DFSG NEW Queue

DFSG, Licensing & New Packages Team

rebol 3.22.5-1

Package Information

DescriptionInterpreter and runtime environment of REBOL/Bulk

REBOL: Relative Expression Based Object Language Rebol is a programming language interpreter and runtime environment. This package provides the Bulk variant of Rebol 3, including the extended codecs, compression, cryptography, multimedia and other functionality provided by that variant.

MaintainerPierre Chevalier <pierre.chevalier1967@free.fr>
Changed ByPierre Chevalier <pierre.chevalier1967@free.fr>
Sponsorsthibault@debian.org
Distributionunstable
Architectureany all
VCSgit: https://salsa.debian.org/pierrechtux/rebol.git (browse)
Closes#1034057
Trackerhttps://tracker.debian.org/pkg/rebol
Uploaded3 hours ago

New Package Report

.changes◂
Version3.22.5-1
Changed-ByPierre Chevalier <pierre.chevalier1967@free.fr>
Architectureall amd64 i386 source
Distributionunstable
DateThu, 24 Sep 2026 18:42:29 +0200
Sourcerebol
Changelog◂
rebol (3.22.5-1) unstable; urgency=medium
 .
   * Initial Debian packaging of Rebol/Bulk 3.22.5.
   * Build the Linux x86-64 interpreter using the upstream Siskin Builder.
   * Take over RFP #1034057 as ITP. (Closes: #1034057)
.dsc◂
Priorityoptional
Componentmain
Package-Listrebol deb devel optional arch=any
rebol-src deb devel optional arch=all
Sectiondevel
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Rebol3
Upstream-Contact: Rebol Open Source Developers
Source: https://github.com/Oldes/Rebol3


Files: *
Copyright: 2012 REBOL Technologies
           2012-2026 Rebol Open Source Contributors
License: Apache-2.0

Files: src/core/mbedtls/*
       src/include/mbedtls/*
       src/include/psa/*
Copyright: The Mbed TLS Contributors
License: Apache-2.0

Files: src/core/brotli/*
       src/include/brotli/*
Copyright: 2010-2025 Google Inc.
License: Expat

Files: src/core/deflate/*
Copyright: 2016-2024 Eric Biggers
           2024 Google LLC
License: Expat

Files: src/core/lz4/*
Copyright: 2011-2020 Yann Collet
License: BSD-2-Clause

Files: src/core/u-xxhash.c
       src/include/sys-xxhash.h
Copyright: 2011-2023 Yann Collet
License: BSD-2-Clause

Files: src/core/f-qsort.c
Copyright: 1992-1993 The Regents of the University of California
License: BSD-3-Clause

Files: src/core/f-stablemerge-sort.c
Copyright: 2026 Oldes Huhuman
License: public-domain
Comment:
 Algorithm based on Timsort by Tim Peters (2002). Collapse  invariant fix
 per de Gouw et al. (2015).

Files: src/include/sys-hash.h
Copyright: Austin Appleby
License: public-domain

Files: src/core/u-qoi.c
       src/include/sys-qoi.h
Copyright: 2021 Dominic Szablewski
License: Expat

Files: src/core/f-dtoa.c
Copyright: 1991, 2000-2001 Lucent Technologies
License: dtoa

Files: src/core/u-jpg.c
       src/include/sys-jpg.h
Copyright: 1991-1998 Thomas G. Lane
License: IJG

Files: src/core/f-adp-symmetry-psort.c
Copyright: 2012 Jingchao Chen
License: Adp-SymPSort

Files: src/core/s-unicode.c
Copyright: 2012 REBOL Technologies
           2012-2026 Rebol Open Source Contributors
           2008-2010 Bjoern Hoehrmann
License: Apache-2.0 and Expat
Comment:
 The UTF-8 decoding code by Bjoern Hoehrmann is licensed under the Expat
 license.  The remaining code is covered by the Apache-2.0 license, as
 stated in the file header.

Files: src/modules/unicode-utils.reb
Copyright: 2008-2010 Bjoern Hoehrmann
License: Expat

Files: src/mezz/codec-json.reb
Copyright: 2019 Red Foundation
           2020-2023 Rebol Open Source Contributors
License: BSL-1.0

Files: src/os/posix/host-compositor.c
       src/os/win32/host-compositor.c
       src/os/win32/host-window.c
       src/include/reb-compositor.h
Copyright: 2012 REBOL Technologies
           2012-2025 Rebol Open Source Contributors
           2012-2018 Saphirion AG & Atronix
           2019 Oldes
           Richard Smolak
License: Apache-2.0

Files: src/os/posix/host-event.c
       src/os/win32/host-event.c
       src/include/reb-dtoa.h
       src/include/sys-dec-to-char.h
       src/include/reb-view.h
       src/boot/window.reb
Copyright: 2012 REBOL Technologies
           2012 Richard Smolak
           2012 Carl Sassenrath
           2012 Oldes
           2012-2013 Saphirion AG
License: Apache-2.0

