quicktree 2.5-7

Package Information

Description	Neighbor-Joining algorithm for phylogenies QuickTree is an efficient implementation of the Neighbor-Joining algorithm (PMID: 3447015), capable of reconstructing phylogenies from huge alignments in time less than the age of the universe. QuickTree accepts both distance matrix and multiple-sequence-aligment inputs. The former should be in PHYLIP format. The latter should be in Stockholm format, which is the native alignment format for the Pfam database. Alignments in various formats can be converted to Stockholm format with the sreformat program, which is part of the HMMer package (hmmer.org). The tress are written to stdout, in the Newick/New-Hampshire format use by PHYLIP and many other programs
Maintainer	Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed By	Andreas Tille <tille@debian.org>
Sponsor	tille@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/med-team/quicktree.git (browse)
Popcon Installs	126
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/quicktree
Uploaded	2 hours ago

New Package Report

.changes◂

Date	Fri, 06 Nov 2026 08:13:24 +0100
Source	quicktree
Version	2.5-7
Changed-By	Andreas Tille <tille@debian.org>
Architecture	source amd64
Distribution	unstable

Changelog◂

quicktree (2.5-7) unstable; urgency=medium
 .
   * Team upload.
   * Add new binary package libquicktree2
   * d/watch: version=5
   * Standards-Version: 4.7.4 (routine-update)
   * Reflow Uploaders field (cme)
   * Remove Priority field (cme)
   * Drop 'Rules-Requires-Root: no' from d/control (routine-update)
   * Reformat the Last-Update date as ISO YYYY-MM-DD.
   * Avoid explicitly specifying -Wl,--as-needed linker flag.

.dsc◂

Package-List	libquicktree-dev deb libdevel optional arch=any libquicktree2 deb libs optional arch=any quicktree deb science optional arch=any
Section	libdevel
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: QuickTree
Source: https://github.com/khowe/quicktree

Files: *
Copyright: 2002-2020 Genome Research Limited
                     Kevin Howe <klh@ebi.ac.uk>
License: Apache-2.0

Files: debian/*
Copyright: 2020 Steffen Moeller <moeller@debian.org>
           2023 Lance Lin <lq27267@gmail.com>
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for quicktree version 2.5-7

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

All 27 upstream files are under Apache-2.0: LICENSE is the full text, and every .c/.h file carries the Apache-2.0 notice with Copyright (C) Genome Research Limited, 2002-. Apache-2.0 is DFSG-free and is in /usr/share/common-licenses, which debian/copyright correctly points to; no other licence, and nothing non-free, appears anywhere in the tree. The DEP-5 file matches the upstream code accurately; its only defect is the debian/* stanza's claim over the test data, which was copied from bioperl-run (minor).

Packaging

The modern parts are right: compat 14, DEP-5 copyright, autopkgtest with a real functional and ABI check, a symbols file, Multi-Arch on both library packages, a correct soname, and hardening flags that reach the compiler through the patched Makefile. What a sponsor would stop on is that debian/rules edits upstream source with two sed -i calls during dh_auto_build, and debian/source/options then tells dpkg-source to ignore changes to exactly those two files; the change belongs in a quilt patch. One of the two seds never matches at all, so the spelling fix it was added for is still absent from the binary.

Issues

important packaging 1. debian/rules rewrites upstream source with sed during the build, and debian/source/options hides the modification from dpkg-source ◂

Files: debian/rules:10-11, debian/source/options:1, src/tree.c:432, src/quicktree.c:175
Basis: checked, in the package or with a reference tool
Evidence: debian/rules: sed -i 's/expexted/expected/' src/tree.c and sed -i 's/optio\n/option/' src/quicktree.c; debian/source/options: extend-diff-ignore = "(^|/)(src\/quicktree\.c|src\/tree\.c)$"
Problem: Changes to upstream source are made by the build instead of by a patch, so they are not in debian/patches, cannot be reviewed as a diff, cannot be forwarded, and are lost by any quilt-based workflow; the source tree the build actually compiles is not the tree the patches describe. extend-diff-ignore exists only to silence the dpkg-source warning about these unrepresentable changes, and as a side effect any later accidental edit to src/tree.c or src/quicktree.c (the two most likely files to be patched) is silently ignored too. Policy 4.3 expects source changes to be sent upstream in patch form; Debian practice puts them in debian/patches.
Fix: Move both substitutions into a DEP-3 patch (they are one fix-the-error-messages change) added to debian/patches/series, and drop debian/source/options (or at least its extend-diff-ignore).

minor licensing 2. debian/* stanza claims Apache-2.0 for debian/tests/data/cysprot.stockholm, which comes from bioperl-run ◂

Files: debian/copyright:11-14, debian/tests/README:4, debian/tests/data/cysprot.stockholm
Basis: inferred from what was read, not seen directly
Evidence: Files: debian/* / Copyright: 2020 Steffen Moeller <moeller@debian.org> 2023 Lance Lin <lq27267@gmail.com> / License: Apache-2.0; debian/tests/README: "The data for tests has been referenced from: https://salsa.debian.org/med-team/bioperl-run/-/blob/master/t/data/cysprot.stockholm"
Problem: debian/tests/data/cysprot.stockholm is a Stockholm alignment taken from another Debian source package, not a file written by either holder named in the debian/* stanza, and nothing suggests it is Apache-2.0. debian/copyright therefore states the wrong origin and licence for that file, which is exactly the provenance question a DFSG review asks about test and data files; the file itself carries no copyright or licence header (its first line is # STOCKHOLM 1.0).
Fix: Add a separate Files: debian/tests/data/* stanza recording where the alignment came from (bioperl-run's t/data, i.e. the Pfam/UniProt-derived data) and its licence, leaving debian/* for the packaging files.

