DFSG NEW review for python-pybreaker version 1.4.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The licences themselves are free: the upstream code is BSD-3-Clause (LICENSE reproduced verbatim in debian/copyright, including the 'software software' typo) and the one bundled third-party tool script pw is MIT/Expat with its notice in the file. No non-free terms, no vendored library, no built or generated binaries that lack source. debian/copyright is nevertheless inaccurate in two places: Files: * names a holder name and address that contradict the upstream LICENSE and pyproject.toml, and the Files: pw stanza does not cover pw.bat and pw.lock, so those two pyprojectx files are described as Daniel Martins's BSD-3-Clause code.

Packaging

Standard, well-formed Debian Python Team packaging. debhelper compat 14 with dh $@ --buildsystem=pybuild, the PEP 517 plugin, pybuild-plugin-pyproject and python3-flit for the flit_core backend; test-only dependencies (pytest, tornado, fakeredis) are correctly marked <!nocheck>; Testsuite: autopkgtest-pkg-pybuild is dh-python's implicit test and needs no debian/tests/control. Standards-Version 4.7.4 matches the current Policy 4.7.4.1 in its first two components, single arch:all binary, Vcs-* and Homepage present, no patches, changelog sane. The empty Depends field is correct at compat 14, where dh_gencontrol adds the relationship substvars itself.

Issues

1. [important] [licensing] Files: pw does not cover pw.bat and pw.lock, which are pyprojectx files under Ivo Houbrechts' MIT licence, so Files: * misattributes them

• Files: debian/copyright:9, debian/copyright:5-7, pw.bat, pw.lock, pw:1-10
• Basis: checked, in the package or with a reference tool
• Evidence: Files: pw / Copyright: 2021 Ivo Houbrechts / License: Expat. copyright-format 6.9: "Patterns match pathnames that start at the root of the source tree. Thus, ‘Makefile.in’ matches only the file at the root of the tree" and a pattern has to contain a wildcard to reach further, so pw matches only that one path. pw.bat is the 2-line Windows shim @echo off / python "%~dp0pw" %*; pw.lock is the lock file pw --lock generates ([main] / requirements = [...] / hash = ...). pw is the pyprojectx wrapper, and pyproject.toml groups the three as pw* ([tool.flit.sdist] exclude = [..., "pw*"]).
• Problem: The two files fall through to Files: *, which declares them BSD-3-Clause with Copyright: Daniel Martins, whereas they belong to the pyprojectx wrapper whose own header (pw:7, pw:9) says Copyright (c) 2021 Ivo Houbrechts and Licensed under the MIT license. debian/copyright therefore names the wrong holder and the wrong licence for two files in the source package, contrary to copyright-format 6.9's last-stanza-wins matching and to the requirement that the file describe the licensing of every file (Policy 12.5).
• Fix: Widen the stanza to Files: pw* (or list pw pw.bat pw.lock), keeping Copyright: 2021 Ivo Houbrechts and License: Expat.

2. [minor] [licensing] Files: * Copyright gives Daniel Martins <diddi@diddi.se>, an address that appears nowhere in the source and contradicts LICENSE and pyproject.toml

• Files: debian/copyright:6, LICENSE:1, pyproject.toml:6
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: Copyright: Daniel Martins <diddi@diddi.se>; LICENSE: Copyright (c) 2010-2021, Daniel Fernandes Martins; pyproject.toml: { name = "Daniel Fernandes Martins", email = "daniel.tritone@gmail.com" }.
• Problem: The holder is named with a truncated name and an address that no file in the source contains, so the copyright statement does not identify the actual holder as upstream states him; the years (2010-2021) are also dropped. The copyright is correct in substance but the record is wrong for anyone who needs to contact the holder.
• Fix: Use Copyright: 2010-2021, Daniel Fernandes Martins <daniel.tritone@gmail.com> in the Files: * stanza.

Verified

• Prescan item Ivo Houbrechts # # pw:7: accounted for — pw's header names that holder and the file is covered by the Files: pw stanza with License: Expat, whose stand-alone text is the MIT text quoted in the header. The gap is only its two siblings (issue above).
• Inventory covered the whole tree (16 files plus .github/, .pre-commit-config.yaml, .gitignore; .pc/ skipped as instructed): src/pybreaker/init.py, py.typed, tests/{init,pybreaker_test,typechecks}.py, README.rst, CHANGELOG, pyproject.toml, .github/{FUNDING.yml,workflows/*}, .pre-commit-config.yaml, .gitignore.
• No file in the tree carries a copyright or licence notice other than LICENSE, pw and pyproject.toml's License :: OSI Approved :: BSD License classifier; grep for Copyright/(C)/©/SPDX/Licensed under/permission grants/GNU/Apache/MPL/public domain found nothing else. README.rst has no licence section; CHANGELOG's 'Thanks @...' lines are credits, not holders.
• No built files, minified code, archives, PDFs, images, fonts or bytecode in the tree; pw is a plain Python script written by hand, not used by debian/rules and not installed in the binary.
• No embedded third-party library: tornado and redis are optional runtime imports from system packages (try: from tornado import gen / try: from redis import Redis in src/pybreaker/init.py), not vendored copies.
• Tested licensing combination: BSD-3-Clause and MIT/Expat are both free and mutually compatible; nothing is non-commercial, no-modification or field-of-use restricted. Both full licence texts are in debian/copyright (BSD-3-Clause, Expat).
• Packaging files read in full: debian/control, rules, changelog, copyright, salsa-ci.yml, source/format, watch (not reviewed). No debian/patches, no install/links/docs files, no maintainer scripts.
• Build dependencies cover what the tests import: tests/pybreaker_test.py uses from unittest import mock (stdlib), pytest, tornado.testing, fakeredis and redis.exceptions; apt-cache show python3-fakeredis confirms Depends: python3-redis, so no python3-mock and no separate python3-redis Build-Depends are missing.
• Testsuite: autopkgtest-pkg-pybuild is dh-python's implicit test: /usr/share/dh-python/pybuild-autopkgtest exists and runs the pybuild buildsystem's autopkgtest command, so no debian/tests/control is needed.
• pybuild-plugin-pyproject builds with python -m build --skip-dependency-check --no-isolation --wheel (/usr/share/dh-python/dhpython/build/plugin_pyproject.py), so the flit_core backend must be installed; python3-flit (4.1.0-4) is Build-Depended on, and apt-cache show finds no separate python3-flit-core or flit-core binary package in unstable or NEW.
• Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: first two components equal, no issue. Distribution unstable, version 1.4.1-1, changelog closes #1151268, date valid for 31 Oct 2026.
• Single Architecture: all binary python3-pybreaker carrying src/pybreaker and py.typed; no Depends field, which is correct at debhelper compat 14 (dh adds relationship substvars itself).
• uscan found the packaged version as the newest upstream release (upstream 1.4.1, packaged 1.4.1).

Not confirmed

• That python3-flit 4.1.0 in the archive really ships the flit_core backend that python -m build --no-isolation imports; the package lists contain no python3-flit-core binary, so this is assumed, and a clean build would show it.

Proposed changes

None.