q2-types 2026.10.0-1

Package Information

Description	QIIME 2 plugin defining types for microbiome analysis QIIME 2 is a powerful, extensible, and decentralized microbiome analysis package with a focus on data and analysis transparency. QIIME 2 enables researchers to start an analysis with raw DNA sequence data and finish with publication-quality figures and statistical results. Key features: * Integrated and automatic tracking of data provenance * Semantic type system * Plugin system for extending microbiome analysis functionality * Support for multiple types of user interfaces (e.g. API, command line, graphical) QIIME 2 currently supports an initial end-to-end microbiome analysis pipeline. New functionality will regularly become available through QIIME 2 plugins. You can view a list of plugins that are currently available on the QIIME 2 plugin availability page. The future plugins page lists plugins that are being developed. This plugin provides the core semantic types used by QIIME 2 plugins to exchange microbiome data such as feature tables and phylogenetic trees.
Maintainer	Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed By	Andreas Tille <tille@debian.org>
Sponsor	tille@debian.org
Distribution	experimental
Architecture	all
VCS	git: https://salsa.debian.org/med-team/q2-types.git (browse)
Closes	#1065333, #1076316, #1104050
Popcon Installs	6
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/q2-types
Uploaded	1 hour ago

New Package Report

.changes◂

Changed-By	Andreas Tille <tille@debian.org>
Architecture	source all
Distribution	experimental
Date	Mon, 02 Nov 2026 09:11:22 +0100
Source	q2-types
Version	2026.10.0-1

Changelog◂

q2-types (2026.10.0-1) experimental; urgency=medium
 .
   * Team upload.
   * New upstream version
   * d/watch: version=5
   * cme fix dpkg-control (+ adapt d/control.in)
   * Do not hardcode Python3.11 any more
     Closes: #1076316
   * Build-Depends: pybuild-plugin-pyproject (routine-update)
   * Replace FSF postal address with a reference to
     https://www.gnu.org/licenses/.
   * Regenerate debian/control from debian/control.in (routine-update)
   * Lintian-overrides for package-contains-documentation-outside-usr-share-doc
     and compressed-duplicate
   * Enhance long description
   * Build-Depends: dh-sequence-single-binary
   * Fix permissions
   * d/patches: Do not fail plugin registration when optional dependencies
     (pyhmmer, frictionless) are not installed, and ignore only the
     autopkgtest modules that need those unpackaged modules.
     Closes: #1104050
   * Add package q2-types-examples
     Closes: #1065333

.dsc◂

Package-List	q2-types deb science optional arch=all q2-types-examples deb science optional arch=all
Section	science
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: QIIME 2
Source: https://github.com/qiime2/q2-types/releases

Files: *
Copyright: 2016-2023 QIIME 2 development team
License: BSD-3-clause

Files: debian/*
Copyright: 2019 Liubov Chuprikova <chuprikovalv@gmail.com>
           2019-2023 Andreas Tille <tille@debian.org>
           2019-2022 Steffen Moeller <moeller@debian.org>
           2020-2023 Étienne Mollier <emollier@debian.org>
License: GPL-2+

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions are met:
  .
  1.  Redistributions of source code must retain the above copyright notice,
      this list of conditions and the following disclaimer.
  .
  2.  Redistributions in binary form must reproduce the above copyright notice,
      this list of conditions and the following disclaimer in the documentation
      and/or other materials provided with the distribution.
  .
  3.  Neither the name of the copyright holder nor the names of its
      contributors may be used to endorse or promote products derived from this
      software without specific prior written permission.
  .
  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: GPL-2+
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.
 .
 For other licensing arrangements, please contact Daniel J. Schaid.
 .
 On a Debian system, the GNU GPL license version 2 is distributed in the
 file /usr/share/common-licenses/GPL-2.