Files: src/os/posix/host-lib.c
       src/os/win32/host-lib.c
Copyright: 2012 REBOL Technologies
           2012-2025 Rebol Open Source Contributors
           2012 Atronix Engineering, Inc.
License: Apache-2.0

Files: src/include/sys-int-funcs.h
Copyright: 2014 Atronix Engineering, Inc.
License: Apache-2.0

Files: debian/*
Copyright: 2026 Pierre Chevalier <pierre.chevalier1967@free.fr>
License: GPL-3

Files: src/core/u-zlib.c
Copyright: 1995-2024 Jean-Loup Gailly and Mark Adler
License: Zlib

Files: src/include/sys-lzav.h
Copyright: 2023-2025 Aleksey Vaneev
License: Expat

Files: src/boot/graphics.reb
Copyright: 2012 REBOL Technologies
           2012 Saphirion AG
           2012 Richard Smolak
           2012 Carl Sassenrath
License: Apache-2.0

Files: src/mezz/prot-http.reb
Copyright: 2012 REBOL Technologies
           2012-2026 Rebol Open Source Contributors
License: Apache-2.0

Files: src/core/mbedtls/chachapoly.c
       src/include/mbedtls/chacha20.h
       src/include/mbedtls/chachapoly.h
Copyright: The Mbed TLS Contributors
License: Apache-2.0 or GPL-2+

Files: src/include/reb-c.h
Copyright: 2012 REBOL Technologies
           2012-2024 Rebol Open Source Developers
License: Apache-2.0

Files: src/core/mbedtls/chacha20.c
Copyright: The Mbed TLS Contributors
License: Apache-2.0

Files: src/core/mbedtls/cipher.c
       src/core/mbedtls/cipher_wrap.c
       src/include/mbedtls/cipher.h
Copyright: The Mbed TLS Contributors
License: Apache-2.0

Files: src/include/mbedtls/config_adjust_legacy_crypto.h
       src/include/mbedtls/config.h
       src/include/mbedtls/check_config.h
       src/include/mbedtls/error.h
       src/include/psa/crypto_builtin_composites.h
       src/include/psa/crypto_config.h
       src/include/psa/crypto_sizes.h
       src/include/psa/crypto_values.h
Copyright: The Mbed TLS Contributors
License: Apache-2.0

Files: src/include/opt-config.h
Copyright: 2012 REBOL Technologies
License: Apache-2.0

Files: src/include/sys-crypt.h
Copyright: 2012 REBOL Technologies
            2012-2022 Rebol Open Source Contributors
License: Apache-2.0

Files: src/mezz/prot-tls.reb
Copyright: 2025 Oldes
License: Expat

Files: src/tests/units/crypt-port-test.r3
Copyright: Oldes, Peter W A Wood
License: Apache-2.0

Files: src/core/u-compress.c
Copyright: 2012 REBOL Technologies
           2012-2025 Rebol Open Source Contributors
License: Apache-2.0

Files: src/core/u-lzma.c
       src/include/sys-lzma.h
Copyright: 2018 Igor Pavlov
License: LZMA

Files: src/core/u-lzw.c
Copyright: 2012 REBOL Technologies
           2012-2022 Rebol Open Source Contributors
           2016-2020 David Bryant
License: Apache-2.0 and BSD-3-Clause
Comment:
 The LZW compressor/decompressor by David Bryant is licensed under the BSD
 3-Clause license.  The remaining code is covered by the Apache-2.0 license,
 as stated in the file header.

Files: src/core/u-crush.c
Copyright: 2012 REBOL Technologies
           2012-2025 Rebol Open Source Contributors
License: Apache-2.0 and public-domain
Comment:
 This code was ported from the original Ilya Muravyov's code, which he placed
 in the public domain.  The original source is available at:
  https://sourceforge.net/projects/crush
 At this URL, the only mention of a license is: "License Public Domain"

Files: src/core/u-rc4.c
       src/include/sys-rc4.h
Copyright: 2007 Cameron Rich
License: CUSTOM_Cameron_Rich

Files: src/include/reb-struct.h
Copyright: 2014 Atronix Engineering, Inc.
           2021-2025 Rebol Open Source Contributors
License: Apache-2.0

Files: src/core/f-int.c
Copyright: 2014 Atronix Engineering, Inc.
License: Apache-2.0

Files: src/core/c-do.c
Copyright: 2012 REBOL Technologies
           2012-2025 Rebol Open Source Contributors
License: Apache-2.0

Files: src/core/t-struct.c
Copyright: 2014 Atronix Engineering, Inc.
           2021-2026 Rebol Open Source Contributors
License: Apache-2.0

Files: src/mezz/prot-mysql.reb
Copyright: 2020 SOFTINNOV, Atronix Engineering, Inc., Oldes
License: BSD-like-Nenad
Comment:
 In git history, at commit 01284d6b966511902396f7837a27b6ec34425ff6, it
 appears that this code is a port/rewrite of the original MySQL driver
 written by Nenad Rakocevic.  The author's website describes its license
 only as "BSD-like".  No complete license text has been found.

