Review: python-waf-build 2.0.27+git20241008+dfsg-1

Package Information

Description	Python framework for configuring, building and installing software Waf is a build system written in Python. It supports automatic dependency tracking, parallel builds, configuration checks and extensible build tasks for many programming languages and toolchains. This package provides the waflib Python 3 library, including its standard tools and contributed extensions.
Maintainer	Steffen Moeller <moeller@debian.org>
Changed By	Steffen Moeller <moeller@debian.org>
Sponsor	moeller@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/python-team/packages/python-waf-build.git (browse)
Closes	#843325
Tracker	https://tracker.debian.org/pkg/python-waf-build
Uploaded	4 hours ago

New Package Report

.changes◂

Changed-By	Steffen Moeller <moeller@debian.org>
Architecture	source all
Distribution	unstable
Date	Tue, 10 Nov 2026 00:08:11 +0100
Source	python-waf-build
Version	2.0.27+git20241008+dfsg-1

Changelog◂

python-waf-build (2.0.27+git20241008+dfsg-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #843325)
   * Retain python-waf-build as the source package name and provide waf as
     the command-line binary package, with python3-waf-build supplying waflib.
   * Install the unbundled Python 3 launcher and all core and extra tools.
   * Repack to exclude non-free logos and the Xilinx ISE example with unclear
     redistribution terms.
   * Add a manual page, upstream regression tests and a C build/install test.
   * Use Waf's shell quoting helper in genpybind for Python 3.13 and later.

.dsc◂

Section	python
Priority	optional
Component	main
Package-List	python3-waf-build deb python optional arch=all waf deb devel optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/ArduPilot/waf
Upstream-Name: waf
Upstream-Contact: https://github.com/ArduPilot/waf/issues
Files-Excluded:
 docs/slides/presentation/gfx/waflogo.svg
 docs/sphinx/_images/waf-64x64.png
 playground/rst/test.svg
 playground/xilinx-ise
Comment:
 The SVG logos explicitly specify CC BY-NC. The companion Sphinx logo is
 also excluded because no separately licensed source is provided for it.
 The Xilinx ISE example includes a vendor copyright notice without a
 redistribution licence. These files are not needed for the Waf library
 or command-line tool.

Files:
 *
Copyright:
 2005-2023 Thomas Nagy
 2005 Scott Newton
 2006 Ralf Habacker
 2006-2007 Carlos Rafael Giani
 2007 Ali Sabil
 2007 Brant Young
 2007 Gustavo Carneiro
 2007 Matthias Jahn
 2007 Tamas Pal
 2007 andersg <andersg@0x63.nu>
 2008 DC
 2008 Daniel Svensson
 2008 Jaap Haitsma
 2008 Sebastian Schlingmann
 2008 Ruediger Sonderfeld
 2008 Bjoern Michaelsen
 2008 Luca Fossati
 2008-2011 Richard Quirk
 2009 Yinon Ehrlich
 2009 Michael Kuhn
 2009-2011 Nicolas Mercier
 2009-2010 Grygoriy Fuchedzhy
 2009 Nicolas Joseph
 2009-2011 Avalanche Studios
 2010 Joshua Simmons
 2010 Mark Coggeshall
 2010 Thomas Frauendorfer
 2010-2014 Jérôme Carretero <cJ-waf@zougloub.eu>
 2011 Antoine Dechaume
 2011 Chris Pickel
 2011 Laurent Birtz
 2011 Per Rosengren
 2011 Yannick LM
 2011-2014 Sylvain Rouquette
 2012 Alex Rønne Petersen
 2012 Anton Feldmann
 2012 Christian Klein <chrikle@berlios.de>
 2012 Hans-Martin von Gaudecker
 2012-2015 Matt Clarkson
 2012 Philipp Bender
 2012-2013, 2018 Garmin International or its subsidiaries
 2013 Christoph Koke
 2013 Mathieu Courtois, EDF R&D
 2014 Alexander Afanasyev
 2014 Krzysztof Kosiński
 2014 Michal Proszek
 2015 Simon Warg
 2016 Przemyslaw Rzepecki
 2016-2018 Calle Rosenquist
 2016-2022 Federico Pellegrin
 2017 Justin Israel
 2018-2019 DragoonX6
 2019 Alibek Omarov
 2019, 2023 Rafaël Kooi
 Waf and ArduPilot contributors
License: BSD-3-clause

Files:
 playground/gtest/tests/gtest_main.cc
Copyright:
 2006 Google Inc.
License: BSD-3-clause

Files:
 demos/intltool/po/sv.po
Copyright:
 None (public domain)
License: public-domain
 This file is in the public domain, as stated in its header.

