smatch 1.75-1

Package Information

Description	Static Analyser for C <Insert long description, indented with spaces.>
Maintainer	Alex Myczko <tar@debian.org>
Changed By	Alex Myczko <tar@debian.org>
Sponsor	tar@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/debian/smatch.git (browse)
Closes	#1070846
Tracker	https://tracker.debian.org/pkg/smatch
Uploaded	4 hours ago

New Package Report

.changes◂

Distribution	unstable
Date	Thu, 12 Nov 2026 22:13:00 +0100
Source	smatch
Version	1.75-1
Changed-By	Alex Myczko <tar@debian.org>
Architecture	source arm64

Changelog◂

smatch (1.75-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1070846)

.dsc◂

Section	devel
Priority	optional
Component	main
Package-List	smatch deb devel optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/error27/smatch
Upstream-Name: smatch
Upstream-Contact: Dan Carpenter

Files:
 *
Copyright:
 2006 Dan Carpenter
License: GPL-2+

Files:
 avl.c
 avl.h
Copyright:
 2010 Joseph Adams <joeyadams3.14159@gmail.com>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

Files:
 cwchash/*
Copyright:
 2002-2004 Christopher Clark <firstname.lastname@cl.cam.ac.uk>
License: BSD-3-clause

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 3. Neither the name of ZXC nor the names of its contributors may be
    used to endorse or promote products derived from this software
    without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL BERTRAND LEBONNOIS OR CONTRIBUTORS BE LIABLE FOR
 DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Files:
 debian/*
Copyright:
 2026 Alex Myczko <tar@debian.org>
License: GPL-2+

License: GPL-2+
 This package is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this package. If not, see <https://www.gnu.org/licenses/>.
Comment:
 On Debian systems, the complete text of the GNU General
 Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".

DFSG Assistant LLM REVIEW 5 blocker, 2 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 3 hours ago.

Report◂

DFSG NEW review for smatch version 1.75-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 5 blocker, 2 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree mixes GPL-2+, GPL-2-only, MIT, BSD-3-clause and OSL-1.1 files, but debian/copyright reduces nearly all of it to one Files: * stanza saying GPL-2+ with only Dan Carpenter's copyright. That is wrong for the whole sparse-derived half of the tree (MIT, with Transmeta, Linus Torvalds, Christopher Li, Luc Van Oostenryck, IBM and others), for smatch_data/db/smdb.py (OSL-1.1, with no licence text at all), and for check_host_input.c (GPL-2 only); many GPL-2+ check files name holders the file does not. semind.c carries no licence grant. The licences themselves are free and compatible in the compiled binary, so the defect is the copyright file, which is a blocker.

Packaging

The binary package's long description is still the dh_make placeholder, so every user and apt front end sees <Insert long description, indented with spaces.>. Build-Depends names only debhelper-compat (= 13) while the Makefile links smatch and sm_hash against -lsqlite3 -lssl -lcrypto, so a clean build cannot link. The destdir patch keeps the unfilled DEP-3 template in its header. Standards-Version 4.7.4, compat 13, 3.0 (quilt), Conflicts: sparse (smatch installs /usr/bin/sparse, cgcc and their man pages), upstream/metadata and the changelog are otherwise in order.

Issues

blocker licensing 1. Files: * says GPL-2+ and only Dan Carpenter, but the sparse-derived half of the tree is MIT with other holders ◂