Files: src/modules/munge3.reb
Copyright: 2019 Ashley G Truter
License: Expat


License: Adp-SymPSort
 Permission to use, copy, modify, and distribute this software and its
 documentation with or without modifications and for any purpose and
 without fee is hereby granted, provided that any copyright notices
 appear in all copies and that both those copyright notices and this
 permission notice appear in supporting documentation, and that the
 names of the contributors or copyright holders not be used in
 advertising or publicity pertaining to distribution of the software
 without specific prior permission.
 .
 THE CONTRIBUTORS AND COPYRIGHT HOLDERS OF THIS SOFTWARE DISCLAIM ALL
 WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL THE
 CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT
 OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
 OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE
 OR PERFORMANCE OF THIS SOFTWARE

License: dtoa
 Permission to use, copy, modify, and distribute this software for any
 purpose without fee is hereby granted, provided that this entire notice is
 included in all copies of any software which is or includes a copy or
 modification of this software and in all copies of the supporting
 documentation for such software.  THIS SOFTWARE IS BEING PROVIDED "AS IS",
 WITHOUT ANY EXPRESS OR IMPLIED WARRANTY. IN PARTICULAR, NEITHER THE AUTHOR
 NOR LUCENT MAKES ANY REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
 MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.

License: IJG
 Independent JPEG Group License
 .
 The authors make NO WARRANTY or representation, either express or implied,
 with respect to this software, its quality, accuracy, merchantability, or
 fitness for a particular purpose. This software is provided "AS IS", and
 you, its user, assume the entire risk as to its quality and accuracy.
 This software is copyright (C) 1991-1998, Thomas G. Lane. All Rights
 Reserved except as specified below.
 .
 Permission is hereby granted to use, copy, modify, and distribute this
 software (or portions thereof) for any purpose, without fee, subject
 to these conditions:
 (1) If any part of the source code for this software is distributed,
     then this README file must be included, with this copyright and
      no-warranty notice unaltered; and any additions, deletions, or
      changes to the original files must be clearly indicated in
       accompanying documentation.
 (2) If only executable code is distributed, then the accompanying
     documentation must state that "this software is based in part on
     the work of the Independent JPEG Group".
 (3) Permission for use of this software is granted only if the user
     accepts full responsibility for any undesirable consequences;
     the authors accept NO LIABILITY for damages of any kind.
 .
 These conditions apply to any software derived from or based on the
 IJG code, not just to the unmodified library. If you use our work,
 you ought to acknowledge us.
 .
 Permission is NOT granted for the use of any IJG author's name or
 company name in advertising or publicity relating to this software
 or products derived from it. This software may be referred to only
 as "the Independent JPEG Group's software".
 .
 We specifically permit and encourage the use of this software as the
 basis of commercial products, provided that all warranty or liability
 claims are assumed by the product vendor.
 .
 ansi2knr.c is included in this distribution by permission of L. Peter
 Deutsch, sole proprietor of its copyright holder, Aladdin Enterprises
 of Menlo Park, CA. ansi2knr.c is NOT covered by the above copyright
 and conditions, but instead by the usual distribution terms of the
 Free Software Foundation; principally, that you must include source
 code if you redistribute it. (See the file ansi2knr.c for full
 details.) However, since ansi2knr.c is not needed as part of any
 program generated from the IJG code, this does not limit you more
 than the foregoing paragraphs do.
 .
 The Unix configuration script "configure" was produced with GNU
 Autoconf. It is copyright by the Free Software Foundation but is
 freely distributable. The same holds for its supporting scripts
 (config.guess, config.sub, ltconfig, ltmain.sh). Another support
 script, install-sh, is copyright by M.I.T. but is also freely
 distributable.
 .
 It appears that the arithmetic coding option of the JPEG spec is
 covered by patents owned by IBM, AT&T, and Mitsubishi. Hence
 arithmetic coding cannot legally be used without obtaining one or
 more licenses. For this reason, support for arithmetic coding has
 been removed from the free JPEG software. (Since arithmetic coding
 provides only a marginal gain over the unpatented Huffman mode, it
 is unlikely that very many implementations will support it.) So far
 as we are aware, there are no patent restrictions on the remaining
 code.
 .
 The IJG distribution formerly included code to read and write GIF
 files. To avoid entanglement with the Unisys LZW patent, GIF reading
 support has been removed altogether, and the GIF writer has been
 simplified to produce "uncompressed GIFs". This technique does not
 use the LZW algorithm; the resulting GIF files are larger than usual,
 but are readable by all standard GIF decoders.
 .
 We are required to state that
 "The Graphics Interchange Format(c) is the Copyright property of
 CompuServe Incorporated. GIF(sm) is a Service Mark property of
 CompuServe Incorporated."