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for q2-types version 2026.10.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 1 blocker, 1 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 55 found, 32 not mentioned in this report (11 not listed by the scan, so not checked)

Licensing

Upstream is BSD-3-clause and the text in debian/copyright is the right one, but two files in q2_types/reference_db/tests/data that debian/copyright attributes to the QIIME 2 development team under BSD-3 are saved copies of a github.com web page (GitHub, Inc.'s content, no licence): they are not the DIAMOND databases their names claim. The GPL-2+ paragraph for debian/* also carries a leftover sentence from an unrelated package. Everything else I checked is covered by the Files: * stanza.

Packaging

The packaging is otherwise competent (compat 14, a DEP-3 patch that closes #1104050, autopkgtest, control generated from control.in, current Standards-Version), but the new q2-types-examples split moves the whole q2_types/reference_db Python module out of q2-types instead of only its data, and q2-types' own plugin_setup.py and q2_types/kaiju/_formats.py import that module. A plain installation of q2-types (q2-types-examples only Enhances it) therefore has a qiime2 plugin that cannot be loaded.

Issues

blocker licensing 1. The two .dmnd test files are saved github.com web pages, under no free licence and wrongly attributed to the QIIME 2 team ◂

Files: q2_types/reference_db/tests/data/dmnd_db/ref_db.dmnd:70, q2_types/reference_db/tests/data/dmnd_db/ref_db.dmnd:2761, q2_types/reference_db/tests/data/bad_dmnd_db/bad_name.dmnd:70, debian/copyright:5-7, q2_types/reference_db/tests/test_formats.py:22-46
Basis: checked, in the package or with a reference tool
Evidence: Both files are GitHub HTML, not binary data: <title>eggnog-mapper/eggnog_proteins.dmnd at master · eggnogdb/eggnog-mapper</title>, a canonical link to https://github.com/eggnogdb/eggnog-mapper/blob/master/tests/fixtures/eggnog_proteins.dmnd, and © 2023 GitHub, Inc. in the footer. debian/copyright says only Files: * / Copyright: 2016-2023 QIIME 2 development team / License: BSD-3-clause.
Problem: The two files are a browser's save of a github.com page (the same page twice, under two names), so their content is GitHub, Inc.'s site and the eggnog-mapper project's page, with no licence granting redistribution, and debian/copyright neither names that holder nor gives terms for them. The tests cannot notice, because DiamondDatabaseFileFmt._validate_ is pass (q2_types/reference_db/_formats.py:97-100, # TODO: have native diamond validation run on db/self.path), so the dmnd tests pass on any file at all. This is the 'GitHub, Inc' holder the scan reported.
Fix: Have upstream drop both files, or replace them with a real DIAMOND database whose source is known, and add a Files: stanza naming that holder and its licence. As they stand they cannot be licensed, so removing them is the fix.

important packaging 2. q2-types-examples takes the whole q2_types/reference_db module, so q2-types alone cannot load its qiime2 plugin ◂

Files: debian/rules:35-37, debian/q2-types.install:1, debian/q2-types-examples.install:1, q2_types/plugin_setup.py:484-494, q2_types/kaiju/_formats.py:9-11, debian/control:38-40
Basis: checked, in the package or with a reference tool
Evidence: dh_install -pq2-types --exclude=/reference_db then dh_install -pq2-types-examples, whose install file is usr/lib/python3*/dist-packages/q2_types/reference_db/*; that glob covers __init__.py, _formats.py, _types.py, _deferred_setup/ and tests/ as well as the data. dh_install turns --exclude=/reference_db into the find expression -regex .*/reference_db.* (Dh_Lib.pm EXCLUDE_FIND; dh_install:286-298), so everything below the directory leaves q2-types. plugin_setup.py's loop re-raises ModuleNotFoundError when e.name starts with q2_types, and q2_types/kaiju/_formats.py does from q2_types.reference_db import NCBITaxonomyNamesFormat, NCBITaxonomyNodesFormat. q2-types-examples is only Enhances: q2-types.
Problem: With q2-types installed and q2-types-examples not (nothing pulls the latter in), q2_types.reference_db does not exist. Importing the plugin entry point walks kaiju._deferred_setup -> q2_types.kaiju._formats -> q2_types.reference_db; the missing name starts with 'q2_types', so the optional-deps.patch re-raises it and q2_types.plugin_setup fails, taking the whole q2-types qiime2 plugin with it. The ReferenceDB/Diamond/Eggnog/NCBITaxonomy/EggnogProteinSequences types and formats disappear from q2-types, although the changelog and the -examples description say that package holds data 'not needed for normal operation'.
Fix: Keep the module in q2-types and split only the data, e.g. dh_install -pq2-types --exclude=/reference_db/tests/data with q2-types-examples installing usr/lib/python3*/dist-packages/q2_types/reference_db/tests/data/*; then check whether debian/tests/control needs q2-types-examples in Depends for the tests that read that data.