Files: debian/copyright:6-10, LICENSE:1-6, LICENSE:36-38, Documentation/smatch.rst:87-88, parse.c:4-10, linearize.c:9-10, options.c:1-7, graph.c:1-2, c2xml.c:6-7, compile.c:4-8, bits.h:1, check_netdev_priv.c:1-4, ast-model.c:5-8
Basis: checked, in the package or with a reference tool
Evidence: debian/copyright: Files: * / Copyright: 2006 Dan Carpenter / License: GPL-2+. LICENSE:1-2: Smatch is released under the GPLv2+ license however Smatch includes the Sparse source as well which is licensed under the MIT license; LICENSE:37: The 'sparse' C parser front-end library is copyrighted by Transmeta Corp and other authors and licensed under the "MIT License". parse.c:6-8: Copyright (C) 2003 Transmeta Corp. / 2003-2004 Linus Torvalds / Copyright (C) 2004 Christopher Li followed by the MIT permission text. graph.c:1-2: Copyright © International Business Machines Corp., 2006 / Adelard LLP, 2007 + MIT. check_netdev_priv.c:1-4: SPDX-License-Identifier: MIT / Copyright (C) 2021 Pavel Skripkin.
Problem: The largest part of the package is the Sparse front end, which upstream licenses MIT, not GPL-2+, and whose copyright holders are Transmeta Corp, Linus Torvalds, Christopher Li, Luc Van Oostenryck, IBM, Adelard LLP, Jeff Garzik, Rob Taylor and others - none of them named in debian/copyright. The same wrong claim covers the MIT-labelled smatch files (bits.h, dominate.c, flowgraph.c, ir.c, optimize.c, options.c, predefine.c, ptrmap.c, scheck.c, ssa.c, test-show-type.c, utils.c, check_netdev_priv.c) and the Sparse documentation. DEP-5 (copyright-format 5.2) requires a Files stanza with the right holders and licence for each such group; a copyright file that says GPL-2+/Dan Carpenter for MIT files with dozens of other holders is inaccurate.
Fix: Add Files stanzas for the sparse-derived files (and for the SPDX-MIT smatch checks and the Sphinx docs), each with License: MIT reusing the existing MIT paragraph and listing Transmeta Corp, Linus Torvalds, Christopher Li, Luc Van Oostenryck, International Business Machines Corp., Adelard LLP, Jeff Garzik, Rob Taylor, Pavel Skripkin and whoever else the notices name; leave Files: * for the GPL-2+ smatch files only.

blocker licensing 2. GPL-2+ stanza names only Dan Carpenter; Oracle, Intel, Linaro, ARM, Joyent, MNX Cloud, Christophe Jaillet and Rasmus Villemoes are missing ◂

Files: debian/copyright:6-10, check_always_true.c:3-4, check_cmn_err.c:2, check_cmn_err.c:17-18, check_arm64_tagged.c:2, check_ida_alloc.c:2, check_kernel_printf.c:2, smatch_kernel_host_data.c:33, check_host_input.c:25
Basis: checked, in the package or with a reference tool
Evidence: check_always_true.c:3-4: Copyright (C) 2022 Oracle. / Copyright 2023 Linaro Ltd.; check_cmn_err.c:2,17-18: Copyright (C) 2016 Oracle. / Copyright 2019 Joyent, Inc. / Copyright 2024 MNX Cloud, Inc.; check_arm64_tagged.c:2: Copyright (C) 2019 ARM.; check_ida_alloc.c:2: Copyright (C) 2022 Christophe Jaillet.; check_kernel_printf.c:2: Copyright (C) 2015 Rasmus Villemoes.; smatch_kernel_host_data.c:33: Copyright (C) 2022 Elena Reshetova Intel Corporation. - all against debian/copyright Copyright: 2006 Dan Carpenter as the only holder for Files: *.
Problem: The Copyright field of the catch-all stanza is the only place these files are described, and it names none of their holders. Oracle alone appears in more than 150 check_*.c files (the pre-scan found 156). DEP-5 (copyright-format 5.2/6.5) requires the actual copyright holders per group of files; a sponsor cannot accept a copyright file that credits a single holder for files belonging to Oracle, Intel, Linaro, ARM, Joyent, MNX Cloud and individual contributors.
Fix: List Oracle, Intel Corporation, Linaro Ltd, ARM, Joyent, Inc., MNX Cloud, Inc., Christophe Jaillet and Rasmus Villemoes (and the other holders the pre-scan found) in the Copyright field of the stanza that covers their files, or split the GPL-2+ group into stanzas per holder.

