DFSG NEW Queue

DFSG, Licensing & New Packages Team

qdl 2.9-2

Package Information

Descriptiontool to communicate with Qualcomm EDL USB devices

qdl is a tool for communicating with Qualcomm processors using the Emergency Download (EDL), Validated Image Programming (VIP) and Sahara protocols over USB.

It can upload a Firehose programmer to a device, flash device storage, read device storage and collect a RAM dump from a crashed device.

MaintainerChristopher Obbard <chris.obbard@oss.qualcomm.com>
Changed ByChristopher Obbard <chris.obbard@oss.qualcomm.com>
Sponsorobbardc@debian.org
Distributionunstable
Architectureany
VCSgit: https://salsa.debian.org/debian/qdl.git (browse)
Popcon Installs42
Binary NEWYes (new binary packages of a source already in sid)
Trackerhttps://tracker.debian.org/pkg/qdl
Uploaded15 hours ago

New Package Report

.changes◂
DateWed, 04 Nov 2026 01:56:20 +0000
Sourceqdl
Version2.9-2
Changed-ByChristopher Obbard <chris.obbard@oss.qualcomm.com>
Architectureamd64 arm64 armhf i386 ppc64el source
Distributionunstable
Changelog◂
qdl (2.9-2) unstable; urgency=medium
 .
   * d/control: skip help2man for cross and nodoc builds
   * d/control: skip test build dependencies for nocheck builds
   * d/control: add nbdkit-plugin-qdl binary package
   * d/rules: install the man page only when it is generated
.dsc◂
Package-Listnbdkit-plugin-qdl deb admin optional arch=any
qdl deb utils optional arch=any
Sectionadmin
Priorityoptional
Componentmain
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: qdl
Upstream-Contact: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
Source: https://github.com/linux-msm/qdl

Files: *
Copyright: 2016, Bjorn Andersson <bjorn@kryo.se>
 2016, 2017, Linaro Ltd.
License: BSD-3-clause

Files: include/qdl.h
 src/patch.h
 src/program.h
 src/usb.c
Copyright: 2016, Bjorn Andersson <bjorn@kryo.se>
 2016, 2017, Linaro Ltd.
 Qualcomm Technologies, Inc. and/or its subsidiaries.
License: BSD-3-clause

Files: src/firehose.c
 src/qdl.c
 src/sahara_config.c
Copyright: 2018, The Linux Foundation.
 2016, 2017, Linaro Ltd.
License: BSD-3-clause

Files: src/list.h
 src/patch.c
 src/program.c
 src/read.c
 src/sahara.c
Copyright: 2016, 2017, Linaro Ltd.
License: BSD-3-clause

Files: src/ufs.c
 src/ufs.h
Copyright: 2018, The Linux Foundation.
License: BSD-3-clause

Files: src/util.c
Copyright: 2016, Bjorn Andersson <bjorn@kryo.se>
License: BSD-3-clause

Files: src/auto.c
 src/cli.c
 src/cli.h
 src/contents.c
 src/contents.h
 src/file.c
 src/file.h
 src/file_nozip.c
 src/file_zip.c
 src/firehose.h
 src/flashmap.c
 src/flashmap.h
 src/gpt.c
 src/gpt.h
 src/input_type.c
 src/input_type.h
 src/nbdkit-qdl-plugin.c
 src/oscompat.c
 src/oscompat.h
 src/pathbuf.c
 src/pathbuf.h
 src/programmer.c
 src/programmer.h
 src/qud.c
 src/read.h
 src/ux.c
 src/ux.h
 src/zipper.c
 tests/common.c
 tests/common.h
 tests/data/*
 tests/meson.build
 tests/test_cli.c
 tests/test_contents_selectors.c
 tests/test_contents_xml.c
 tests/test_firehose.c
 tests/test_flashmap.c
 tests/test_hil.sh
 tests/test_hil_vip.sh
 tests/test_input_type.c
 tests/test_op_loaders.c
 tests/test_oscompat.c
 tests/test_pathbuf.c
 tests/test_program_load_xml.c
 tests/test_programmer.c
 tests/test_sahara_archive.py
 tests/test_ufs.c
 tests/test_usb.c
 tests/test_util.c
 tests/test_ux.c
 tests/test_vip_generation.sh
 udev/*
Copyright: Qualcomm Technologies, Inc. and/or its subsidiaries.
License: BSD-3-clause

Files: src/json.c
 src/json.h
Copyright: Qualcomm Technologies, Inc. and/or its subsidiaries.
 2018, 2019, Linaro Ltd.
License: BSD-3-clause

