DFSG NEW review for qttesting version 1.0.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All source is DFSG-free: the core C++ code is BSD-3-clause (Kitware Inc, Sandia Corporation), test code and header pqTest.h additionally Apache-2.0, and the clear.svg icon is public domain. No non-free terms, no built blobs (BUILD_TESTING is off; only source ships). debian/copyright is in DEP-5 format with a correct Files:* catch-all, a specific pqTest.h stanza, and full licence texts included. Two minor inaccuracies: pqTest.h is dual-licensed BSD-3-Clause AND Apache-2.0 but the stanza says Apache-2 or BSD-3-clause, and clear.svg is public domain but is grouped under the Kitware/Sandia BSD-3 catch-all. Neither affects DFSG compliance.

Packaging

Clean, modern packaging: debhelper compat 14, single dh rules file with hardening=+all, correct two-way split (runtime lib + -dev), valid Build-Depends (qt6-base-dev, dh-exec, pkgconf, cmake all exist in the archive), proper install files using dh-exec multiarch substitution, Vcs-* pointing at salsa science-team matching the Maintainer, and Standards-Version 4.7.4. One defect: debian/copyright's header has Source: TODO, an unfilled placeholder that a sponsor would require to be completed before upload.

Issues

1. [important] [packaging] debian/copyright contains an unfilled Source: TODO placeholder

• Files: debian/copyright:3
• Basis: checked, in the package or with a reference tool
• Evidence: Line 3 of debian/copyright reads Source: TODO.
• Problem: The Source header field of the machine-readable copyright file is left as a literal TODO placeholder rather than naming where the upstream source was obtained. It indicates unfinished metadata in a required file and would be flagged by a sponsor before an initial upload.
• Fix: Replace TODO with the upstream source URL (e.g. https://gitlab.kitware.com/paraview/qttesting or the tarball URL), and add an Upstream-Name/Upstream-Contact if desired.

2. [minor] [licensing] pqTest.h dual licence described with or where the file says AND

• Files: debian/copyright:8-12, Testing/Cpp/pqTest.h:3
• Basis: checked, in the package or with a reference tool
• Evidence: pqTest.h header states SPDX-License-Identifier: BSD-3-Clause AND Apache-2.0, but the corresponding Files stanza says License: Apache-2 or BSD-3-clause.
• Problem: AND means both licences apply simultaneously; or lets a recipient pick one. The discrepancy would give a recipient a materially different licence grant than the author intended. Harmless to DFSG compliance since both licences are free and the BSD-3 text is included, but it misdescribes the actual terms.
• Fix: Change the pqTest.h stanza to License: BSD-3-clause and Apache-2 (or note the dual grant) to match the SPDX AND.

3. [minor] [licensing] clear.svg is public domain but grouped under the Kitware/Sandia BSD-3 catch-all

• Files: Resources/Icons/clear.svg, debian/copyright:4-7
• Basis: checked, in the package or with a reference tool
• Evidence: clear.svg (sodipodi docname round_error_warning_icon.svg, author Molumen) embeds <cc:license rdf:resource="http://web.resource.org/cc/PublicDomain" /> with Reproduction/Distribution/DerivativeWorks permits; it is covered by the Files: * stanza attributing Kitware Inc / Sandia Corporation under BSD-3-clause.
• Problem: The icon is public domain, not BSD-3-clause held by Kitware/Sandia, so the copyright attribution and licence in the catch-all stanza are inaccurate for that file. Both terms are free, so this does not affect DFSG compliance.
• Fix: Either add a specific Files stanza for Resources/Icons/clear.svg stating it is public domain, or add a Comment noting the public-domain source while it remains covered by the catch-all.

Verified

• All ~120 upstream .cxx/.h files carry SPDX-FileCopyrightText: Copyright (c) Kitware Inc. / Sandia Corporation and SPDX-License-Identifier: BSD-3-Clause, matching the Files: * stanza.
• Copyright.txt (project root) is the Kitware Inc. 2000 BSD-3-clause text; debian/copyright reproduces the full BSD-3-clause and Apache-2.0 texts.
• debian/* stanza (IFIC, CSIC-UV, Apache-2) correctly covers packaging files; no Debian file carries a conflicting licence.
• pqTest.h is the only file with an Apache-2 element; its Files stanza overrides the catch-all per DEP-5 later-stanza rule.
• Resources icons are source-form SVG or PNG under Resources/QtTesting.qrc; no built/lost-source artifacts were found (prescan reported only the listed holders, all named in debian/copyright).
• Build-Depends resolve: qt6-base-dev 6.11.2+dfsg-6, dh-exec 0.31, pkgconf, cmake all present in the archive.
• dh-exec is required and present; it expands ${DEB_HOST_MULTIARCH} in both .install files (dh_install runs dh-exec automatically).
• debian/rules sets hardening=+all and exports build flags; dh at compat 14 handles relationship substvars itself, so the two binary stanzas' Depends fields are complete.
• libqttesting1.install (libqttesting.so.*) and libqttesting-dev.install (headers, .so symlink, cmake config) match the CMake install layout (SOVERSION 1); dev depends on the runtime package at ${binary:Version}.
• Standards-Version 4.7.4 is current (first two components 4.7).
• Vcs-Git/Vcs-Browser point at salsa.debian.org/science-team/qttesting, matching the Debian Science Team maintainer; Homepage matches upstream.
• No debian/tests (autopkgtest) exists; not required. No maintainer scripts or maintscript files exist, so no idempotence concern.
• uscan found the packaged version as the newest upstream release (upstream 1.0.1, packaged 1.0.1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

None.

Proposed changes

None.