blocker licensing 3. smatch_data/db/smdb.py is licensed OSL-1.1, which debian/copyright does not mention and whose text it does not include ◂

Files: smatch_data/db/smdb.py:3-5, debian/copyright:6-10
Basis: checked, in the package or with a reference tool
Evidence: smdb.py:3-5: # Copyright (C) 2013 Oracle. / # / # Licensed under the Open Software License version 1.1. debian/copyright has no OSL stanza and the catch-all gives GPL-2+; smdb.py is installed to /usr/share/smatch/db/smdb.py (Makefile:115, INST_ASSETS += $(wildcard smatch_data/*)).
Problem: The Open Software License 1.1 is a different, copyleft licence, not GPL-2+, and it is not in /usr/share/common-licenses. DEP-5 (copyright-format 5.3, 6.7) requires a stand-alone License: OSL-1.1 paragraph containing its full text, and a Files: stanza attributing the script to Oracle. Neither is present, so the copyright file misstates the file's licence and ships no copy of its terms.
Fix: Add Files: smatch_data/db/smdb.py with Copyright: 2013 Oracle and License: OSL-1.1, plus a stand-alone OSL-1.1 paragraph with the complete licence text.

blocker licensing 4. check_host_input.c is GPL-2 only but debian/copyright puts it under GPL-2+ ◂

Files: check_host_input.c:25-30, debian/copyright:6-10
Basis: checked, in the package or with a reference tool
Evidence: check_host_input.c:27-29: This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2, as published by the Free Software Foundation. - there is no or (at your option) any later version.
Problem: The file grants GPL version 2 only, while the catch-all stanza says GPL-2+. The difference matters to anyone taking the code under GPL-3, and the licence short name in debian/copyright must match the grant (copyright-format 6.7, 7.1).
Fix: Add Files: check_host_input.c with Copyright: 2022 Intel Corporation and License: GPL-2, and refer to /usr/share/common-licenses/GPL-2.

blocker licensing 5. semind.c grants no licence at all ◂

Files: semind.c:1-5, LICENSE:1-6, Makefile:167-177
Basis: checked, in the package or with a reference tool
Evidence: semind.c:1-5 is only /* / * semind - semantic indexer for C. / * / * Copyright (C) 2020 Alexey Gladkov / */; a grep of the whole file for GNU, License, MIT and GPL finds no licence text. LICENSE:1-6 assigns GPL-2+ to Smatch and MIT to the Sparse source but does not say which semind.c is.
Problem: There is no permission to copy, modify or distribute the file, so it is not DFSG-free as shipped; the Files: * stanza's GPL-2+ claim for it has nothing behind it. semind is built and installed as /usr/bin/semind plus /usr/share/man/man1/semind.1 whenever sqlite3 is detected (Makefile:167-177), so the defect reaches the binary once the missing build dependency is added.
Fix: Ask upstream to state the licence of semind.c in the file and in LICENSE (it is a Sparse tool, so MIT is likely) and record that in debian/copyright with Alexey Gladkov as holder; otherwise do not build/install semind.

important licensing 6. cwchash BSD-3 paragraph is not the files' licence text: it names ZXC and BERTRAND LEBONNOIS ◂

Files: debian/copyright:44-66, cwchash/hashtable.c:244-262, cwchash/hashtable.h:169-186
Basis: checked, in the package or with a reference tool
Evidence: The files say Copyright (c) 2002, Christopher Clark / All rights reserved. / * Neither the name of the original author; nor the names of any contributors may be used to endorse... and IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE. debian/copyright instead has Neither the name of ZXC nor the names of its contributors and IN NO EVENT SHALL BERTRAND LEBONNOIS OR CONTRIBUTORS BE LIABLE.
Problem: The stand-alone License: BSD-3-clause paragraph is a template from an unrelated project, not the notice the cwchash files carry (DEP-5/copyright-format 6.7: the Licence paragraph contains the licence text). The short name is right, but the reproduced notice is not, and cwchash ships no COPYING file of its own.
Fix: Replace the BSD-3-clause paragraph with the exact text from cwchash/hashtable.c, clause 3 included.

