DFSG NEW review for renaissance version 0.9.0+git20250710.de4727a-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The code licences themselves are free and mutually compatible (LGPL-2+ library, GPL-2+ tools/examples, public-domain templates), but debian/copyright does not describe them accurately. Files: Documentation/* is declared to be under the permissive manual licence, yet Documentation/gsmarkup.dtd is LGPL-2+, and the tutorial sources/generated HTML carry no licence notice at all and are attributed to Nicola Pero, not the FSF. In addition the library files grant LGPL-2+ ('Library General Public License ... version 2 ... or any later version') while the catch-all stanza says LGPL-2.1+.

Packaging

The packaging is clean and current: compat 14 with dpkg-build-api 1, all build-dependencies resolve in the archive, one DEP-3 patch, hardened build, correct package split with Multi-Arch and Breaks/Replaces for the librenaissance0 -> librenaissance0d rename, and consistent install/manpage/doc-base/build-profile files. No packaging fault worth reporting was found.

Issues

1. [blocker] [licensing] Documentation/* puts the LGPL-2+ gsmarkup.dtd under the permissive manual licence

• Files: debian/copyright:24-36, Documentation/gsmarkup.dtd:3-21
• Basis: checked, in the package or with a reference tool
• Evidence: Files: Documentation/* ... License: permissive; whereas Documentation/gsmarkup.dtd says This library is free software; ... under the terms of the GNU Library General Public License ... either version 2 of the License, or (at your option) any later version.
• Problem: Per copyright-format 6.9, * matches slashes and the last matching stanza wins, so Documentation/* overrides Files: * for the DTD. debian/copyright therefore states a permissive licence where the file itself grants LGPL-2+, giving downstream users terms the copyright holder never granted and omitting the LGPL conditions.
• Fix: Give the DTD its own Files: Documentation/gsmarkup.dtd stanza with the LGPL-2+ terms, or narrow the Documentation stanza to the manual's .tex/.html files.

2. [important] [licensing] Tutorial documentation has no licence notice but is declared FSF copyright under the manual licence

• Files: debian/copyright:24-36, Documentation/Tutorials/Renaissance/Renaissance.tex:1-12, Documentation/Tutorials/Renaissance/Pregenerated/index.html, Documentation/ANNOUNCE:1-5
• Basis: checked, in the package or with a reference tool
• Evidence: the tutorial .tex has only %%% Nicola Pero and \author{Nicola Pero ...} and no Copyright/Permission line, and the generated tutorial HTML has none either; the stanza says Copyright: 2001-2018 Free Software Foundation, Inc. and License: permissive with text beginning Permission is granted to make and distribute verbatim copies of this manual ...
• Problem: That permission text is the manual's own grant (it appears in Documentation/title.tex and Documentation/.latex2html-init, which the tutorial does not use). The tutorial is a separate document attributed to Nicola Pero, and Documentation/ANNOUNCE similarly has no notice, so the copyright file names a holder and a licence that the files do not support. debian/rules builds Documentation/Tutorials and installs it into renaissance-doc, so if no grant exists the shipped tutorial is not distributable.
• Fix: Confirm the tutorial's licensing with upstream/the FSF and record it in a separate Files: Documentation/Tutorials/* stanza with the correct holder, or obtain and add a licence statement; do not reuse the manual's wording for it. Check Documentation/ANNOUNCE at the same time.

3. [minor] [licensing] Library files grant LGPL-2+ but debian/copyright says LGPL-2.1+

• Files: debian/copyright:5-10, Source/Renaissance.h:11-14, Source/AutoLayout/GSAutoLayoutBox.h:11-14
• Basis: checked, in the package or with a reference tool
• Evidence: headers: GNU Library General Public License ... either version 2 of the License, or (at your option) any later version; debian/copyright License: LGPL-2.1+ with the comment that the notices are not updated.
• Problem: The short name must describe the grant actually made. The notices start at version 2, so the correct short name is LGPL-2+; LGPL-2.1+ wrongly omits the LGPL-2.0 option (it is over-restrictive rather than a freeness problem, and it does not match the LGPL-2.1 text of COPYING.LIB either).
• Fix: Use License: LGPL-2+ for the library files and a matching LGPL-2 text/pointer, keeping a note that upstream's COPYING.LIB contains the 2.1 text.