minor licensing 3. The GPL-2+ paragraph contains a leftover 'contact Daniel J. Schaid' sentence belonging to another package ◂

Files: debian/copyright:53
Basis: checked, in the package or with a reference tool
Evidence: For other licensing arrangements, please contact Daniel J. Schaid. sits between the GPL notice and the /usr/share/common-licenses/GPL-2 pointer of the stand-alone License: GPL-2+ paragraph.
Problem: It is copied boilerplate that announces an alternative licensing arrangement for debian/* that does not exist, and names a person unconnected with this package; a reader of the copyright file is misled about the terms and the contact.
Fix: Delete that line; the rest of the paragraph is the standard GPL-2+ notice and the common-licenses pointer.

Verified ◂

Read debian/ in full: control, control.in, rules, changelog, copyright, both .install files, patches/series and optional-deps.patch, tests/control and run-unit-test, upstream/metadata, salsa-ci.yml, lintian-overrides, source/format, README.test (debian/watch is out of scope).
The top-level LICENSE (BSD 3-Clause, 2016-2026, QIIME 2 development team) matches the BSD-3-clause text in debian/copyright, and every .py file in q2_types carries the same 'Distributed under the terms of the Modified BSD License' header. Apart from the two .dmnd pages, no other holder or licence statement was found in the tree.
Gzipped FASTQ fixtures for the EMP multiplexed formats: q2_types/feature_data/tests/data/emp_multiplexed/barcodes.fastq.gz, q2_types/feature_data/tests/data/emp_multiplexed/sequences.fastq.gz, q2_types/feature_data/tests/data/emp_multiplexed_single_end/Undetermined_S0_L001_I1_001.fastq.gz, q2_types/feature_data/tests/data/emp_multiplexed_single_end/Undetermined_S0_L001_R1_001.fastq.gz; and for the multiplexed-sequence formats: q2_types/multiplexed_sequences/tests/data/Human-Kneecap_S1_L001_R1_001.fastq.gz, q2_types/multiplexed_sequences/tests/data/forward.fastq.gz, q2_types/multiplexed_sequences/tests/data/reverse.fastq.gz, q2_types/multiplexed_sequences/tests/data/s1-phred64.fastq.gz. All are test data, generated or trimmed fixtures, not built software.
Gzipped FASTQ fixtures at the top of per_sample_sequences (valid reads, phred64 variants and deliberately malformed files used by the negative tests): q2_types/per_sample_sequences/tests/data/0.10_S2_L001_R1_001.fastq.gz, .../1_S1_L001_R1_001.fastq.gz, .../Human-Armpit.fastq.gz, .../Human-Armpit_S2_L001_R1_001.fastq.gz, .../Human-Armpit_S2_R1_001.fastq.gz, .../Human-Kneecap_S1_L001_R1_001.fastq.gz, .../Human-Kneecap_S1_R1_001.fastq.gz, .../incomplete-quality.fastq.gz, .../incomplete-sep.fastq.gz, .../incomplete-sequence.fastq.gz, .../invalid-quality.fastq.gz, .../invalid-sep.fastq.gz, .../mixed-case.fastq.gz, .../not-fastq.fastq.gz, .../partial-record.fastq.gz, .../s1-phred64.fastq.gz, .../s2-phred64.fastq.gz.
Gzipped FASTQ fixtures for the manifest/partitioning tests: q2_types/per_sample_sequences/tests/data/different_file_names/sample_b_S00_L001_R2_001.fastq.gz, .../different_file_names/sample_b_S02_L001_R1_001.fastq.gz, .../paired_end_data/Human-Kneecap_S1_L001_R2_001.fastq.gz, .../paired_end_data_numeric/0.10_S2_L001_R2_001.fastq.gz, .../paired_end_data_numeric/1_S1_L001_R2_001.fastq.gz, .../paired_end_data_overlapping_ids/sample_51_S26_L001_R1_001.fastq.gz, .../paired_end_data_overlapping_ids/sample_51_S26_L001_R2_001.fastq.gz, .../paired_end_data_overlapping_ids/sample_5_S771_L001_R1_001.fastq.gz, .../paired_end_data_overlapping_ids/sample_5_S771_L001_R2_001.fastq.gz, .../unmatched_paired_end/sample-name-1_S1_L001_R1_001.fastq.gz, .../unmatched_paired_end/sample-name-1_S1_L001_R2_001.fastq.gz.
