DFSG NEW review for ringdecomposerlib version 1.1.3-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 1 minor; 1 more from the model's own knowledge, under Not confirmed
• debian/watch: absent
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All files are BSD-3-Clause (upstream “BSD New”). Every C/C++/Cython/Python source carries the standard University of Hamburg ZBH notice (2016, Niek Andresen, Florian Flachsenberg, Matthias Rarey); files without an individual notice (CMakeLists, docs, DIMACS test data, CI files) are part of the same upstream release under the root LICENSE and are covered by the Files: * stanza. debian/copyright is machine-readable DEP-5 with accurate stanzas and reproduces the full BSD-3-Clause text, which is required since it is not in /usr/share/common-licenses. No non-free terms, no unlicensed files, no built or minified or binary files, no vendored third-party code, no Files-Excluded needed.

Packaging

Solid foundation: debhelper compat 13, dh $@, current Standards-Version, single clean -dev package, sufficient Build-Depends, no patches. But execute_after_dh_install in debian/rules deletes the shared library that upstream's CMake builds and installs and hand-moves the static archive into the multiarch dir, so the package ships only a static lib and header with no runtime library, compensating for the missing SOVERSION instead of fixing it; the layout should be done with .install files. The Maintainer address uses the decommissioned alioth list.

Issues

1. [important] [packaging] Shared library is deleted in an override; the -dev package ships only a static archive

• Files: debian/rules, src/RingDecomposerLib/CMakeLists.txt
• Basis: checked, in the package or with a reference tool
• Evidence: rm debian/libringdecomposerlib-dev/usr/lib/*.so; mv debian/libringdecomposerlib-dev/usr/lib/*.a debian/libringdecomposerlib-dev/usr/lib/$(DEB_HOST_MULTIARCH). CMake builds the shared target via build_library("${SHARED_LIBRARY}" "SHARED") with no VERSION/SOVERSION, so the installed shared library is an unversioned libRingDecomposerLib.so with no SONAME.
• Problem: The workaround wanted to avoid shipping a SONAME-less shared library, but destroys the shared artifact upstream ships: no runtime/binary package is produced, consumers can only link statically, and libringdecomposerlib-dev has no accompanying runtime library. The raw mkdir/mv/rm in a rules hook (instead of debian/*.install, where compat 13 supports ${DEB_HOST_MULTIARCH}) is fragile: a future upstream change that stops producing the .a/.so would break the glob. A sponsor should require the shared library be shipped properly rather than deleted.
• Fix: Add a Debian patch setting VERSION/SOVERSION on the shared target in src/RingDecomposerLib/CMakeLists.txt and ship the versioned shared library (with a runtime binary package and shlibs), or, if static-only is deliberate, replace the mkdir/mv/rm block with a debian/libringdecomposerlib-dev.install file installing the static archive into usr/lib/${DEB_HOST_MULTIARCH}.

2. [minor] [packaging] There is no debian/watch

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Problem: Without a watch file new upstream releases are not noticed by uscan, the tracker or the maintainer's tools.
• Fix: Add a debian/watch in version 5 format, or, if upstream has no usable release channel, one holding a comment that says so.

Verified

• debian/copyright read in full: DEP-5 1.0 format, Files: *, Files: debian/*, and a standalone License: BSD-3-Clause paragraph with the complete licence text (correct, since BSD-3-Clause is not shipped in /usr/share/common-licenses).
• Copyright holders and licence in debian/copyright match the tree: all C/Python/Cython files carry the same BSD-3-Clause header crediting University of Hamburg, ZBH Center for Bioinformatics, 2016, Niek Andresen, Florian Flachsenberg, Matthias Rarey. The copyright grep covered all 51 files with notices and the prescan's author check confirms every holder found is named in debian/copyright.
• Files without an individual notice are covered by the root LICENSE and the Files: * stanza: CMakeLists.txt (7 files incl. root, src/, src/python, test), INSTALL, README, README.md, mainpage.doxygen, documentation/doxygen.cfg, documentation/sphinx/{conf.py,index.rst}, test/README, the 26 test/.dimacs, .gitignore, .travis.yml, src/python/setup.py.in.
• No other licence files exist anywhere (no COPYING/NOTICE/AUTHORS in subdirectories); no vendored code; RDKit (benchmark, external) and DIMACS test data are not bundled.
• No binary/built files: a glob for .so/.o/.a/.class/.jar/.pyc/minified/PDF/image files returned only .py sources; everything is the preferred form for modification (C, Cython .pyx/.pxd, CMake, text data).
• test/*.dimacs are text graph files (molecular ring topologies, PubChem-derived with chemical data removed) - test data, not a licensing concern.
• debian/control, rules, changelog and source/format read in full. debhelper-compat (= 13) with dh $@; Standards-Version: 4.7.4 equals the current Policy 4.7.4.1 (checked via the policy tool). Single binary libringdecomposerlib-dev (libdevel, Multi-Arch: same); ${misc:Depends} present; no shlibs needed since no shared library remains. Build-Depends (debhelper-compat, cmake) suffice for the default build; python wrapper and RDKit benchmark are off by default.
• Changelog 1.1.3-1, unstable, initial release closing #1151046; source format 3.0 (quilt) with no patches, so nothing to review there; Vcs-* fields consistent with the salsa debichem-team/ringdecomposerlib namespace; no autopkgtests (optional).
• At compat 13, dh_missing defaults to --fail-missing but only scans debian/tmp, while a single-binary build installs directly into the package directory (verified via the debhelper tool), so the build is not at risk from the missing/installed-file check.
• CMAKE_POLICY_VERSION_MINIMUM=3.5 in override_dh_auto_configure is a legitimate guard for the cmake_minimum_required(VERSION 3.1) deprecation under current cmake.

Not confirmed

• Could not build or run the package (read-only review); the ctest validation tests and the resulting files are unexercised. No certain build or test failure is identifiable from the sources: the .so and .a named by the rules glob are produced by the CMake install.
• The salsa repository named by the Vcs-* fields was not verified to exist.
• Whether the lists.alioth.debian.org address still forwards mail could not be checked; flagged as a minor issue.
• Whether this is a fault: Stale Debian Team mailing-list address in Maintainer. The model reported it as a minor packaging issue from its own knowledge of something outside the package, which it did not check with a tool, so it is not counted among the issues. Files: debian/control.
  Evidence: Maintainer: Debichem Team <debichem-devel@lists.alioth.debian.org>
  Problem: lists.alioth.debian.org was decommissioned in 2018; the Debichem Team's list is debichem-devel@lists.debian.org. Mail from the BTS to this address (including the closure CC in the changelog) will not reach the team.
  Fix: Use debichem-devel@lists.debian.org.

Proposed changes

None.