License: Apache-2.0
 /usr/share/common-licenses/Apache-2.0

License: GPL-3
 /usr/share/common-licenses/GPL-3

License: GPL-2+
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 On Debian systems, the complete text of version 2 of the GNU General
 Public License can be found in `/usr/share/common-licenses/GPL-2'.

License: BSD-2-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice, this
 list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright notice,
 this list of conditions and the following disclaimer in the documentation
 and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice, this
 list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright notice,
 this list of conditions and the following disclaimer in the documentation
 and/or other materials provided with the distribution.
 .
 3. Neither the name of the copyright holder nor the names of its contributors
 may be used to endorse or promote products derived from this software without
 specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: BSL-1.0
 Boost Software License - Version 1.0 - August 17th, 2003
 .
 Permission is hereby granted, free of charge, to any person or organization
 obtaining a copy of the software and accompanying documentation covered by this
 license (the "Software") to use, reproduce, display, distribute, execute, and
 transmit the Software, and to prepare derivative works of the Software, and to
 permit third-parties to whom the Software is furnished to do so, all subject to
 the following:
 .
 The copyright notices in the Software and this entire statement, including the
 above license grant, this restriction and the following disclaimer, must be
 included in all copies of the Software, in whole or in part, and all derivative
 works of the Software, unless such copies or derivative works are solely in the
 form of machine-executable object code generated by a source language
 processor.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT SHALL
 THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE FOR ANY
 DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

License: Expat
 MIT License (Expat)
 .
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in
 the Software without restriction, including without limitation the rights to
 use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
 of the Software, and to permit persons to whom the Software is furnished to do
 so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: public-domain
 This software is released into the public domain.
Comment:
 In the few cases where this license is mentioned, no additional information
 could be found.

License: Zlib
 This software is provided 'as-is', without any express or implied
 warranty.  In no event will the authors be held liable for any damages
 arising from the use of this software.
 .
 Permission is granted to anyone to use this software for any purpose,
 including commercial applications, and to alter it and redistribute it
 freely, subject to the following restrictions:
 .
 1. The origin of this software must not be misrepresented; you must not
    claim that you wrote the original software. If you use this software
    in a product, an acknowledgment in the product documentation would be
    appreciated but is not required.
 2. Altered source versions must be plainly marked as such, and must not be
    misrepresented as being the original software.
 3. This notice may not be removed or altered from any source distribution.

License: CUSTOM_Cameron_Rich
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 * Redistributions of source code must retain the above copyright notice,
   this list of conditions and the following disclaimer.
 * Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.
 * Neither the name of the axTLS project nor the names of its contributors
   may be used to endorse or promote products derived from this software
   without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
 CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Comment:
 This license is very similar to the BSD-3-Clause, but there are some few
 differences:
  copyright holder => axTLS project
  COPYRIGHT OWNER  => COPYRIGHT HOLDER

License: LZMA
 LZMA SDK is placed in the public domain.
 .
 Anyone is free to copy, modify, publish, use, compile, sell, or distribute
 the original LZMA SDK code, either in source code form or as a compiled
 binary, for any purpose, commercial or non-commercial, and by any means.
 .
 Note: The abbreviation LZMA originally stood for Lempel - Ziv - Markov chain
 - Arithmetic coding. Preliminary versions of LZMA used arithmetic coding. But
 in the final version of LZMA, arithmetic coding was replaced by range coding.

License: BSD-like-Nenad
 Open-source : BSD-like license.
Comment:
 The line above is the only mention of license on Softinnov (Nenad Rakocevic)
 web page, https://www.softinnov.org/rebol/mysql.shtml, which is the origin of
 this prot-mysql.reb file.

DFSG Assistant LLM REVIEW 3 blocker, 5 important, 4 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for rebol version 3.22.5-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: No
  • Issues: 3 blocker, 5 important, 4 minor
  • debian/watch: absent
  • debian/copyright: machine-readable
  • Scan before the review: 30 found

Licensing

debian/copyright is DEP-5 and the bulk of the tree is Apache-2.0 as stated, but two files carry terms or an absence of terms that are not acceptable for main, and several groups of files state licences the catch-all Files: * contradicts. src/modules/prebol.reb restricts modifications ("Changes to the official version must be approved by REBOL Technologies"), which fails DFSG 3, and it is compiled into the Bulk binary. src/mezz/prot-mysql.reb has no licence text at all, only the maintainer's paraphrase "BSD-like". The GraphicsMagick/ImageMagick code in u-image-resize.c/sys-magick.h is described as Apache-2.0 on the strength of a file header naming licences that are not included, and the MIT/BSD-declaring mezz modules, Red-derived BSD-3 test scripts and Unicode data tables are not documented.

Packaging

The packaging is conventional and mostly sound (debhelper 13, quilt, separate -src package, man page, ${shlibs:Depends}), but Architecture: any is wrong: debian/rules maps four Debian architectures and every other one yields a siskin target name that does not exist in make/rebol3.nest, so the package cannot build on ppc64el, s390x or armel. It also embeds nine third-party libraries that Debian already ships, only zlib (for PNG) being taken from the system, and the stage1 bootstrap path its own files describe is broken. No autopkgtest.