BGZF/gzip-compressed BAM alignment fixtures (gzip member per BAM record block): q2_types/per_sample_sequences/tests/data/bowtie/maps-invalid/sample1.bam, .../maps-invalid/sample2.bam, .../maps-legacy/sample1_alignment.bam, .../maps-legacy/sample2_alignment.bam, .../maps-multi/sample1/map1.bam, .../maps-multi/sample1/map2.bam, .../maps-multi/sample2/map1.bam, .../maps-multi/sample2/map2.bam, .../maps-single/sample1.bam, .../maps-single/sample2.bam; the older two carry the legacy alignment naming the format must still accept.
Gzipped TSV fixtures for the NCBI taxonomy format validators, valid and deliberately malformed: q2_types/reference_db/tests/data/ncbi/too_many_cols.gz, .../ncbi/wrong_accession.gz, .../ncbi/wrong_accession_version.gz, .../ncbi/wrong_col.gz, .../ncbi/wrong_gi.gz, .../ncbi/wrong_taxid.gz, .../ncbi/db-valid/prot.accession2taxid.gz.
The four unrecognised binaries are fixtures for EggnogRefBinFileFmt: q2_types/reference_db/tests/data/good_eggnog/eggnog.db, .../good_eggnog/eggnog.taxa.db, .../good_eggnog/eggnog.taxa.db.traverse.pkl (a pickle) and q2_types/reference_db/tests/data/single_eggnog/eggnog.db. reference_db/tests/test_formats.py:49-79 only feeds them to a validator that checks the file name, and the .db files contain no SQLite schema text; they are not needed at run time and only ship via q2-types-examples.
The 'GitHub, Inc' author the prescan flagged is the footer of the two .dmnd HTML pages (see the first issue), not a holder in any code file.
Binary test fixtures the scan did not list: q2_types/profile_hmms/tests/data/bacteria/bacteria.hmm.h3f, .h3i, .h3m, .h3p (hmmpress output), q2_types/per_sample_sequences/tests/data/bowtie/*/*/*.bt2 (bowtie2 indexes), q2_types/kraken2/tests/data/kraken2-db/hash.k2d, opts.k2d, taxo.k2d and q2_types/kaiju/tests/data/db-valid/kaiju_db_test.fmi. Their generating inputs are not shipped, so they cannot be rebuilt, but the tests only check that the format recognises the pressed/index files; I did not treat them as a licensing defect.
q2_types/reference_db/tests/data/eggnog_seq_tax/e5.taxid_info.tsv and the ncbi/ fixtures are small extracts of NCBI taxonomy data (public-domain factual data) used to exercise the NCBI and Eggnog validators; nothing in them carries licence text.
Packaging checks that came out clean: Standards-Version 4.7.4 is current against Policy 4.7.4.1; compat 14 plus dh-sequence-python3 and pybuild-plugin-pyproject; optional-deps.patch has DEP-3 headers (Description, Author, Last-Update) and a purpose stated in the changelog (#1104050); the two optional modules its rationale names, pyhmmer and frictionless, really are absent from the archive, so the patch is justified; every third-party module imported at run time (numpy, pandas, skbio, biom, h5py, ijson, qiime2) is in q2-types' Depends; debian/tests/control provides an autopkgtest that runs the suite.
uscan found the packaged version as the newest upstream release (upstream 2026.10.0, packaged 2026.10.0).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed ◂