Files:
 debian/*
Copyright:
 2026 Steffen Moeller <moeller@debian.org>
License: GPL-2+

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 .
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 .
 3. The name of the author may not be used to endorse or promote products
    derived from this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR
 IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
 INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: GPL-2+
 This package is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this package. If not, see <https://www.gnu.org/licenses/>.
Comment:
 On Debian systems, the complete text of the GNU General
 Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for python-waf-build version 2.0.27+git20241008+dfsg-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 6 found

Licensing

The source is free and DFSG-compliant: the whole upstream tree is Waf's BSD-3-clause (top-level LICENSE, utils/launcher/LICENSE and the notice in several tools), with one Google BSD-3 sample and one public-domain .po file, both given their own stanzas; the non-free CC BY-NC logos and the unlicensed Xilinx ISE example named in Files-Excluded are absent from the tree, and no other restrictive terms remain. Packaging is GPL-2+, compatible with BSD-3, and debian/copyright is valid DEP-5 with the required licence texts. It is not accurate, though: five people credited as authors in the file headers (and so holders of the retained copyright notice) are missing from the Copyright list, so debian/copyright does not describe every file's copyright.

Packaging

Clean, conventional packaging: 3.0 (quilt) with two DEP-3 patches, debhelper 13 with dh-sequence-python3, a sensible two-package split (waflib library plus /usr/bin/waf launcher) with an exact-version dependency between them, a hand-written manpage wired through waf.manpages, two autopkgtests that run against the installed packages and are also run at build time, Standards-Version 4.7.4 against Policy 4.7.4.1, and a .dsc that is consistent with debian/control. The python3-waf-build.install patterns cover every waflib file (all are .py). Only a documentation slip in debian/README.source was found.

Issues

blocker licensing 1. debian/copyright does not name the holders John O'Meara, Stian Selnes, Petar Forai, Thomas Zellman and Gernot Vormayr, credited in the file headers ◂

Files: debian/copyright:19-58, waflib/Tools/bison.py:3, waflib/Tools/flex.py:3, waflib/Tools/icc.py:3, waflib/extras/swig.py:3, waflib/extras/boost.py:4, playground/swig/wscript:3, demos/jni/wscript:3
Basis: checked, in the package or with a reference tool
Evidence: # John O'Meara, 2006 (bison.py, flex.py); # Stian Selnes 2008 (icc.py); # Petar Forai (swig.py, # Peter Forai in playground/swig/wscript); # Thomas Zellman 2009 (demos/jni/wscript); # partially based on boost.py written by Gernot Vormayr (boost.py). None of these names appears in the Files: * Copyright list in debian/copyright, which otherwise reproduces the per-file author credits.
Problem: BSD-3-clause requires that the copyright notice be retained, and DEP-5's Copyright field is meant to give every holder whose notice is in the files (Debian Policy 12.5, copyright-format 6.5). The holder list in the Files: * stanza is evidently built from these headers and is short by five names, so debian/copyright is not an accurate description of the source's copyright.
Fix: Add John O'Meara 2006, 2008 Stian Selnes, Petar Forai, 2009 Thomas Zellman and Gernot Vormayr to the Copyright field of the Files: * stanza (Gernot Vormayr as holder of the part of waflib/extras/boost.py derived from his boost.py, or in a separate stanza for that file).

minor packaging 2. debian/README.source's mk-origtargz example names a different snapshot (2.0.22+git20261002) from the packaged 2.0.27+git20241008 ◂

Files: debian/README.source:28-33
Basis: checked, in the package or with a reference tool
Evidence: --version 2.0.27+git20241008 ... /path/to/python-waf-build_2.0.22+git20261002.orig.tar.xz; the package version is 2.0.27+git20241008, and no 2.0.22+git20261002 snapshot is described anywhere.
Problem: The README tells a future maintainer how to recreate the orig tarball, but its only concrete input path is a leftover from a different (and internally inconsistent, version 2.0.22 with a 2026-10-02 snapshot) draft, so following it would repack the wrong source.
Fix: Update the example input path to correspond to the imported snapshot (or drop the version-bearing file name in favour of a placeholder such as <upstream-snapshot>.orig.tar.xz).

minor packaging 3. uscan finds only upstream versions older than the packaged one ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: upstream 1.9.2, packaged 2.0.27+git20241008+dfsg
Problem: The newest version uscan finds with debian/watch is older than the version in debian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
Fix: Check where debian/watch looks and how it mangles versions.

