. Debian's python3-ahocorasick is 1.4.1, below the upstream requirement of >= 2.3, but the Automaton/add_word/make_automaton/iter API the code uses exists there.
minor packaging 6. The orfdata manual page still names version 0.34.0 ◂
- Files:
debian/orfdata.1:1 - Basis: checked, in the package or with a reference tool
- Evidence:
.TH ORFDATA 1 "October 2026" "orfdata 0.34.0" "User Commands"while debian/changelog is at 0.52.0+ds1-1 and pyproject.toml/PKG-INFO say 0.52.0. - Problem:
man orfdatareports a version the package does not have, on a page that was split out of python3-orfdata in 0.34.0 and not updated since. - Fix: Change the version argument of the .TH line to 0.52.0.
minor packaging 7. Changelog keeps a 0.34.0+ds1-1 entry below a 0.52.0+ds1-1 entry that calls itself the initial release ◂
- Files:
debian/changelog:1-16 - Basis: checked, in the package or with a reference tool
- Evidence:
python-orfdata (0.52.0+ds1-1) unstable; urgency=mediumwith* Initial release (Closes: #1151088)., directly abovepython-orfdata (0.34.0+ds1-1) unstable; urgency=medium, both dated Sat, 14 Nov 2026. - Problem: Two entries for the same source in unstable, the newer claiming to be the first upload and to close the ITP. Either 0.34.0+ds1-1 was uploaded, in which case that claim and the bug closure are wrong, or it is a draft entry that does not belong in the changelog of an upload; a reader cannot tell which from the package.
- Fix: Drop the 0.34.0+ds1-1 entry (its changes are described in the 0.52.0 entry's patch note), or correct the 0.52.0 entry so it does not call itself the initial release.
Verified ◂
- debian/copyright is DEP-5 with the exact copyright-format 1.0 Format line; the Apache-2.0, Expat, CC-BY-4.0 and CC0-1.0 paragraphs are complete or point at /usr/share/common-licenses, and the NCBI and Ensembl texts are quoted in the file.
- The upstream licence of the code, tests, tools and documentation is the top-level LICENSE, Apache-2.0; there is no other licence, header or SPDX tag anywhere in orfdata/, tests/*.py or tools/, so
Files: *is correct for those files. The only other licence files are orfdata/data/orf-evidence/AUTHOR-LICENSE.txt and orfdata/data/uorf-evidence/AUTHOR-LICENSE.txt (MIT, (c) 2025 Leron Kok), which the orf-evidence/uorf-evidence stanza describes. - All 83 compressed and archive files, including the 43 the prescan truncates, are data fixtures or packaged resources, not missing sources. Explicitly: orfdata/data/orf-evidence/catalog.json.gz and orfdata/data/uorf-evidence/catalog.json.gz are the curated evidence catalogues, with their manifest.json, NOTICE.txt and AUTHOR-LICENSE.txt describing sources, changes and licence, and the orfdata/data/orf-evidence/* and orfdata/data/uorf-evidence/* stanza matches them; orfdata/data/viral/hpv16-refseq-CDS.json.gz is the nine-CDS HPV16 reference from NCBI NC_001526.4, documented in orfdata/data/viral/NOTICE.md; orfdata/data/genomes/rcrs-ensembl115.cdna.fa.gz, rcrs-ensembl115.gtf.gz and rcrs-ensembl115.pep.fa.gz are the Ensembl rCRS records of the first licensing issue; orfdata/data/ires/rfam-15.1-human-ires.json is Rfam 15.1 (CC0). The rest are per-dataset slices under tests/data/ (wang, ingolia, copy, pfizer, pfizer_rna, mammary_stroma, ncorf_mammals, riborf, regions, references, peptideatlas, openprot, ensembl, search_reference, t2t, viral, viral_records, storage), each with source URL, SHA-256 and selected rows in the adjacent README.md, NOTICE.md or manifest.json; the workbooks tests/data/copy/workbook.xlsx, tests/data/ncorf_mammals/S3.xlsx, tests/data/riborf/SD3.xlsx and tests/data/pfizer_rna/samples.xlsx are re-encoded factual slices, and tests/data/kaabinejadian/Results.zip is a PRIDE PXD074485 (CC0) slice, as their README files say.
- tests/data/storage/v1.sqlite, tests/data/storage/v2.sqlite, tests/data/storage/v3.sqlite and tests/data/storage/v4.sqlite are synthetic legacy-layout fixtures built by tests/data/storage/generate.py from released orfdata versions; the generator and the README that explains what each version contains are in the tree, so no preferred form for modification is missing.