Issues

1. [blocker] [licensing] src/modules/prebol.reb forbids distributing modified versions without REBOL Technologies' approval

  • Files: src/modules/prebol.reb:26-29, debian/copyright:9-13
  • Basis: checked, in the package or with a reference tool
  • Evidence: Rights: {Users are allowed to modify this source, but must keep this header intact. Changes to the official version must be approved by REBOL Technologies www.REBOL.com. ...}
  • Problem: A requirement that modifications be approved by the copyright holder is a restriction on distributing derived works and is not a free licence (DFSG 3), and it conflicts with the Apache-2.0 the tree's LICENSE and Files: * claim for this file. The file is not dead weight: make/rebol3.nest includes it in every Bulk build (:include-prebol in include-rebol-bulk), so it is compiled into the shipped rebol binary, and it is shipped as source in rebol-src.
  • Fix: Ask upstream whether old prebol.r terms still apply (the file has no Apache header) and have them relicensed or the clause removed; failing that, drop the file or ship a version with a clear Apache-2.0 header, and document it in debian/copyright.

2. [blocker] [licensing] src/mezz/prot-mysql.reb has no licence grant; debian/copyright invents "BSD-like-Nenad" from a one-line web mention

  • Files: src/mezz/prot-mysql.reb:9-13, debian/copyright:302-310, debian/copyright:541-543
  • Basis: checked, in the package or with a reference tool
  • Evidence: License: BSD-like-Nenad whose whole text is "Open-source : BSD-like license." and Comment: ... No complete license text has been found.
  • Problem: The file is a port of Nenad Rakocevic's MySQL driver with no licence statement of its own; a claim on a web page that it is "BSD-like" grants nothing, does not say which BSD variant, and cannot be relied on (DFSG 1 and 3). The maintainer's own Comment: records that no licence was found. It is also compiled into the Bulk rebol binary (:include-prot-mysql in include-rebol-bulk) and shipped in rebol-src.
  • Fix: Get written clarification from the authors (SOFTINNOV/Nenad Rakocevic, Atronix, Oldes) and document the real licence, or remove the module from the package (and from the build).

3. [blocker] [licensing] GraphicsMagick/ImageMagick code in u-image-resize.c and sys-magick.h is described as Apache-2.0; its holders and licences are not documented

  • Files: src/core/u-image-resize.c:52-58, src/include/sys-magick.h:29-35, debian/copyright:9-13
  • Basis: checked, in the package or with a reference tool
  • Evidence: % Copyright (C) 2003 - 2019 GraphicsMagick Group / % Copyright (C) 2002 ImageMagick Studio / % This program is covered by multiple licenses, which are described in Copyright.txt. You should have received a copy of Copyright.txt with this package
  • Problem: These files are ported GraphicsMagick code under GraphicsMagick's own terms, not the Apache-2.0 Files: * gives them. The GraphicsMagick Group and ImageMagick Studio holders appear nowhere in debian/copyright, and the Copyright.txt the header requires to accompany the code is not in the package, so the actual permission is not reproduced at all.
  • Fix: Add a Files: stanza for both files naming GraphicsMagick Group, ImageMagick Studio and Oldes, with the GraphicsMagick/ImageMagick licence text (it is MIT-style, not Apache-2.0) quoted in a stand-alone License paragraph, and note the code's origin.

4. [important] [licensing] Red-derived test scripts are BSD-3-Clause with five holders; debian/copyright calls them Apache-2.0 and names none of them

  • Files: src/tests/quick-test-module.r3:6-7, src/tests/units/csv-test.r3:5-6, src/tests/units/evaluation-test.r3:6-7, src/tests/units/integer-test_.r3:7-8, src/tests/units/load-test.r3:7-8, src/tests/units/power-test.r3:6-7
  • Basis: checked, in the package or with a reference tool
  • Evidence: Rights: "Copyright (C) 2011-2019 Red Foundation. All rights reserved." / License: "BSD-3 - https://github.com/red/red/blob/origin/BSD-3-License.txt" (power-test.r3: Copyright (C) 2011-2017, Nenad Rakocevic & Peter W A Wood & mahengyang)
  • Problem: The files are BSD-3-Clause, not Apache-2.0 as Files: * says, and the holders Red Foundation, Nenad Rakocevic, Peter W A Wood, mahengyang and Boleslav Březovský (csv-test.r3) are missing. BSD-3 also obliges the notice to be reproduced with the shipped code. The BSD-3-Clause text already present in the stand-alone paragraph fits these files.
  • Fix: Add Files: src/tests/* with those holders and License: BSD-3-Clause (checking the remaining test scripts for the same header).

