DFSG NEW review for sd-debian-metapackages version 0.1.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 and complete for the tree: Files: * covers all five upstream files (README.md, CHANGELOG.md, tox.ini, .git-changelog.toml, LICENSE) and Files: debian/* the packaging, all under one free licence, GPL-3+, whose text is correctly referenced to /usr/share/common-licenses/GPL-3 as Policy 12.5 asks. Nothing non-free appears anywhere in the tree, no file carries a conflicting notice, and there is no built, generated or third-party code whose provenance would need a stanza. The two holders named are the two maintainers, and their names match the UIDs of the upstream signing keys.

Packaging

A small, well-formed metapackage: one binary sd-debian, Architecture: all, whose whole content is its dependency set; compat 14 with dh-sequence-single-binary (provided by debhelper 14.5) used to keep the single-binary layout; Standards-Version 4.7.4 matches the current Policy 4.7.4.1; source format 3.0 (quilt) with no patches; a signed upstream tarball, upstream/metadata and Vcs-* fields. Both hard dependencies exist in the archive; the one dependency and the three Suggests that the lists do not have are NEW/not-yet-existing packages rather than faults.

Issues

None.

Verified

• The upstream tarball holds exactly five files (sd-debian-metapackages-0.1.0/{.git-changelog.toml,CHANGELOG.md,LICENSE,README.md,tox.ini}); no built files, binaries, PDFs, minified code, generated code or vendored third-party libraries, and no Files-Excluded needed.
• LICENSE is the unmodified GPL version 3 text (674 lines, ending with the standard 'How to Apply These Terms' appendix); it is the only licence text in the tree.
• The prescan's author check scanned the four upstream files that can carry notices; none of them (README.md, CHANGELOG.md, tox.ini, .git-changelog.toml) contains a Copyright, (C), © or SPDX line, so no holder in the tree contradicts the two named in Files: *, and none is missing from it.
• The two holders in debian/copyright match the UIDs in debian/upstream/signing-key.asc: Daniel Baumann <mail@daniel-baumann.ch> and Patrik Dufresne <patrik@ikus-soft.com> (alongside his ikus06@gmail.com and info@patrikdufresne.com UIDs). The file holds two OpenPGP PUBLIC key blocks, not a private key.
• No licence terms beyond the GPL-3 text exist in the tree: the string searches for SPDX-License-Identifier, All rights reserved, non-commercial, no-modification and field-of-use wording hit only the GPL's own body (e.g. GPL-3 §7 'Additional Terms', §2 'noncommercially').
• Build-Depends: dh-sequence-single-binary is a virtual package provided by debhelper 14.5 (apt-cache), so it resolves together with debhelper-compat (= 14) in unstable; /usr/share/perl5/Debian/Debhelper/Sequence/single_binary.pm only adds --destdir=debian/tmp/ to dh_auto_install and errors on multiple binaries, which this source does not have.
• Dependencies: sd-debian-hook-apt and sd-debian-hook-dpkg are in the archive at 0.2.0-1 (source sd-debian-hooks); sd-debian-ansible is a binary of source sd-debian 0.1.0-1 waiting in NEW; sd-debian is this package's own binary. Enhances: ansible names a package that exists (ansible 14.4.0+dfsg-1).
• Source format 3.0 (quilt) with no debian/patches and an empty quilt series; .pc/ left unread as instructed. No maintainer scripts, *.maintscript, debian/install, debian/links, debian/docs or debian/tests exist — none is needed for an empty metapackage.
• debian/rules runs dh ${@} and an execute_after_dh_auto_clean that removes a .tox directory the source does not contain; harmless, it changes nothing in the build.
• Trailing commas after the last element of Build-Depends and Depends are tolerated by dpkg: the generated .dsc re-emits Build-Depends: debhelper-compat (= 14), dh-sequence-single-binary with the comma dropped.
• The orig tarball contains no debian/ directory, so the packaging is entirely in the .debian.tar.xz, whose file list matches the tree (changelog, control, copyright, rules, watch, source/format, upstream/metadata, upstream/signing-key.asc).
• debian/changelog: one entry, 0.1.0-1, distribution sid, urgency medium, dated Sun, 01 Nov 2026, which is a Sunday; version matches the upstream tarball name and Upstream-Name.
• debian/upstream/metadata gives Bug-Database, Bug-Submit, Repository and Repository-Browse; Vcs-Git/Vcs-Browser and Homepage are consistent with it.
• Standards-Version 4.7.4 against Policy 4.7.4.1: same first two components, so current (not an issue by the review's rule).
• uscan found the packaged version as the newest upstream release (upstream 0.1.0, packaged 0.1.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed

• Suggests: sd-debian-bundles-all, sd-debian-bundles-doc, sd-debian-doc name three binaries that are in neither the package lists nor the NEW queue. Suggests is optional and apt only ignores an unknown name, so this is not a fault in the package, but unless those source packages are uploaded the suggestions will dangle.
• debian/copyright declares GPL-3+, while the only grant shipped is the plain GPL version 3 text: no file in the tree states 'or any later version' (the phrase occurs only in GPL-3 §14 and in the licence's own boilerplate appendix). The copyright holders are the two uploaders, so the '+' is their own declaration and the package cannot be shown wrong; I could not consult the upstream project's statement to confirm it.

Proposed changes

None.