DFSG NEW review for qcom-va-driver version 1.1.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is MIT/Expat (the upstream LICENSE carries the full text and every source file says SPDX-License-Identifier: MIT), except the five Linux kernel patches under patches/, which are correctly declared GPL-2.0-only with a pointer to /usr/share/common-licenses/GPL-2 and are not combined with the driver. Nothing non-free, no missing licence, no vendored third-party code and no generated binary without its input. The DEP-5 debian/copyright matches every other holder and licence; the only gap is one holder line, reported below as minor.

Packaging

Solid, conventional packaging: debhelper compat 13 with meson, arm64-only Architecture and Multi-Arch: same, a separate hardware-test package consistently gated by the noinsttest build profile in control, rules and Build-Depends, DEP-3 patches, an autopkgtest that loads the driver without hardware, and a README.Debian that explains every deliberate departure from upstream (CDSP disabled, renamed driver, GStreamer settings not installed). Installed paths match meson's libdir/libexecdir under dh, and the test binaries match what the wrapper script runs. Standards-Version 4.7.4 is current against Policy 4.7.4.1.

Issues

1. [minor] [licensing] Files: * gives only "libva-v4l2 contributors" for the four tests/*/meson.build files, which record Qualcomm Technologies as copyright holder

• Files: debian/copyright:6-8, debian/copyright:10-13, tests/meson.build:2, tests/decoder/meson.build:2, tests/encoder/meson.build:2, tests/vpp/meson.build:2, debian/patches/0001-Build-and-install-the-hardware-tests.patch:124-125
• Basis: checked, in the package or with a reference tool
• Evidence: The four files say # Copyright (c) 2026 Qualcomm Technologies, Inc. and/or its subsidiaries; debian/copyright has Files: * / Copyright: 2026 libva-v4l2 contributors, and Qualcomm appears only under Files: debian/*.
• Problem: copyright-format 6.9: patterns are anchored at the root of the tree and the last matching stanza wins, so debian/* does not reach tests/; the stanza that does match those four files names a different holder, so their recorded copyright is not described by debian/copyright (copyright-format 5.2 requires the Copyright field of the matching stanza). The licence (Expat) is correct and unaffected.
• Fix: Name Qualcomm in the Files: * Copyright field, or add a Files: tests/*/meson.build stanza with both holders (2026 libva-v4l2 contributors, 2026 Qualcomm Technologies, Inc. and/or its subsidiaries) and License: Expat.

Verified

• The prescan listed no files: its author check found every holder it saw already named in debian/copyright, and my own search of the tree found no holder beyond libva-v4l2 contributors, Xilin Wu and Qualcomm Technologies.
• Read debian/ in full: control, rules, changelog, copyright, install/docs/not-installed, gbp.conf, salsa-ci.yml, lrc.config, README.Debian, source/format, source/lintian-overrides, upstream/metadata, tests/control, tests/driver-load, scripts/qcom-va-driver-tests, both patches and patches/series.
• Grep of the whole tree for Copyright, (C), ©, SPDX-License-Identifier, GNU ..., Apache, MPL, BSD, ISC, public domain, All rights reserved, non-commercial, NoDerivatives, Creative Commons found only MIT/Expat notices (including src/cdsp/iris_vpp.idl, the only source file without an SPDX tag, and the README/LICENSE) plus the kernel patches' GPL references.
• patches/ holds five Linux kernel patches, each From:/Signed-off-by: Xilin Wu <sophon@radxa.com>; the Files: patches/* GPL-2.0-only stanza and the LICENSE's closing paragraph describe them correctly. They are shipped source only and never linked with the MIT driver.
• No third-party code is vendored: subprojects/ holds three .wrap files (qualcomm/fastrpc, QAIC, Hexagon Open Access, fetched from vendor URLs at build time only) and upstream's own MIT build shims. With -Dcdsp_vpp=disabled in debian/rules the src/cdsp subdir and those wraps are never used, and debhelper's meson buildsystem passes --wrap-mode=nodownload (read in /usr/share/perl5/Debian/Debhelper/Buildsystem/meson.pm).
• subprojects/packagefiles/hexagon/meson.build has project(... license: 'proprietary'); that names the Hexagon Open Access SDK the wrap points to, not the file, which is upstream's MIT shim and documented as such in debian/lrc.config. The BSD-3-Clause and BSD-3-Clause-Clear license: fields in the fastrpc and qaic shims are the same case.
• No built files, minified code, bytecode, archives, PDFs, images or fonts in the tree; the generators for the CDSP path (src/cdsp/build-dsp.py, subprojects/packagefiles/*/build.py) are shipped. tests/build/gpu-copy.py and tests/vpp/check-abi.py only drive builds at development time.
• .pc/ and the empty debian/tests/__pycache__/ were skipped; there is no debian/cargo-checksum.json, and no .pyc is shipped (.gitignore excludes them).
• debhelper compat 13: dh passes --libdir=lib/$(DEB_HOST_MULTIARCH) (matching usr/lib/*/dri/ in qcom-va-driver.install, the msm_drv_video.so relative symlink and the wrapper's /usr/lib/aarch64-linux-gnu/dri path) and does not override libexecdir, so meson's default /usr/libexec matches qcom-va-driver-tests.install.
• Build-Depends resolve: dh-sequence-libva is provided by libva-dev 2.24.1-2, and glslang-tools, libgles-dev, libva2 and vainfo exist in the archive; libva-drm and gstreamer-app-1.0/gstreamer-video-1.0 come with libva-dev and libgstreamer-plugins-base1.0-dev.
• ${shlibs:Depends} and ${misc:Depends} are declared and still needed at compat 13; the noinsttest profile in the tests package's Build-Profiles, in the < !noinsttest > Build-Depends markers and in rules' BUILD_TESTS agree with each other.
• Paths in qcom-va-driver-tests match the patched tests/*/meson.build install rules (main10, prime-import, api-smoke, async, writable-export, vpp-overlay, vpp-tonemap, vpp-scaling, the three Python scripts and the four preload shims); the shims and scripts are installed with mode 0755 by install_mode, and debian/not-installed covers the dropped meson-installed README.md and LICENSE.
• debian/tests/driver-load only dlopen()s the installed driver and resolves __vaDriverInit_1_0; it needs no device, and its Depends (python3, qcom-va-driver) plus the .dsc's Testsuite: autopkgtest/Testsuite-Triggers: python3 are consistent.
• Standards-Version 4.7.4 matches Policy 4.7.4.1's first two components; changelog is 1.1.0-1 to unstable with an ITP closure; Vcs-Git/Vcs-Browser/Homepage and debian/upstream/metadata are well formed; both Debian patches carry From/Date/Subject/Forwarded/Last-Update.
• debian/salsa-ci.yml disables the amd64/i386 builds and the artifact-consuming jobs, which is consistent with an arm64-only package.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.1.1, packaged 1.1.0), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed

• Unlike i965-va-driver (libva-driver-abi-1.22) and intel-media-va-driver (libva-driver-abi-1.24), qcom-va-driver declares no libva-driver-abi-* dependency. libva-dev ships the dh-sequence-libva addon but it is not installed here, so I could not check whether that addon adds the field; if it does not, the driver does not pin the libva driver ABI it implements.
• I could not check the file modes of debian/tests/driver-load and debian/scripts/qcom-va-driver-tests (autopkgtest and dh_install need them executable), and did not build the package or run its tests.

Proposed changes

None.