minor packaging 3. the sed for src/quicktree.c never matches, so the '-in' error message still reads "optio" ◂

Files: debian/rules:11, src/quicktree.c:175
Basis: checked, in the package or with a reference tool
Evidence: sed -i 's/optio\n/option/' src/quicktree.c against fatal_util("Error: Incorrect use of '-in' optio\n%s\n", usage );; sed(1): "The \n sequence in a regular expression matches the newline character"
Problem: sed works on one line at a time with the newline removed, so a pattern containing \n can never match the two characters backslash-n that appear in the C string; the substitution is a silent no-op and the typo the 2.5-5 changelog entry ("Fix spellings") claims to fix is still in the program. Only the src/tree.c sed has any effect.
Fix: As a patch, replace optio with option (or match the literal \\n), and check the result against the built binary.

Verified ◂

Prescan: no built files, no non-free licence wording and no copyright holder missing from debian/copyright were flagged, so the scan produced no file list to work through.
Licensing inventory complete: 27 upstream files — src/*.c (12), include/*.h (12), Makefile, README.md, LICENSE. All .c and 11 of the .h files carry Copyright (C) Genome Research Limited, 2002- and the Apache-2.0 notice; include/version.h carries the same Apache-2.0 notice with Author: Torsten Seemann and no copyright line, so the Files: * stanza still covers it.
LICENSE is the full Apache-2.0 text with the appendix placeholder only; debian/copyright is DEP-5, its Format: is the current 1.0 URL, Files: * covers src/, include/, Makefile, README.md and LICENSE, and debian/* correctly overrides it for debian/.
/usr/share/common-licenses/Apache-2.0 is the correct target for the pointer, and Apache-2.0 is the DFSG-free licence the files' notices name.
Grep over src/, include/ and debian/ for GNU|Lesser|General Public|public domain|All rights reserved|non-commercial|Creative Commons|MIT License|BSD|Mozilla|no modification|Redistribution: no matches, so there is no second licence in the tree.
Packaging files read in full: changelog, control, rules, clean, copyright, examples, quicktree.install, manpages, libquicktree2.symbols, quicktree.htm, source/format, source/options, tests/control, tests/run-unit-test, tests/README, upstream/metadata, salsa-ci.yml, and all five patches with patches/series.
Standards-Version: 4.7.4 against Policy 4.7.4.1 — first two components equal, so not an issue. Changelog is unstable, version 2.5-7, dated today; Vcs-* and Homepage point at the right places.
d-shlibs 0.111 and hmmer2 2.3.2+dfsg-12 exist in the archive (apt-cache), so Build-Depends: d-shlibs and Suggests: hmmer|hmmer2 are satisfiable; help2man and debhelper-compat (= 14) are the only other build dependencies and both are used.
Hardening reaches the compiler: hardening=+all, and the patched Makefile uses CC ?=, CFLAGS ?=/+= and LDFLAGS += so dpkg-buildflags values are kept; the shared library is built from separate -fPIC objects with -Wl,-soname,libquicktree.so.2. debian/clean removes the generated libquicktree.so* symlinks and quicktree.1 is removed in override_dh_auto_clean.
Soname, package names and symbols are consistent: libquicktree.so.2 ↔ libquicktree2, 57 @Base 2.5 entries in debian/libquicktree2.symbols, libquicktree-dev in libdevel with Multi-Arch: same and Depends: libquicktree2 (= ${binary:Version}), ${misc:Depends}/${shlibs:Depends} present in the binary packages.
The autopkgtest is a real test: it runs quicktree -upgma -boot 0 on the installed example and then compiles a small program against /usr/include/quicktree and checks with ldd that it links libquicktree.so.2, matching what the two library packages are meant to ship.
Patches are on-topic and have DEP-3 headers (fixMake and create_lib lack a Forwarded: field, a nit not worth reporting); build_shared_library.patch carries a full rationale.
uscan found the packaged version as the newest upstream release (upstream 2.5, packaged 2.5).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

debian/tests/run-unit-test runs gunzip -r * over the installed example, but debian/examples ships debian/tests/data/cysprot.stockholm uncompressed (# STOCKHOLM 1.0 on line 1). gzip reports an uncompressed file as unknown suffix -- ignored and its manual says a warning gives exit status 2, which under set -e would abort the script before the quicktree run; I could not run gzip here, so a debci run would show whether the autopkgtest fails at that line.
Nothing in the package installs libquicktree.a: debian/quicktree.install lists only the binary, there is no libquicktree-dev.install, and d-shlibmove is given only libquicktree.so. d-shlibs is not installed on the reviewing system, so I could not check whether d-shlibmove also moves the static archive; if it does not, libquicktree-dev does not contain the static library its description says it does, and the reason libquicktree.a was added in 2.5-3 is defeated.
debian/rules:12 runs help2man with its default help option (--help), but quicktree accepts only -h/-v: get_option answers No such option as '--help'. and exits non-zero, and debian/quicktree.htm holds only the [NAME] section. help2man is not installed here, so I could not confirm whether the generated quicktree.1 ends up as a NAME-only stub; --help-option=-h --version-option=-v would remove the doubt.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 0 hours ago.

Back to Dashboard | View all reviews for this package