Verified

• Read debian/copyright in full: DEP-5, Format: is exactly the 1.0 URL, no Files-Excluded; stanzas for Files: *, Tools/* Examples/*, Examples/Applications/Templates/*, Documentation/*, debian/*, and stand-alone LGPL-2.1+/GPL-2+/public-domain/permissive licence paragraphs.
• Inventoried the tree: Source/ (149 files) all carry FSF copyright and the GNU Library General Public License ... version 2 ... or any later version header; Tools/ (2 applications) and Examples/ (applications, Classes, Special) carry FSF copyright and GPL-2+ notices; Examples/Applications/Templates/* say This file is in the public domain as declared.
• Scanned for other licence wording (GNU General Public, GNU Lesser, GFDL, Apache, MPL, MIT, BSD, Creative Commons, non-commercial, no-derivatives, SPDX-License-Identifier, All rights reserved): nothing besides the LGPL/GPL/public-domain texts above; no non-free term found.
• Prescan hit Examples/Applications/Ink/Credits.rtf:3: it is an RTF credits file for the Ink example, Copyright (c) 2000, 2003 Free Software Foundation, Inc.; the \par is RTF markup, not a separate holder, and the file is covered by the Examples/* GPL-2+ stanza.
• Binary files: 16 .tiff, 2 .icns and 1 .jpg under Examples/Applications (application icons, e.g. Ink/Images/Ink.icns); they are raster artwork covered by the Examples/* GPL-2+ stanza and were assessed by path/name, not opened. No .pdf/.ps/.jar/.class/.so/.a in the upstream tree.
• Documentation/Pregenerated and Documentation/Tutorials/Renaissance/Pregenerated are latex2html output; the .tex sources they were generated from are present in the same directories. The Copyright (c) 1993... Nikos Drakos ... Ross Moore footer in the generated HTML is the translator's boilerplate, not a licence claim on the document.
• Read all of debian/ (control, rules, changelog, copyright, patches/series and the patch, *.install, *.manpages, *.docs, doc-base files, man pages, source/format, upstream/metadata, gbp.conf, salsa-ci.yml); only debian/watch was left to the separate check.
• The patched Source/GNUmakefile matches debian/patches/link-libs.patch, which has DEP-3 headers and a Forwarded URL; source format is 3.0 (quilt).
• Dependencies resolve: gnustep-make 2.9.3-7 (>= 2.9.3-2), libgnustep-gui-dev 0.32.0-5 (>= 0.31.1-9), latex2html 2026+debian1-1; dpkg-build-api 1 is provided by dpkg-dev 1.23.11.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components current); debhelper compat 14 with dpkg-build-api 1, so dh_gencontrol supplies relationship substvars and dh_installdocs falls back to debian/tmp (checked with the debhelper tool), which makes usr/share/doc/* in renaissance-doc.docs resolve.
• Package split, Architecture/Multi-Arch, the librenaissance0 -> librenaissance0d Breaks/Replaces, and the doc-base paths match what rules and the install files produce; Build-Profiles <!nodoc> is consistent between control, Build-Depends-Indep and the doc package.
• uscan found the packaged version as the newest upstream release (upstream 0.9.0+git20250710.de4727a, packaged 0.9.0+git20250710.de4727a).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2, LGPL-2.1).

Not confirmed

• Could not check where the docs make variable used by debian/rules is defined, nor how the nodoc profile disables the Documentation build: /usr/share/GNUstep/debian/config.mk (from gnustep-make) is not installed on the reviewing system. No build failure is asserted.
• No build or runtime test was run; the review is of the source only.

Proposed changes

None.