Verified ◂

Files named by the pre-review scan, accounted for: docs/slides/presentation/gfx/slides-executable_deps.dia is a Dia document (gzipped XML by design) used as figure source for docs/slides/presentation/slides.tex, not a built artifact, covered by Files: *; playground/dynamic_build2/foo.tar is a test input holding aa/main.c (int main() {return 0;}) that the playground wscript unpacks, not a compiled output; demos/mac_app/resources/MainMenu.nib/keyedobjects.nib is the compiled Cocoa nib of the macOS demo, whose Interface Builder source designable.nib (XML) is present in the same directory and which the package neither builds nor installs.
build_system_kit/nostate/README.txt:2 (for research purposes only) is the author saying the example is a demonstration, not a licence restriction; the file is under Files: * BSD-3.
The CC BY-NC wording at debian/README.source:19 and debian/copyright:11 describes the excluded logo files; docs/slides/presentation/gfx/waflogo.svg, docs/sphinx/_images/waf-64x64.png, playground/rst/test.svg and playground/xilinx-ise are all absent from the tree, and a case-insensitive tree-wide grep for creativecommons|by-nc|noncommercial|cc-by finds no other occurrence.
playground/sphinx/src/conf.py:23 (copyright = '2019, sphinx') is sphinx-quickstart template output for its demo project (project = 'project', author = 'sphinx', index.rst' sphinx-quickstart on Sun May 26 ... 2019 banner); 'sphinx' there is the placeholder project name, not a copyright holder or third-party code, and the file is covered by Files: *.
Generated files: playground/cython/cython_cache/src/cy_ctest.c, cy_cxxtest.cc, cy_cxxtest.h and cy_cxxtest_api.h are /* Generated by Cython 0.29 */; their generator inputs playground/cython/src/cy_ctest.pyx and cy_cxxtest.pyx are in the package, and the directory is a demo of Cython output caching.
Licence evidence across the tree: LICENSE, utils/launcher/LICENSE, the headers of waf-light, zip/waf-zip, waflib/extras/codelite.py and waflib/extras/msvs.py all carry the same BSD-3-clause text; docs/sphinx/copyright.rst states the documentation is under it; waflib/Tools and waflib/extras credit lines were read in full (126 waflib and 112 demo/playground/test lines) and no GPL, LGPL, MIT, Apache, MPL or other grant exists anywhere in the tree.
playground/gtest/tests/gtest_main.cc is the only Google file (BSD-3, Copyright 2006, Google Inc.) and has its own stanza; the neighbouring gtest sample sources carry no notice and fall under Files: *.
demos/intltool/po/sv.po states # public domain, no copyright and is covered by its own stanza with License: public-domain.
Binary demo assets recorded by name, not opened: demos/mac_app/resources/MacApp.icns, demos/c/program/gfx/semfavicon.ico, playground/stpl_c_py_cs_satellite_wix/src/gui/Resources/Icon1.ico, demos/mac_app/resources/MainMenu.nib/{designable.nib,keyedobjects.nib}, utils/pubkey.asc; all are macOS/Windows demo resources or a signing key, covered by the BSD-3 Files: * stanza and not installed by either binary package.
debian/copyright is valid DEP-5: Format: is the canonical URL, the Files-Excluded stanza is consistent with the tree, and the License/Comment paragraphs include the BSD-3 text, the GPL-2+ text with the /usr/share/common-licenses/GPL-2 pointer, and the public-domain text.
Every file installed by python3-waf-build matches its .install: all 154 files under waflib/ (top level, Tools/, extras/) end in .py, so the three *.py patterns cover the whole library.
debian/tests/control follows the autopkgtest spec (cwd is the unpacked source root; tests use the installed /usr/bin/waf and waflib); the build-time and autopkgtest dependency sets (python3-all, build-essential) match what the scripts use, and py3versions comes with python3-all.
Packaging internals: debhelper 13 with dh-sequence-python3, no substvar requirement at that level, override_dh_auto_test is run only when dh does not skip it for nocheck; both patches have DEP-3 headers with Author/Forwarded/Last-Update; debian/rules, waf.1, waf.docs, waf.dirs, waf.manpages, .install and the changelog are internally consistent, and the .dsc matches debian/control (which also shows dpkg accepting the trailing comma after python3-all).
Sampling: the whole tree was covered by tree-wide licence/attribution greps (.pc/ excluded, gitignore: false everywhere); about 40 individual files (debian/*, licence/attribution headers, generated files, test scripts, demo assets) were read in full rather than all 999 files one by one.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed ◂

Whether Closes: #843325 in debian/changelog is the ITP for this package; the BTS is not reachable from here.
debian/lrc.config contains only the word debian; nothing in debian/ reads it and I could not confirm which tool (if any) it is meant for.
The provenance of the demo icons and the macOS nib resources is stated nowhere upstream; I judged them from their location and the project LICENSE rather than from an explicit notice.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 2 hours ago, started 2 hours ago, completed 2 hours ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Back to Dashboard | View all reviews for this package