5. [important] [licensing] Twelve MIT modules and one "BSD" module declare licences debian/copyright does not give them

  • Files: src/mezz/codec-csv.reb:22, src/mezz/codec-mime-field.reb:9, src/mezz/codec-mime-types.reb:11, src/mezz/codec-pkix.reb:8, src/mezz/codec-ppk.reb:8, src/mezz/codec-quoted-printable.reb:9, src/mezz/codec-ssh-key.reb:8, src/mezz/codec-utc-time.reb:5, src/mezz/prot-daytime.reb:11, src/mezz/prot-mail.reb:19, src/mezz/prot-pop3.reb:11, src/modules/scheduler.reb:11-15
  • Basis: checked, in the package or with a reference tool
  • Evidence: License: MIT in the mezz modules; src/modules/scheduler.reb: License: BSD with Copyright: "2009 SOFTINNOV"; against debian/copyright: Files: * / License: Apache-2.0
  • Problem: Thirteen files state a licence other than Apache-2.0 and are not matched by any stanza, so Files: * misdescribes them; Oldes, SOFTINNOV/Nenad Rakocevic (scheduler) and Brian Hawley (codec-csv.reb) are named in no Copyright field. scheduler.reb's "BSD" does not say which variant, which is itself too vague to record.
  • Fix: Add Files: src/mezz/*.reb License: Expat and Files: src/modules/scheduler.reb with SOFTINNOV/Oldes and the BSD-3-Clause variant if that is what it is (otherwise ask upstream), naming the holders.

6. [important] [licensing] Public-domain and third-party code in f-random.c, sys-zlib.h, c-lexicals.reb and s-unicode.c is undocumented, and the Unicode data licence is missing

  • Files: src/core/f-random.c:31-33, src/include/sys-zlib.h:20, make/tools/c-lexicals.reb:2-8, src/core/s-unicode.c:637, src/core/s-unicode.c:704, NOTICE:17
  • Basis: checked, in the package or with a reference tool
  • Evidence: f-random.c: This program by D E Knuth is in the public domain and freely copyable.; c-lexicals.reb: Rights: { Copyright 2015 Brett Handley } with Apache-2.0; s-unicode.c: /* From https://unicode.org/Public/UNIDATA/UnicodeData.txt */, /* From https://unicode.org/Public/UNIDATA/EastAsianWidth.txt */
  • Problem: None of these appears in a Files:/Copyright: field: f-random.c is partly Knuth's public-domain generator (neither holder nor licence recorded), sys-zlib.h is zlib code under Files: * Apache-2.0 although the Zlib text exists, c-lexicals.reb adds Brett Handley as holder, and s-unicode.c embeds tables derived from Unicode's data files, whose licence requires the copyright and permission notice to be reproduced — NOTICE names "2001-2004 Unicode, Inc." but no licence text is in the package.
  • Fix: Add stanzas naming D. E. Knuth (public domain), Jean-loup Gailly and Mark Adler for src/include/sys-zlib.h with License: Zlib, Brett Handley for make/tools/c-lexicals.reb, and Unicode, Inc. for src/core/s-unicode.c, including the Unicode data-files licence text.

7. [important] [packaging] Architecture: any overclaims: no build target exists for ppc64el, s390x or armel

  • Files: debian/control:26, debian/rules:7-16, make/rebol3.nest:1417-1599
  • Basis: checked, in the package or with a reference tool
  • Evidence: ARCH := $(DEB_TARGET_ARCH) with clauses only for amd64(x64), i386(x86), armhf(armv7), mips64el(mips64le); the nest's linux bulk targets are only rebol3-bulk-linux-{x86,x64,armv6,armv7,arm64,mips64le,riscv64}.
  • Problem: On any other release architecture siskin make/rebol3.nest %rebol3-bulk-linux-<debarch> names a target that does not exist (e.g. rebol3-bulk-linux-ppc64el, -s390x, -armel), and override_dh_auto_test/override_dh_auto_install then reference a binary that was never produced, so the build fails there.
  • Fix: Restrict the binary package to the architectures that work (Architecture: amd64 i386 armhf arm64 mips64el riscv64), or add the missing mappings (armel→armv6) and an upstream target for the remaining architectures.

8. [important] [packaging] Nine third-party libraries are embedded and built in-tree although Debian ships them, mbedtls included

  • Files: src/core/mbedtls/, src/core/brotli/, src/core/deflate/, src/core/lz4/, src/core/u-xxhash.c, src/core/u-lzma.c, src/core/u-jpg.c, src/core/u-qoi.c, debian/patches/0001-use-system-zlib-for-png.patch
  • Basis: checked, in the package or with a reference tool
  • Evidence: Only zlib is taken from the system (patch 0001 adds %z and drops core/u-zlib.c from the PNG codec); the others are compiled from the copy in the tree, e.g. include-brotli-compression, include-lz4-compression, include-mbedtls.
  • Problem: libmbedtls-dev 3.6.7, libbrotli-dev, liblz4-dev, libxxhash-dev, liblzma-dev and zlib1g-dev all exist in the archive (apt-cache), so the vendored copies are duplication that no security update reaches; the vendored mbedtls is 3.5.2 against 3.6.7 in Debian, and it is the cryptographic core of the binary.
  • Fix: At minimum record the embedded copies and their versions for the security team (a README.source and a debian/copyright note), and replace them with the system libraries where the build system allows, as patch 0001 already does for zlib.

