DFSG NEW review for sludge version 2.3.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 3 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: 28 found

Licensing

Nothing in the tree is non-free: the bulk is LGPL-2.1, the GTK Dev Kit and the Debian files are GPL-3+, libvorbis and libwebm are BSD-3 with their notices present, the DHTMLGoodies menu script is LGPL-2.1+, and source/CommonCode/utf8.cpp is public domain. The DFSG is satisfied. debian/copyright is nevertheless not fully accurate: Files: * describes source/CommonCode/utf8.cpp as LGPL-2.1 under the SLUDGE authors although the file is public domain by Jeff Bezanson, and the libwebm stanza names only Google Inc. while the file headers name The WebM project authors. Both are fixed with small stanzas.

Packaging

The packaging is clean and current: debhelper compat 13 with a plain dh $@, complete Build-Depends for what the CMake files look for, correct package split and relationships, man pages generated from DocBook sources, desktop/MIME/icon integration, an install-file set that matches the CMake install destinations, and no patches. The one real defect is that the engine embeds a 2010 copy of libwebm's mkvparser even though Debian ships libwebm-dev, which Policy 4.13 says to link against instead.

Issues

1. [blocker] [licensing] Files: * calls source/CommonCode/utf8.cpp LGPL-2.1 by the SLUDGE authors; it is public domain by Jeff Bezanson

• Files: source/CommonCode/utf8.cpp:1-4, debian/copyright:7-11
• Basis: checked, in the package or with a reference tool
• Evidence: utf8.cpp begins Basic UTF-8 manipulation routines / by Jeff Bezanson / placed in the public domain Fall 2005, while Files: * says Copyright: 2000 - 2008 Tim Furnish (Hungry Software) ... 2010 - 2014 Tobias Hansen and License: LGPL-2.1.
• Problem: The file is compiled into both sludge-engine and sludge-devkit (COMMON_DIR/utf8.cpp in CMakeLists.txt, SOURCE_DIR/CommonCode/utf8.cpp in GTK_Dev_Kit/CMakeLists.txt), so the copyright shipped in the binary packages is wrong: the author is omitted and a public-domain work is described as LGPL-2.1. DEP-5 §6.8 requires public-domain status to be recorded; Policy 4.5 requires the copyright file to carry the package's copyright information.
• Fix: Add, after the Files: * stanza, a stanza such as Files: source/CommonCode/utf8.cpp / Copyright: 2005 Jeff Bezanson / License: public-domain with a short paragraph quoting Basic UTF-8 manipulation routines ... placed in the public domain Fall 2005 (and note that it contains a routine based on PCRE's valid_utf8 by Philip Hazel).

2. [minor] [licensing] libwebm stanza omits the holder named in the file notices, The WebM project authors

• Files: source/Engine/libwebm/mkvparser.cpp:1, source/Engine/libwebm/mkvreader.cpp:1, debian/copyright:36-38
• Basis: checked, in the package or with a reference tool
• Evidence: // Copyright (c) 2010 The WebM project authors. All Rights Reserved. in mkvparser.cpp, mkvparser.hpp, mkvreader.cpp and mkvreader.hpp; stanza says Files: source/Engine/libwebm/* / Copyright: 2010, Google Inc..
• Problem: The Copyright field should collect the notices that the files actually carry (DEP-5 §6.8); the licence and its text are right, but the holder stated in the headers is not named.
• Fix: Make the Copyright field 2010, Google Inc. and 2010 The WebM project authors.

3. [minor] [packaging] Engine embeds a 2010 copy of libwebm's mkvparser although Debian packages libwebm

• Files: source/Engine/libwebm/mkvparser.cpp, source/Engine/libwebm/mkvparser.hpp, source/Engine/libwebm/mkvreader.cpp, CMakeLists.txt:104-106
• Basis: checked, in the package or with a reference tool
• Evidence: libwebm/mkvparser.cpp libwebm/mkvreader.cpp are compiled into sludge-engine; apt-cache show libwebm-dev gives Source: libwebm, version 1.0.0.32-1, Section: libdevel, with libwebm1.
• Problem: Policy 4.13 says that where the included code is already in the archive as a library, the Debian packaging should ensure that binary packages reference the libraries already in Debian and the convenience copy is not used. The files are a verbatim 2010 libwebm snapshot (mkvparser, mkvreader) rather than Debian's library, so security and bug fixes to libwebm do not reach the package.
• Fix: Build-Depend on libwebm-dev, drop source/Engine/libwebm/mkvparser.*, and use mkvreader/mkvparser from /usr/include (upstreaming the change if the local MkvReader::Open(int) shim is still needed).

4. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Read every file in debian/ in full, including control, rules, copyright, all .install/.manpages/.doc-base/.sharedmimeinfo/.xml, source/format and source/include-binaries; licence notices were grepped across source/, GTK_Dev_Kit/, doc/, tests/, cmake/ and packaging/, and every LICENSE/COPYING/GPL file read.
• COPYING is the LGPL-2.1 text and GPL the GPL-3 text; README and doc/SLUDGEDevKitHelp/Copyright.html grant LGPL 2.1 for SLUDGE except the GTK Dev Kit, which is GPL 3 or later; this matches the Files: * (LGPL-2.1) and debian/* GTK_Dev_Kit/* (GPL-3+) stanzas. No MIT, Apache, MPL, CC or other licence family occurs anywhere in the tree.
• source/Engine/libvorbis/ holds COPYING (BSD-3, Copyright (c) 2002-2008 Xiph.org Foundation), vorbis_misc.h and vorbis_os.h ((C) COPYRIGHT 1994-2009 by the Xiph.Org Foundation); the stanza names Xiph.Org Foundation and reproduces the BSD-3 text. The two headers are needed because source/Engine/movie.cpp uses the vorbis_fpu_setround/vorbis_ftoi macros, which libvorbis-dev does not ship.
• GTK_Dev_Kit/support/sludge.lang carries an LGPL-2.1 notice (Marco Barisione, Emanuele Aina, Tobias Hansen) and doc/SLUDGEDevKitHelp/HtmlMenu.html an LGPL-2.1-or-later notice (DHTMLGoodies.com, Alf Magne Kalleland, Tobias Hansen); both have their own stanzas, and the Erwin Broekhuis stanza correctly overrides the GTK-Dev-Kit and debian/* stanzas for the icons and images it lists.
• __MyCompanyName__ (source/DevKit/GraphicalTools/floormaker.cpp, floormaker.h, source/DevKit/TranslationEditor/translator.cpp, translator.h, source/Engine/shaders.h) is an unedited Xcode template placeholder, not a holder; the files were created by Rikard Peterson, who is named in Files: *. SLUDGE Developers in source/Engine/movie.cpp/movie.h is upstream's collective name for the same authors.
• doc/Credits.html and doc/Credits.rtf are a credits page reproducing the licences of the libraries SLUDGE uses; the holders the scan found in them (Andreas Dilger, Glenn Randers-Pehrson, Guy Eric Schalnat/Group 42, Jean-loup Gailly and Mark Adler, Ben Davis with Robert J Ohannessian and Julien Cugniere, Ben Woodhouse, the FSF and the 59 Temple Place address) are authors of libpng, zlib, DUMB, GLee, the LGPL and the GPL quoted there, not holders of the document. Every doc/SLUDGEDevKitHelp/*.html page ends with SLUDGE and this SLUDGE documentation are copyright Hungry Software and contributors 2000-2012, covered by Files: *.
• Example-project sprite banks and images, covered by Files: * (LGPL-2.1) and by upstream's Erwin Broekhuis credit for the artwork: doc/ExampleProjects/VerbCoin/demofont.duc, doc/ExampleProjects/VerbCoin/nicupfontsmall.duc, doc/ExampleProjects/VerbCoin/ego/alien.duc, doc/ExampleProjects/VerbCoin/outside/duck.duc, doc/ExampleProjects/VerbCoin/iface/mouse.duc, doc/ExampleProjects/VerbCoin/iface/mushroom.duc, doc/ExampleProjects/VerbCoin/iface/invback.tga, doc/ExampleProjects/VerbCoin/iface/verbcoin.tga. They are SLUDGE .duc font and sprite banks and TGA interface art of the bundled VerbCoin example.
• doc/ExampleProjects/VerbCoin/inside/room.tga and doc/ExampleProjects/VerbCoin/outside/room.tga are the background TGA images of the two rooms, and doc/ExampleProjects/VerbCoin/inside/room.zbu and doc/ExampleProjects/VerbCoin/outside/room.zbu their SLUDGE z-buffer files (Szb data); doc/ExampleProjects/Welcome/image.tga is the background of the Welcome example. All are example data under Files: * (LGPL-2.1).
• doc/ExampleProjects/VerbCoin/inside/music.mod and doc/ExampleProjects/VerbCoin/outside/music.mod are the tracker-module originals, and doc/ExampleProjects/VerbCoin/inside/music.xm and doc/ExampleProjects/VerbCoin/outside/music.xm the FastTracker versions the examples play; doc/CMakeLists.txt excludes *.mod (and *.helpindex) from installation, so only the .xm files ship. Covered by Files: *.
