DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: sd-debian-hooks 0.1.0-1

Package Information

DescriptionSoftware-defined Debian (apt hook)

Software-defined Debian (sd-debian) is a next-generation declarative framework to deterministically define a Debian system with all its packages, configuration, and data.

This package contains the apt hook.

Maintainersd-debian Maintainers <team+sd-debian@tracker.debian.org>
Changed ByDaniel Baumann <daniel@debian.org>
Sponsormail@daniel-baumann.ch
Distributionsid
Architectureall
VCSgit: https://git.sd.debian.net/packages/sd-debian-hooks (browse)
Trackerhttps://tracker.debian.org/pkg/sd-debian-hooks
Uploaded26 days ago

New Package Report

.changes◂
Distributionsid
DateMon, 12 Oct 2026 16:18:54 +0200
Sourcesd-debian-hooks
Version0.1.0-1
Changed-ByDaniel Baumann <daniel@debian.org>
Architecturesource all
Changelog◂ 
sd-debian-hooks (0.1.0-1) sid; urgency=medium
 .
   * Initial upload to sid.
.dsc◂
Sectionadmin
Priorityoptional
Componentmain
Package-Listsd-debian-hook-apt deb admin optional arch=all
sd-debian-hook-dpkg deb admin optional arch=all
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: sd-debian-hooks
Upstream-Contact: https://git.sd.debian.net/packages/sd-debian-hooks/issues
Source: https://git.sd.debian.net/packages/sd-debian-hooks/tags

Files: *
Copyright:
 2024-2026 Daniel Baumann <daniel@debian.org>
 2024-2026 Patrik Dufresne <patrik@ikus-soft.com>
License: GPL-3+

Files: debian/*
Copyright:
 2024-2026 Daniel Baumann <daniel@debian.org>
 2024-2026 Patrik Dufresne <patrik@ikus-soft.com>
License: GPL-3+

License: GPL-3+
 The full text of the GNU General Public License 3
 can be found in the file /usr/share/common-licenses/GPL-3

DFSG Assistant LLM REVIEW 0 blocker, 2 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 21 days ago.

Report◂

DFSG NEW review for sd-debian-hooks version 0.1.0-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: No
  • Issues: 0 blocker, 2 important, 2 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

Every upstream file carries a GPL-3-or-later notice naming Daniel Baumann and Patrik Dufresne, both of whom debian/copyright lists; the two test modules name only Patrik Dufresne, who is also covered by the Files: * stanza. debian/copyright is DEP-5, has a correct GPL-3+ stanza pointing at /usr/share/common-licenses/GPL-3, and nothing in the tree is non-free or of unclear provenance. The prescan's author check found no holder missing from debian/copyright.

Packaging

The packaging is small and mostly clean: compat 14 with a plain dh sequencer, correct debhelper-generated maintainer scripts, tmpfiles handled by dh_installtmpfiles, current Standards-Version, and every upstream file installed by exactly one of the two binary packages. But the apt hook package is broken when installed without the dpkg hook package: it opens the lock file in /run/sd-debian, a directory only the dpkg hook creates, and dies with an uncaught FileNotFoundError on every apt dpkg Post-Invoke. There is also an unused Build-Depends (devscripts).

Issues

important packaging 1. sd-debian-hook-apt's Post-Invoke hook crashes when /run/sd-debian does not exist ◂
  • Files: files/usr/libexec/sd-debian/hooks/apt_dpkg-post-invoke:33, files/usr/libexec/sd-debian/hooks/apt_dpkg-post-invoke:103, files/usr/libexec/sd-debian/hooks/dpkg_status-logger:197, debian/sd-debian-hook-dpkg.tmpfiles, debian/control
  • Basis: checked, in the package or with a reference tool
  • Evidence: RUNDIR = Path("/run/sd-debian") and lock_fd = os.open(LOCKFILE, os.O_CREAT | os.O_RDWR) at the top of wait_for_dpkg_status_logger(), with no mkdir; /run/sd-debian is created only by dpkg_status-logger (RUNDIR.mkdir(parents=True, exist_ok=True)) and is not listed in debian/sd-debian-hook-dpkg.tmpfiles (which only has /var/lib/sd-debian and /var/log/sd-debian). sd-debian-hook-dpkg.tmpfiles and dpkg_status-logger ship only in sd-debian-hook-dpkg, and sd-debian-hook-apt neither Depends on it nor ships the directory itself.
  • Problem: sd-debian-hook-apt is an independently installable binary package, and its only purpose is the /etc/apt/apt.conf.d/99sd-debian-hook snippet that runs apt_dpkg-post-invoke on every DPkg::Post-Invoke. With sd-debian-hook-dpkg not installed, /run/sd-debian does not exist, so os.open(..., O_CREAT) raises FileNotFoundError outside the loop's try/except, and the hook aborts with a Python traceback on every apt install/upgrade/remove. The unit tests hide this because they replace wait_for_dpkg_status_logger with a no-op (tests/test_apt_post_invoke.py:82).
  • Fix: Create the runtime directory before opening the lock (RUNDIR.mkdir(parents=True, exist_ok=True)), and/or ship a tmpfiles entry for /run/sd-debian in sd-debian-hook-apt, or make sd-debian-hook-apt depend on the package that provides the state files it consumes. Add a test that exercises wait_for_dpkg_status_logger() with a non-existent lock directory.
important packaging 2. uscan reports a warning for debian/watch ◂

  • Files: debian/watch

  • Basis: found by the review tooling's own checks

  • Evidence:

    In watchfile debian/watch, reading webpage
  https://sd.debian.net/api/v1/repos/sd-debian/sd-debian-hooks/tags failed: 404 Not Found

  • Problem: uscan must run without errors or warnings and find the upstream releases.