Files: src/io.c
 src/sim.c
 src/sim.h
 src/vip.c
 src/vip.h
Copyright: 2025, Qualcomm Innovation Center, Inc.
License: BSD-3-clause

Files: src/sha2.c
 src/sha2.h
Copyright: 2000, 2001, Aaron D. Gifford <me@aarongifford.com>
License: BSD-3-clause

Files: src/sparse.c
Copyright: 2025, Maksim Paimushkin <maxim.paymushkin.development@gmail.com>
License: BSD-3-clause

Files: src/sparse.h
Copyright: 2010, The Android Open Source Project
License: Apache-2.0

Files: debian/*
Copyright: 2022-2026, Christopher Obbard <obbardc@debian.org>
 2026, Qualcomm Technologies, Inc. and/or its subsidiaries.
License: BSD-3-clause

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
 1. Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright
 notice, this list of conditions and the following disclaimer in the
 documentation and/or other materials provided with the distribution.
 .
 3. Neither the name of the copyright holder(s) nor the names of any
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
 IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
 PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 14 hours ago.

Report◂

DFSG NEW review for qdl version 2.9-2

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 2 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 and covers the whole tree: the Files: * catch-all plus twelve per-path stanzas name, for each group, the holders its headers state (Bjorn Andersson/Linaro, The Linux Foundation, Qualcomm Technologies, Qualcomm Innovation Center, Aaron D. Gifford, Maksim Paimushkin, AOSP). Everything is BSD-3-Clause except src/sparse.h, which is Apache-2.0 and is declared as such with its text and a /usr/share/common-licenses pointer; the two licences combine without conflict. The full BSD-3 text is in the file, the prescan's author check found no unnamed holder, and there are no non-free terms, unlicensed files or built artefacts.

Packaging

Competent packaging: source format 3.0 (quilt), debhelper compat 14 with a small dh rules file, build profiles handled for help2man, cmocka and zip, every Build-Depends present in the archive, Standards-Version 4.7.4, a sensible two-package split with coherent Multi-Arch fields, a DEP-3 patch forwarded upstream, and a three-stanza autopkgtest suite. Two minors: the plugin depends on qdl without using it, and the build-needed autopkgtest writes into the build tree without declaring rw-build-tree.