9. [minor] [packaging] No autopkgtest, although rules already runs a smoke test

  • Files: debian/rules:36-41
  • Basis: checked, in the package or with a reference tool
  • Evidence: override_dh_auto_test: runs ./build/rebol3-bulk-linux-${ARCH} -v and --do 'print "...OK"'; there is no debian/tests/ directory.
  • Problem: The package ships an interpreter and its own test suite (src/tests/), and the only runtime check is a build-time smoke test that a nocheck build skips; nothing verifies the installed binary in the archive's test infrastructure.
  • Fix: Add debian/tests/control and a trivial test that runs /usr/bin/rebol --do 'print 1 + 1', and optionally a subset of src/tests/.

10. [minor] [packaging] The stage1 profile cannot work: it names a siskin binary that is not in the source and rules calls siskin unconditionally

  • Files: debian/control:8-9, debian/source/include-binaries, debian/build_bootstrap.sh:20-24, debian/rules:32-33
  • Basis: checked, in the package or with a reference tool
  • Evidence: Build-Depends: ... siskin <!stage1>; include-binaries lists debian/build/rebol3-bulk-linux-x64 and debian/build/siskin, neither of which exists in the tree; debian/rules calls siskin make/rebol3.nest ... with no fallback; build_bootstrap.sh downloads a prebuilt siskin from GitHub.
  • Problem: With -Pstage1 the build dependency is removed but siskin is still executed, and the binary that was meant to supply it is not shipped, so the profile fails; the stale include-binaries entries are the remains of a source package that once carried prebuilt binaries, and the documented bootstrap is a network download, not a build.
  • Fix: Either drop the stage1 profile and build_bootstrap.sh/include-binaries, or make the stage1 path work from files in the package; in any case delete the include-binaries entries for files that do not exist.

11. [minor] [packaging] rebol-src (Architecture: all) ships files generated by the build, and its "build tools" are not in it

  • Files: debian/rules:43-48, debian/rules:20-31, debian/control:33-36
  • Basis: checked, in the package or with a reference tool
  • Evidence: cp -a make src debian/rebol-src/usr/share/rebol-src/ runs in override_dh_auto_install, i.e. after the build has created src/core/b-boot.c, src/include/reb-lib.h, ext-types.h, reb-dialect.h, gen-*.h, host-*.h — the very files override_dh_auto_clean removes; the description promises "source tree and build tools" but no siskin is shipped or depended on.
  • Problem: The arch:all package's contents therefore depend on the build rather than on the source tree, and it cannot serve the purpose its description gives it without siskin installed.
  • Fix: Copy only the files that belong to the source distribution (or dh_installdocs/an install list excluding the generated ones), and either Recommends: siskin or correct the description.

12. [minor] [packaging] There is no debian/watch

  • Files: debian/watch
  • Basis: found by the review tooling's own checks
  • Problem: Without a watch file new upstream releases are not noticed by uscan, the tracker or the maintainer's tools.
  • Fix: Add a debian/watch in version 5 format, or, if upstream has no usable release channel, one holding a comment that says so.

