DFSG NEW review for s2geometry version 0.14.0+git079611b-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

The entire tree is Apache-2.0 except three gtl headers (dense_hash_set.h, densehashtable.h, hashtable_common.h) which carry both an Apache-2.0 header and a BSD-3-clause notice, exactly as debian/copyright states ("Apache-2.0 and BSD-3-clause"). The package is machine-readable DEP-5 with a Files: * catch-all and a dedicated stanza for the three gtl files. All copyright holders found in the tree are represented: the two newer "Google LLC" headers (2025/2026, e.g. bignum.h, python/s2cell_id_range.h) are the same Google entity already listed as "Google Inc" (renamed in 2017), and Sean McAllister is explicitly listed. The prescan's only generated document, doc/pdf/dd-index-validation.pdf, is a rendered PDF of the present markdown source doc/design/index_validation.md with its images in doc/design/images/, so its preferred form for modification is in the tree; it is also not installed in any binary. No non-free terms, no missing licences, Apache-2.0 and BSD-3-clause are compatible. debian/copyright accurately describes the licensing.

Packaging

Packaging is clean and follows current practice. debhelper-compat 13 with dh --buildsystem=cmake+ninja, hardening=+all, BUILD_TESTS=ON and WITH_PYTHON=OFF. Build-Depends are all present and satisfiable (verified libabsl-dev 20260526.0-2+b1 exists in unstable and satisfies >= 20260526); ${shlibs:Depends}/${misc:Depends} substvars are explicitly present. Patches have DEP-3 headers, clear purpose, and are properly Forwarded: not-needed (vendor) or are Debian-specific adaptations. not-installed correctly accounts for the test-only static lib at compat 13's dh_missing --fail-missing default. Multi-Arch: same on both -0 and -dev with correct versioned Depends. Standards-Version 4.7.4 is current against Policy 4.7.4.1. No maintainer scripts needed, changelog/distribution/closures sane, Vcs-* and Homepage fields present. Source format 3.0 (quilt).

Issues

1. [minor] [packaging] No autopkgtest (debian/tests) despite a substantial test suite

• Files: debian/tests (absent)
• Basis: checked, in the package or with a reference tool
• Evidence: debian/ contains no tests/control; upstream builds/runs tests via ctest (BUILD_TESTS=ON, libgtest/libgmock/libbenchmark in Build-Depends).
• Problem: The package builds and runs a full ctest suite at build time but ships no debian/tests/control, so there is no autopkgtest regression coverage for the installed -dev/library. Not a policy violation, and unlikely to block upload, but a straightforward improvement given the test infrastructure already present.
• Fix: Add a debian/tests/control with a small smoke test (e.g. compile and run a minimal program against libs2, or run one of the documented examples) with the needed build-deps for the test.

2. [minor] [packaging] uscan finds only upstream versions older than the packaged one

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: upstream 0.14.0, packaged 0.14.0+git079611b
• Problem: The newest version uscan finds with debian/watch is older than the version in debian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
• Fix: Check where debian/watch looks and how it mangles versions.

Verified

• doc/pdf/dd-index-validation.pdf is a PDF rendering whose editable source doc/design/index_validation.md and all referenced images (doc/design/images/.png) are present in the tree; it is not installed in any binary package (only doc/examples/ is installed).
• Copyright holders named in newer file headers as "Google LLC" (2025/2026, e.g. src/s2/util/math/exactfloat/bignum.h, src/python/s2cell_id_range.{h,cc,test.cc}) are the successor entity of the "Google Inc" already listed under Files: * in debian/copyright (rename in 2017); still represented. Sean McAllister smcallis@google.com is listed explicitly.
• The three src/s2/util/gtl headers carry both an Apache-2.0 header and a BSD-3-clause notice ("Neither the name of Google Inc. nor the names of its contributors..."); debian/copyright's dedicated stanza for them is accurate.
• libabsl-dev 20260526.0-2+b1 exists in unstable and satisfies build-dependency libabsl-dev (>= 20260526); libbm
• substvars ${shlibs:Depends} and ${misc:Depends} are present in the binary stanzas (compat 13, not auto-added).
• Source format 3.0 (quilt); debian/source/format correct.
• debian/not-installed correctly lists usr/lib/*/libs2testing.a, matching the dh_missing --fail-missing default of compat 13.
• Patches: Use-packaged-gtest.patch, disable-ASLR-re-exec-benchmark.patch, and both cmake patches all have DEP-3 headers, named Authors, Origin: vendor, Forwarded: not-needed, and clear descriptions; they are coherent vendor adaptations (replace FetchContent downloads with find_package, relocate cmake files to /cmake/s2, drop ASLR re-exec, unset CMAKE_CXX_STANDARD).
• Both Google-entity copyright holders flagged by the prescan as "possibly named under a similar name" map to the already-listed Google Inc; no genuinely missing holder remains.
• I sampled the tree via prescan results and targeted greps (SPDX/GPL/LGPL/MIT/BSD/non-commercial terms); apart from the gtl BSD notice nothing non-Apache was found.
• No maintainer scripts required; none present and none needed for a plain library.
• Debian changelog closures (#1146589 drop python bindings, ITP #962686, python versions #1023961) are consistent with the packaging; distribution unstable; latest version 0.14.0+git079611b-1.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

None.

Proposed changes

None.