Issues

minor packaging 1. nbdkit-plugin-qdl depends on qdl although it neither runs it nor links against it ◂
  • Files: debian/control, src/meson.build, meson.build, debian/nbdkit-plugin-qdl.install
  • Basis: inferred from what was read, not seen directly
  • Evidence: Depends: nbdkit, qdl (= ${binary:Version}),; meson.build builds the module from nbdkit_plugin_src + lib_sources + common_sources with no link_with, and nbdkit-plugin-qdl.install installs only usr/lib/*/nbdkit/plugins/nbdkit-qdl-plugin.so.
  • Problem: qdl's sources are compiled into the plugin module and nothing executes /usr/bin/qdl, so the strict versioned dependency only forces the plugin and qdl to be upgraded in lockstep and pulls in a package the plugin does not use. The only thing qdl could supply is its udev rules, and docs/nbd.md tells users to run nbdkit under sudo.
  • Fix: Drop qdl (= ${binary:Version}); if the udev rules really are the reason, use an unversioned qdl.
minor packaging 2. autopkgtest upstream-tests writes into the build tree without declaring rw-build-tree ◂
  • Files: debian/tests/control, debian/tests/upstream-tests
  • Basis: checked, in the package or with a reference tool
  • Evidence: Restrictions: allow-stderr, build-needed; the script runs meson configure "$BUILD_DIR" -Dtests=enabled and meson test -C "$BUILD_DIR", which write meson-private/, build.ninja and the test binaries into obj-$(dpkg-architecture -qDEB_HOST_GNU_TYPE).
  • Problem: The autopkgtest specification says rw-build-tree is for a test that needs "write access to the built source tree (so it may need to be copied first)", and that tests must declare all applicable Restrictions. Runners that execute tests unprivileged only provide a writable copy when the restriction is declared, and the meson commands would then fail to write.
  • Fix: Add rw-build-tree to the Restrictions of the upstream-tests stanza.
Verified ◂
  • debian/copyright read in full: DEP-5 with the standard Format URL, Files-Excluded not used (and nothing excluded from the tree).
  • Per-file headers matched against the stanzas: include/qdl.h, src/patch.h, src/program.h and src/usb.c (Qualcomm Technologies) are in their own stanza; src/firehose.c, src/qdl.c and src/sahara_config.c (Linaro + The Linux Foundation), src/list.h, src/patch.c, src/program.c, src/read.c, src/sahara.c (Linaro), src/ufs.c/h (Linux Foundation), src/util.c (Bjorn Andersson), src/json.c/h (Qualcomm + Linaro), src/io.c, src/sim.c/h, src/vip.c/h (Qualcomm Innovation Center), src/sha2.c/h (Aaron D. Gifford) and src/sparse.c (Maksim Paimushkin) each have the stanza that names their holder.
  • src/sparse.h is the only Apache-2.0 file (SPDX-License-Identifier: Apache-2.0, Copyright (C) 2010 The Android Open Source Project) and has its own stanza and licence paragraph; Apache-2.0 and BSD-3-Clause are compatible in one binary.
  • src/sha2.c/h keep the OpenBSD copy of Gifford's SHA-2 code (BSD-3-Clause, no non-free clause); src/list.h and src/sparse.c are small original BSD-3 files, not copies of GPL kernel or AOSP code.
  • Files without a notice (LICENSE, README.md, CHANGELOG.md, CONTRIBUTING.md, RELEASING.md, AGENTS.md, CLAUDE.md, commitlint.config.mjs, meson.build, meson_options.txt, include/version.h.in, src/meson.build, scripts/*.sh, .checkpatch.conf, .gitignore, .github/**) fall under Files: *, whose BSD-3-Clause matches README's BSD 3-Clause statement and meson.build's license: 'BSD-3-Clause'.
  • The prescan's author check reported no unnamed holder; I re-checked its nine names against the headers. No file contains non-free wording (no NC/ND/field-of-use/no-modification terms); the only All rights reserved lines accompany BSD-3 headers.
  • tests/data/*.xml and flashmap.json are synthetic fixtures (An ** Autogenerated file **, unit-test layout), not firmware; the tests build their inputs with tests/data/generate_flat_build.sh.
  • No built binaries, bytecode, minified code, PDFs, images or fonts in the tree. The only generated files are include/version.h (from include/version.h.in) and qdl.1 (help2man against the built qdl), both produced by the build.
  • debian/patches/0001-tests-build-test_firehose-without-jump-tables.patch touches only tests/meson.build, matches the patched tree, and has From/Date/Subject, an explanation and Forwarded:; series lists it.
  • debian/rules is a plain dh $@ at compat 14 with three overrides; compat 14 adds the relationship substvars itself, so naming them is harmless, and dh_auto_install uses debian/tmp because two binary packages exist.
  • Build-Depends all exist in the archive: nbdkit-plugin-dev, systemd-dev (Architecture: all, provides udev.pc), libcmocka-dev, meson (depends on ninja-build), zip, help2man, pkgconf.
  • Multi-Arch fields are consistent: qdl is foreign, the plugin is same, and its only architecture-independent payload (copyright, changelog, nbd.md) is identical; nbdkit and qdl are both Multi-Arch: foreign.
  • debian/changelog is well formed for unstable at 2.9-2, Standards-Version 4.7.4 matches the Policy on this system (4.7.4.1), Vcs-*, Homepage and debian/upstream/metadata agree, and debian/gbp.conf uses the branches named in Vcs-Git.
  • The nbdkit plugin uses NBDKIT_API_VERSION 2 and meson installs it to /usr/lib//nbdkit/plugins through dh's --libdir=lib/; Debian's nbdkit predates this by many releases, and the autopkgtest loads it with nbdkit --dump-plugin qdl.
  • The udev rule is installed from the generated udev/70-qdl.rules.in via debian/qdl.install at /usr/lib/udev/rules.d (udev.pc), and no maintainer scripts are needed or present.
  • I did not read debian/watch (checked separately), .pc/, or debian/cargo-checksum.json (absent).
  • uscan found the packaged version as the newest upstream release (upstream 2.9, packaged 2.9).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
  • debian/tests/control has Depends: qdl, and Depends: nbdkit-plugin-qdl,: a trailing comma is not valid dependency-field syntax (Policy 7.1), but autopkgtest is not installed here, so I could not see whether its parser rejects the stanza or silently drops the empty entry.
  • I could not build anything. If a nodoc-profile build is run where help2man happens to be installed, meson still generates and installs qdl.1 into debian/tmp, while debian/rules' ifeq tests the profiles rather than whether the file exists and so skips the dh_installman override; dh_missing (--fail-missing by default at compat 14) would then fail on the uninstalled man page. A build with and without help2man would show it.
Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 14 hours ago.

Back to Dashboard | View all reviews for this package