Verified

  • debian/copyright is machine-readable DEP-5 with the correct Format: URL, no Files-Excluded, and no draft field names; later stanzas correctly override Files: *, and every path a stanza names exists in the tree (checked all of them).
  • Standards-Version: 4.7.4.1 equals the current Policy version 4.7.4.1 (policy tool), so no issue.
  • siskin is not in the archive yet but is built by siskin 0.22.5-1, waiting in NEW, so Build-Depends: siskin <!stage1> is satisfiable and not reported as a fault (apt-cache).
  • debian/patches/0002-remove-deprecated-code.patch deletes 31 files under src/core/deprecated/ and src/include/deprecated/ (OpenSSL/SSLeay SHA-1, Gifford SHA-2, micro-ecc, chacha, RC4, AES, DH, MD5); both directories are absent from the tree, the Bulk target does not include include-cryptography-deprecated, and the holders the scan missed from NOTICE (Aaron D. Gifford, Eric Young, Eduard Suica, Kenneth MacKay, insane coder) belong only to those removed files, so they need no stanza. Its hit at line 4827 is inside the deleted u-sha1.c. The file is a legitimate DEP-3 patch whose only object is to drop unused, non-Apache relic crypto.
  • .pc/0002-remove-deprecated-code.patch/src/core/deprecated/u-sha1.c is quilt's pre-patch copy of a file this package deletes; ignored per the review instructions, and its OpenSSL/SSLeay "free for commercial and non-commercial use" wording is not in the shipped tree.
  • src/tests/units/files/test.aar is an upstream test fixture — an Android archive (ZIP) used as input by the ZIP/AAR codec tests in src/tests/ — not a build product, and its licence is the tree's.
  • src/core/u-rc4.c/sys-rc4.h (Cameron Rich), u-lzw.c (David Bryant, BSD-3), u-xxhash.c, u-lz4/*, u-qoi.c, u-lzav.h, u-jpg.c (IJG), f-qsort.c (Regents), f-dtoa.c (Lucent), f-adp-symmetry-psort.c (Jingchao Chen), u-lzma.c (public domain), u-crush.c (Muravyov, public domain, credited in the stanza Comment), u-zlib.c (Zlib), src/mezz/codec-json.reb (BSL-1.0), src/mezz/prot-tls.reb (MIT) and src/mezz/prot-http.reb match their stanzas; the scan's "rare licence wording" hits in debian/copyright:323 (IJG) and :538 (LZMA) are the standard free texts, and those in src/core/p-crypt.c:43 and src/include/sys-value.h:1350 are code comments, not licence terms.
  • src/modules/munge3.reb:7 says "MIT. Free for both commercial and non-commercial use", which is the Expat stanza already present; CHANGES.md:1671's "private use" is a changelog note about an mbedtls header.
  • Prescan binary/archive/document files are all upstream test fixtures, not build products without source: under src/tests/units/files/ — test.aar, alice29.txt.gz, test-{deflate,lzma,stored}.zip, test.tar, hello-{1,2}.pdf, hello-linearized.pdf, flower-from-{photoshop,xnview}.pdf, pdf-maker-doc.pdf, Some.mobileprovision, flower.dds, google.crt, test.pfx, issue-2186-UTF32-BE.txt, test1-deflate.swf, test2-lzma.swf, test3.swf, test4-as2btn.swf — are the inputs for the zip/tar/gzip/pdf/swf/image/certificate codecs exercised by src/tests/; they are data, and their licence is the tree's.
  • src/core/brotli/common/dictionary.bin.br is brotli's built-in static dictionary, part of the vendored brotli sources (dictionary.c), needed by the brotli codec; not a generated file of this package.
  • src/core/brotli/ carries "Distributed under MIT license" headers with the licence text in the package (Expat stanza), src/core/lz4/LICENSE (BSD-2-Clause), src/core/deflate/COPYING (Expat) and mbedtls (Apache-2.0) match their stanzas; brotli's LICENSE file is absent from the vendored copy but the full Expat text is in debian/copyright.
  • Packaging mechanics: debian/rules uses debhelper 13 with a correct %: dh $@, no substvars are missing that compat 13 would not add, dh_auto_test is skipped under nocheck by dh itself, the man page is installed by debian/rebol.manpages, LICENSE/NOTICE ship in both packages' docs, debian/changelog is well-formed for unstable and closes the RFP #1034057, and debian/source/format is 3.0 (quilt).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-2, GPL-3).

Not confirmed

  • Whether the generated headers copied into rebol-src differ between architectures (which would make the arch:all package non-reproducible); the build would show it.
  • Whether siskin builds the %rebol3-bulk-linux-arm64 and -riscv64 targets without further patching; no build could be run.

Proposed changes

None.

Uploader's response to the LLM review

Answering a few points:

dfsg-team@debian.org, le mar. 27 oct. 2026 18:27:15 +0000, a ecrit:

It found 3 blocker, 5 important, 4 minor issues:

  • [blocker] [licensing] src/modules/prebol.reb forbids distributing modified versions without REBOL Technologies' approval

I don't think it forbids distributing modified versions. It says:

«
Users are allowed to modify this source, but must keep this header
intact. Changes to the official version must be approved by REBOL
Technologies
»

I don't think the version modified by Debian would be labelled "official
version"?

  • [important] [packaging] Architecture: any overclaims: no build target exists for ppc64el, s390x or armel

That is not a problem per se.

  • [important] [packaging] Nine third-party libraries are embedded and built in-tree although Debian ships them, mbedtls included

That should indeed be made a work item on salsa.

  • [minor] [packaging] No autopkgtest, although rules already runs a smoke test

That test can indeed be made in autopkgtest, as superficial test. For
later.

  • [minor] [packaging] The stage1 profile cannot work: it names a siskin binary that is not in the source and rules calls siskin unconditionally

Yes, there is chicken-and-egg with the siskin package, also uploaded at
the same time. We'll handle the bootstrap.

  • [minor] [packaging] rebol-src (Architecture: all) ships files generated by the build, and its "build tools" are not in it

The build-tool is siskin, which is the one that needs rebol-src to build
:)

Whether the generated headers copied into rebol-src differ between architectures

They don't, it's just the source code, for siskin to be able to build.

Whether siskin builds the %rebol3-bulk-linux-arm64 and -riscv64 targets without further patching

Yes, it can.

— Samuel Thibault (sthibault), 2 hours ago

Back to Dashboard | View all reviews for this package