• images/ARROWS.CUR, images/BIGARROW.cur, images/BLOKEY.CUR, images/CROSS.CUR, images/INVIS.CUR, images/MOVER.CUR, images/NOWAY.CUR and images/TARGET.CUR are Windows cursor resources included by images/SLUDGE.RC, which is only compiled on Windows; they fall under Files: images/* (Erwin Broekhuis, LGPL-2.1).
• doc/SLUDGE Dev Kit Help.chw is a compiled Windows HTML Help index and doc/SLUDGEDevKitHelp/SLUDGEDevKitHelp.helpindex a macOS help index; their source, doc/SLUDGE Dev Kit Help.hhp, SLUDGE Dev Kit Help.hhk, Table of Contents.hhc and the HTML pages, is all present, and neither binary is installed into a package.
• tests/devkit/fixtures/zbuffer.tga is the input fixture of tests/devkit/view_test.cpp, next to the reference images in tests/devkit/references/, and is covered by Files: *.
• debian/source/include-binaries lists exactly the eight PNGs added under debian/engine/icons/, which debian/sludge-engine.install installs to usr/share/icons/hicolor, matching the application/x-sludge-game MIME icons and Icon=sludge-engine of the desktop file.
• Build-Depends cover what the build looks for: SDL3, ogg/vorbis, PNG, DUMB, vpx, GTK 3, glib, epoxy, OpenGL, pkgconf for CMakeLists.txt, cmake/Dependencies.cmake and GTK_Dev_Kit/CMakeLists.txt, and docbook-xml/docbook-xsl/xsltproc for the man pages; libsdl3-dev (3.4.18) and libdumb1-dev were verified in the archive.
• override_dh_auto_test: dh_auto_test -- "ARGS+=-E devkit_views" is correct: cmake.pm test() prepends ARGS+= make variables, so CTest is invoked with -E devkit_views, and the override is skipped under nocheck at compat 13.
• Each file CMake installs is matched by an .install or .manpages file (devkit glade/png icons and five desktop files, the five tools and the compiler, the engine moved from usr/bin to usr/games, docs to usr/share/doc/sludge), and dh_installmime handles the two .sharedmimeinfo files; Policy 10.1 grandfathers the existing /usr/games installation.
• The man pages generated from debian/*.1.xml match the code: -f/--fullscreen, -w/--window, -L/--list-languages, -l/--language, -a/--antialias, -d/--debug, -h/--help are exactly the options of parseCmdlineParameters() in source/Engine/posixstuff.cpp, and the documented Alt+Enter/Alt+A/Alt+C shortcuts exist in source/Engine/main.cpp.
• Relationship sanity: sludge-devkit depends on sludge-engine because SludgeProjectManager.cpp runs sludge-engine via G_SPAWN_SEARCH_PATH; the compiler is a separate binary linking GTK_Dev_Kit/CompilerMain.cpp (GPL-3+) with the LGPL-2.1 DevKit code, which LGPL-2.1 §3 permits. No patches, 3.0 (quilt), Standards-Version: 4.7.4 against Policy 4.7.4.1, changelog version 2.3.1-1 in unstable.
• uscan found the packaged version as the newest upstream release (upstream 2.3.1, packaged 2.3.1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3, LGPL-2.1).

Not confirmed

• The provenance of the example projects' music and sound files (doc/ExampleProjects/VerbCoin/inside/music.mod, doc/ExampleProjects/VerbCoin/inside/music.xm, doc/ExampleProjects/VerbCoin/outside/music.mod, doc/ExampleProjects/VerbCoin/outside/music.xm, doc/ExampleProjects/VerbCoin/iface/pop.wav, doc/ExampleProjects/Welcome/tada.wav) and of the two font sprite banks (doc/ExampleProjects/VerbCoin/demofont.duc, doc/ExampleProjects/VerbCoin/nicupfontsmall.duc): they are binary and were not opened, and upstream's Credits credits only Erwin Broekhuis for graphics, so a third-party origin that Files: * would not cover cannot be ruled out from the text files.
• Whether the 2010 mkvparser/mkvreader code would compile against Debian's libwebm 1.0.0.32 unmodified; only a build would show, so the Policy 4.13 fix may need a small compatibility shim.
• docbook-xsl is not installed on the reviewing system, so I could not check that its XML catalog resolves the http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl URL used with xsltproc --nonet; the build chroot installs docbook-xsl, which normally provides that mapping.