DFSG NEW review for python-pytest-metadata version 3.1.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All upstream code is MPL-2.0: every Python module in src/ and tests/ carries the three-line MPL-2.0 Source Code Form header, the top-level LICENSE is the same notice, and pyproject.toml/PKG-INFO declare MPL-2.0, an SPDX identifier /usr/share/common-licenses/MPL-2.0 covers. debian/copyright is DEP-5, names the two principal upstream holders plus 'pytest-metadata contributors' (which covers the remaining names in AUTHORS), licenses debian/* to the uploader, and includes the licence text by pointer. No non-free term, no unlicensed file and no vendored third-party code was found.

Packaging

The packaging is a clean, conventional pybuild/hatchling package: correct Build-Depends (all present in the archive), debhelper compat 14 with dh-sequence-python3, a three-line rules, DEP-5 copyright, source format 3.0 (quilt) with no patches, autopkgtest via Testsuite: autopkgtest-pkg-pybuild, and a sane changelog. The runtime dependency on python3-pytest comes from dh_python3's Requires-Dist guessing and the pytest test suite is actually run both at build time and in autopkgtest, because dh's pybuild buildsystem selects --test-pytest when python3-pytest is in Build-Depends.

Issues

None.

Verified

• debian/copyright is machine-readable (canonical Format: URL): Files: * MPL-2.0 with 2017-2024, Dave Hunt, Jim Brännlund and pytest-metadata contributors; Files: debian/* MPL-2.0 for 2026, Nico Della Torre; a stand-alone License: MPL-2.0 paragraph with the Source Code Form notice and a pointer to /usr/share/common-licenses/MPL-2.0, which exists on the system.
• Licence evidence in the tree is uniform: src/pytest_metadata/{plugin,hooks}.py, all eight src/pytest_metadata/ci/*.py, and tests/test_metadata.py begin with the MPL-2.0 Source Code Form header; LICENSE is the same notice; pyproject.toml:12 has license = "MPL-2.0" and PKG-INFO:9 License-Expression: MPL-2.0. A tree-wide grep for Copyright/(C)/SPDX/GPL/LGPL/Apache/BSD/MIT/CC/public-domain/All-rights-reserved wording found no other licence.
• No vendored third-party code: the ci/*.py modules are the project's own environment-variable tables, and .pre-commit-config.yaml only names external hook repositories (black, pre-commit-hooks, flake8) without shipping code from them.
• Prescan: dfsg-author-check reported every holder it found as named in debian/copyright (no files listed). The contributors in AUTHORS beyond Dave Hunt and Jim Brännlund (Agustín Herranz, Arminius, Imran Mumtaz, Sam Clements, Tomas Krizek, Zac Hatfield-Dodds) are covered by the pytest-metadata contributors line, and no per-file copyright notice names anyone else.
• Built/generated files in the scan's sense: src/pytest_metadata/__version.py is the hatch-vcs/setuptools_scm version file (present in the orig sdist, 411 bytes, a version string only); debian/clean removes it and dh's pybuild buildsystem exports SETUPTOOLS_SCM_PRETEND_VERSION from debian/changelog because python3-hatch-vcs is in Build-Depends (/usr/share/perl5/Debian/Debhelper/Buildsystem/pybuild.pm:152), so it is regenerated during the build. PKG-INFO is sdist metadata generated from pyproject.toml, which is shipped. There are no binaries, images, fonts, PDFs or archives in the tree.
• autopkgtest: Testsuite: autopkgtest-pkg-pybuild needs no debian/tests/control; autodep8's pybuild support (/usr/share/autodep8/support/pybuild/generate) generates Test-Command: pybuild-autopkgtest with Depends: @, pybuild-plugin-autopkgtest, @builddeps@.
• Tests are actually run: dh's pybuild buildsystem adds --test-pytest when python3-pytest is in Build-Depends (/usr/share/perl5/Debian/Debhelper/Buildsystem/pybuild.pm:212), and pybuild puts the installed module on PYTHONPATH for the test step (/usr/share/dh-python/pybuild:312-331); the upstream suite is pytest-only (pytester fixture), so the unittest fallback would have collected nothing.
• Runtime dependency: Depends carries only ${misc:Depends}, ${python3:Depends}; dh_python3 reads the built METADATA's Requires-Dist: pytest>=7.0.0 by default (guess_deps default True, /usr/share/dh-python/dhpython/options.py:40; parse_requires_dist, pydist.py:740), so python3-pytest is added. Debian has pytest 9.1.1-1.
• Build-Depends all exist: debhelper-compat (= 14), dh-sequence-python3 (dh-python 7.20261025 Provides it), pybuild-plugin-pyproject (dh-python), python3-hatch-vcs 0.5.0 (Depends python3-setuptools-scm), python3-hatchling 1.32.4 (accepts the PEP 639 license = "MPL-2.0" string), python3-pytest <!nocheck> 9.1.1.
• Standards-Version 4.7.4 against Policy 4.7.4.1: first two components equal, so current enough. Rules-Requires-Root is not needed: Policy 5.6.31 makes no the default.
• debian/source/format is 3.0 (quilt) with no debian/patches; no maintainer scripts, no .maintscript, no debian/tests. debian/changelog is a well-formed initial 3.1.1-1 to unstable dated Fri, 30 Oct 2026 with an ITP closure; debian/gbp.conf (debian/master, upstream, pristine-tar) and debian/upstream/metadata are consistent with the Homepage and Vcs- fields.
• Orig and debian tarballs match the unpacked tree: the orig tarball has exactly the shipped top level plus src/pytest_metadata/ (including __version.py) and tests/, and the debian tarball contains exactly the files present under debian/.
• uscan found the packaged version as the newest upstream release (upstream 3.1.1, packaged 3.1.1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (MPL-2.0).

Not confirmed

• The salsa-ci snippet (SALSA_CI_DISABLE_BUILD_PACKAGE_ALL/ANY, SALSA_CI_ENABLE_BUILD_PACKAGE_PROFILES, .test-build-package-profiles) could not be checked offline; it affects the CI pipeline only, not the package, and the configuration is plausible.

Proposed changes

None.