pyproject.toml's build-system.requires names versioningit, which is not packaged anywhere in the archive, and no Build-Depends can provide it; with python3 -m build --no-isolation the wheel's version may be left unset. A build log, or the wheel name (q2_types-0.0.0-.whl against q2_types-2026.10.0-.whl), would show whether the build fails in the backend or the package's __version__ silently falls back to the '0.0.0+notfound' branch of q2_types/init.py.
I did not open the binary fixtures (.k2d, .fmi, .h3*, .bt2, .bam, .pkl, .biom, .db), so whether any of them embeds provenance or a licence statement is unverified; only their names, roles in the tests and the text that is legible to grep were considered.
What these files are. The scan made before the review picked them out (built files, minified code, archives, licence wording that is rarely free, or licences that are not accepted), and this report does not mention them: q2_types/per_sample_sequences/tests/data/1_S1_L001_R1_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/Human-Armpit.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/Human-Armpit_S2_L001_R1_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/Human-Armpit_S2_R1_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/Human-Kneecap_S1_L001_R1_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/Human-Kneecap_S1_R1_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/bowtie/maps-legacy/sample1_alignment.bam (gzip-compressed file); q2_types/per_sample_sequences/tests/data/bowtie/maps-legacy/sample2_alignment.bam (gzip-compressed file); q2_types/per_sample_sequences/tests/data/bowtie/maps-multi/sample1/map1.bam (gzip-compressed file); q2_types/per_sample_sequences/tests/data/bowtie/maps-multi/sample1/map2.bam (gzip-compressed file); q2_types/per_sample_sequences/tests/data/bowtie/maps-multi/sample2/map1.bam (gzip-compressed file); q2_types/per_sample_sequences/tests/data/bowtie/maps-multi/sample2/map2.bam (gzip-compressed file); q2_types/per_sample_sequences/tests/data/bowtie/maps-single/sample1.bam (gzip-compressed file); q2_types/per_sample_sequences/tests/data/bowtie/maps-single/sample2.bam (gzip-compressed file); q2_types/per_sample_sequences/tests/data/different_file_names/sample_b_S02_L001_R1_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/incomplete-quality.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/incomplete-sep.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/incomplete-sequence.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/invalid-quality.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/invalid-sep.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/mixed-case.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/not-fastq.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/paired_end_data/Human-Kneecap_S1_L001_R2_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/paired_end_data_numeric/0.10_S2_L001_R2_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/paired_end_data_numeric/1_S1_L001_R2_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/paired_end_data_overlapping_ids/sample_51_S26_L001_R1_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/paired_end_data_overlapping_ids/sample_51_S26_L001_R2_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/paired_end_data_overlapping_ids/sample_5_S771_L001_R1_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/paired_end_data_overlapping_ids/sample_5_S771_L001_R2_001.fastq.gz (gzip-compressed file); q2_types/per_sample_sequences/tests/data/partial-record.fastq.gz (gzip-compressed file), and 2 more.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-13 17:27 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package