  • Fix: Correct debian/watch so that uscan --report runs cleanly.

minor packaging 3. The apt hook writes /var/log/sd-debian/sd-debian.log without rotation when the dpkg hook is absent ◂
  • Files: files/usr/libexec/sd-debian/hooks/apt_dpkg-post-invoke:84-96, files/etc/logrotate.d/sd-debian, debian/sd-debian-hook-dpkg.install, debian/sd-debian-hook-dpkg.tmpfiles
  • Basis: checked, in the package or with a reference tool
  • Evidence: setup_logger(LOGFILE) with LOGFILE = LOGDIR / "sd-debian.log" is called unconditionally in the apt hook; the logrotate rule and the 0750 root:adm /var/log/sd-debian directory are installed only by sd-debian-hook-dpkg.
  • Problem: When sd-debian-hook-apt is installed alone, its hook creates /var/log/sd-debian/sd-debian.log as root and appends to it on every apt operation, but nothing rotates or bounds it and logrotate is only even Suggests in the other package. Unbounded root-owned logs are a poor outcome for a package that can be installed by itself.
  • Fix: Ship the log directory and its logrotate rule with the package that writes the log (or use the same dependency arrangement as for the /run directory), and make logrotate a Recommends of whichever package ships the rule.
minor packaging 4. Build-Depends names devscripts, which nothing uses ◂
  • Files: debian/control:10-19, debian/rules, tox.ini
  • Basis: checked, in the package or with a reference tool
  • Evidence: devscripts <!nocheck> in Build-Depends; debian/rules only runs tox -e lint / tox -e test, and tox.ini's dependencies are black, isort, flake8, flake8-copyright and pytest.
  • Problem: An unused build dependency pulls devscripts and its dependency tree onto every buildd for no purpose and is the sort of thing a sponsor asks to be dropped.
  • Fix: Remove devscripts <!nocheck> from Build-Depends.
Verified ◂
  • Read every file in the tree (14 upstream files plus debian/); .pc/ and debian/cargo-checksum.json (absent) excluded.
  • debian/copyright is DEP-5 with Format: 1.0; Files: * and debian/* both GPL-3+, both holders (Daniel Baumann, Patrik Dufresne) listed; the standalone GPL-3+ paragraph points to /usr/share/common-licenses/GPL-3, which exists.
  • Licence headers agree with debian/copyright in all five source files: the three hooks and two test modules carry SPDX GPL-3.0+ with the 'either version 3 ... or any later version' grant; LICENSE is the verbatim GPL-3 text.
  • Prescan author check reported no holder missing from debian/copyright; nothing in the tree is binary, generated, minified or vendored, and the prescan listed no other files.
  • The three hook scripts and the three /etc snippets are each installed by exactly one .install file; no source file is left uninstalled (dh_missing clean by inspection).
  • dh_installtmpfiles runs in the default dh sequence since compat 13 and at compat 14 removes the tmpfiles on package removal/purge (checked with the debhelper tool); debian/sd-debian-hook-dpkg.tmpfiles is therefore picked up automatically.
  • The dpkg.cfg.d snippet's status-logger=(...) form is valid: dpkg.cfg(5) takes the same options as the command line without leading hyphens, and dpkg(1) uses --status-logger=command, run via sh -c, so the subshell is acceptable.
  • Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 (first two components equal); compat 14 is current; no missing relationship substvars at compat 14.
  • Build-Depends packages checked in the archive: python3-flake8-copyright (0.2.4-1) and tox (4.55.1-3) exist; debhelper-compat (= 14) is provided by debhelper 14.5.
  • No debian/patches directory and no patches/series; source format 3.0 (quilt) with no patches is valid.
  • sd-debian, named in Enhances, is not in the archive's lists nor in NEW; it is the companion project these hooks are opt-in for, and the hooks handle its absence by checking for /usr/bin/sd-debian.
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).
Not confirmed ◂
  • Whether tox -e test works at build time: [testenv] sets neither skip_install nor package, and the source tree has no pyproject.toml or setup.py, so tox 4 may fail at its packaging step; pip may also want the network for the deps. tox is not installed on the reviewing system, so this could not be checked. A build would show it.
  • tox -e lint runs black/isort/flake8 from whatever versions Debian provides rather than pinned ones; a formatting difference would fail the build. Not checked.
  • The executable bit on the hook scripts in the tarball could not be verified (the read-only tooling does not expose file modes); if they were not executable, the /etc snippets' -x guards would silently disable all hooks.
Proposed changes ◂

None.

Uploader's response to the LLM review

I've reviewed the suggested changed and commited them in git for the next upload, however, they are not blocking the acceptance of the package (so I don't upload just yet).

— Daniel Baumann (daniel), 19 days ago

Review Information

accepted — allocated to awm 14 days ago, started 14 days ago, completed 14 days ago.

Final Comment

Back to Dashboard | View all reviews for this package