- The 35 rare-wording hits are not licence terms of shipped files. debian/README.source:10, docs/catalogs.md:85,558, docs/dog-peptides.md:44, docs/index.md:138, docs/mammary-stroma.md:103, docs/pfizer-rna.md:85, orfdata/command_parsers.py:339, orfdata/install.py:25, orfdata/liftover.py:220,288, orfdata/data/chains.json:58,82, orfdata/data/datasets.json:856,857,929, tests/test_liftover.py:252,263, tests/data/mammary_stroma/NOTICE.md:32, tests/data/mammary_stroma/manifest.json:100, tests/data/pfizer/vendor/NOTICE.md:121,122, tests/data/pfizer_rna/NOTICE.md:9, tests/data/pfizer_rna/dog-expected.json:107,108, tests/data/pfizer_rna/dog-manifest.json:114,115, tests/data/pfizer_rna/mouse-expected.json:107,108, tests/data/pfizer_rna/mouse-manifest.json:114,115, tests/data/references/uniprot_literature.json:489, tools/README-dog-results.md:580, tools/build_dog_dataset.py:53 and tools/package_dog_dataset.py:124 all quote UCSC's non-commercial chain-file terms (for files downloaded on demand with --accept-terms, not shipped) or the CC-BY-NC-ND terms of article supplements that are not redistributed; the four tests/data/pfizer_rna/*-{expected,manifest}.json hits are the
access_terms/license_urlmetadata records that say the supplement is not redistributed. - No non-free material is shipped: Files-Excluded names tests/data/peptideatlas/atlas_build.tsv.zip and tests/data/openprot/*.zip, none of which is in the tree, and the tests that need them are excluded through debian/tests/pytest.args (
--ignore=tests/test_openprot.pyand the dog-peptide deselects), used by both the build and autopkgtest. - tests/data/copy/methods.pdf and tests/data/copy/paper.xml are not the article: both are JSON metadata stubs (
{"fixture_metadata_stub": true, "primary_url": ...}) naming the primary object's URL and SHA-256, which is what the NOTICE.md of tests/data/copy describes; tests/data/mammary_stroma/paper.xml is a synthetic wrapper of the factual clinical table, and tests/data/pfizer/vendor/dog-panel.json keeps factual cells only. - Every file under tests/data/viral/ and orfdata/data/viral/ is GenBank/RefSeq or GDC-inventory material and is covered by the NCBI stanza; the GDC ledger TSVs are checksum-and-count tables built by tools/build_reference_ledger.py, which is in the tree together with build_hpv16_cds.py and build_gdc_viral_coverage.py (the tests import the latter two, so they are not missing).
- No third-party library is vendored: orfdata/sources/*.py are OpenVax's own readers, there is no COPYING/LICENSE outside the top-level LICENSE and the two AUTHOR-LICENSE.txt files, and nothing in the package looks like an embedded copy of a library Debian ships.
- python3-pyensembl is absent from the archive but is built by the pyensembl 2.33.2-1 upload in NEW (apt-cache), so the dependency is not a fault; dh_python3's mapping resolves pyensembl, datacache, openpyxl, pyahocorasick and the rest of the Requires-Dist list to Debian packages, which is how the runtime dependencies reach ${python3:Depends} at compat 13.
- The packaging files were all read: control, rules, changelog, source/format and source/options, the install/manpages/docs files, pybuild.testfiles, clean, README.source, gbp.conf, upstream/metadata, salsa-ci.yml, tests/control, tests/pytest.args, both test scripts, lrc.config (an lrc(1) exclusion list, not a packaging file), and the single patch (DEP-3 with Description, Author, Forwarded to upstream PR 207, Last-Update).
- uscan found the packaged version as the newest upstream release (upstream
0.52.0, packaged0.52.0+ds1). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0,CC-BY-4.0,CC0-1.0).
Not confirmed ◂
- Whether the pyensembl 2.33.2-1 upload in NEW brings python3-argcomplete into the build environment, which would make the argcomplete half of the Build-Depends issue moot.
- Whether python3-datacache 1.27.1, the archive version, satisfies everything upstream's declared datacache>=1.29.3 is used for; the tests were not run here, and Build-Depends only require >= 1.25.1.
- Whether debian/gbp.conf's
debian-branch = mastermatches the branch of the salsa repository; the remote cannot be inspected from here. - What these files are. The scan made before the review picked them out (built files, minified code, archives, licence wording that is rarely free, or licences that are not accepted), and this report does not mention them:
tests/data/copy/GSM1905474_KL9_fpkm.txt.gz(gzip-compressed file);tests/data/copy/GSM1905476_KL10_fpkm.txt.gz(gzip-compressed file);tests/data/copy/GSM1905478_KL11_fpkm.txt.gz(gzip-compressed file);tests/data/copy/GSM1905479_KL12_fpkm.txt.gz(gzip-compressed file);tests/data/ingolia/GSM346111.quant.txt.gz(gzip-compressed file);tests/data/ingolia/GSM346114.quant.txt.gz(gzip-compressed file);tests/data/ingolia/GSM346115.quant.txt.gz(gzip-compressed file);tests/data/ingolia/GSM346116.quant.txt.gz(gzip-compressed file);tests/data/ingolia/GSM346117.quant.txt.gz(gzip-compressed file);tests/data/ingolia/GSM346118.quant.txt.gz(gzip-compressed file);tests/data/ingolia/GSM346120.quant.txt.gz(gzip-compressed file);tests/data/ingolia/GSM346122.quant.txt.gz(gzip-compressed file);tests/data/ingolia/readMe.txt.gz(gzip-compressed file).
Proposed changes ◂
None.
Uploader's response to the LLM review
Waiting for the uploader's response until , because the review found serious issues.