important packaging 7. Long description in debian/control is the replacement placeholder ◂

Files: debian/control:17-18
Basis: checked, in the package or with a reference tool
Evidence: Description: Static Analyser for C followed by <Insert long description, indented with spaces.>.
Problem: Policy 3.4 requires the extended description to describe the package; as shipped, apt show smatch and every package browser display the dh_make placeholder. It is also the only text explaining what the package is.
Fix: Write a real extended description (what smatch does, that it needs a cross-function database, that it conflicts with sparse because it ships the Sparse tools).

minor packaging 8. Build-Depends omits libsqlite3-dev and libssl-dev, which smatch and sm_hash link against unconditionally ◂

Files: debian/control:4-6, Makefile:410, Makefile:412-413, Makefile:416, Documentation/smatch.rst:23-25
Basis: checked, in the package or with a reference tool
Evidence: Makefile:410: SMATCH_LDFLAGS := -lsqlite3 -lssl -lcrypto -lm; Makefile:413: $(Q)$(LD) -o $@ $< $(SMATCH_OBJS) $(SMATCH_CHECKS) $(LIBS) $(SMATCH_LDFLAGS); Makefile:416 links sm_hash the same way; smatch_hash.c:19 includes <openssl/evp.h>. debian/control Build-Depends: lists only debhelper-compat (= 13), and Documentation/smatch.rst says to install libsqlite3-dev ... libssl-dev.
Problem: In a clean unstable chroot that has only build-essential and the declared Build-Depends, dh_auto_build -> make cannot link smatch or smatch_data/db/sm_hash: the linker finds no libsqlite3, libssl or libcrypto. The same absence silently disables semind and c2xml (their pkg-config checks fail), so their man pages and assets are not installed either.
Fix: Add libsqlite3-dev and libssl-dev to Build-Depends (and libxml2-dev if c2xml is meant to be installed).

minor packaging 9. debian/patches/destdir still carries the unfilled DEP-3 template as its header ◂

Files: debian/patches/destdir:1-24, debian/patches/series:1
Basis: checked, in the package or with a reference tool
Evidence: Subject: [PATCH] <short summary of the patch> followed by TODO: Put a short summary on the line above and replace this paragraph, then the whole explanatory block The information above should follow the Patch Tagging Guidelines, see https://dep.debian.net/deps/dep3/ ... and unfilled Origin:, Forwarded:, Applied-Upstream: templates.
Problem: The only patch in the package has no description of what it does or why, no Origin and no Forwarded status; dpkg-source keeps all of it as the patch header, so debian/patches/destdir documents itself with a TODO. DEP-3 4.x asks for a description and the standard fields.
Fix: Replace the template with a real Description: (it changes the default PREFIX from $(HOME) to /usr so dh_auto_install works), and add Forwarded: not-needed or a URL.

Verified ◂

All of debian/ was read: control, rules, changelog, copyright, docs, clean, source/format, patches/series, patches/destdir, upstream/metadata. There is no debian/tests, debian/install, debian/links, debian/compat or maintainer script.
debian/copyright is DEP-5 with the current Format: line; Files: avl.c avl.h matches the MIT notice in those files (Copyright (C) 2010 Joseph Adams) and the stand-alone MIT paragraph reproduces the full text.
Every holder in the pre-scan is accounted for by issues 1, 2, 4 or 5: Alexey Gladkov, ARM, Christophe Jaillet, Elena Reshetova/Intel Corporation, Intel Corporation, Jeff Garzik, Joyent Inc, Linaro Ltd, Linus Torvalds, Luc Van Oostenryck, MNX Cloud Inc, Oracle, Pavel Skripkin, Rasmus Villemoes, Rob Taylor and Transmeta Corp; also International Business Machines Corp. and Adelard LLP, which the pre-scan's name matcher missed, and the check_*.c files named in its block.
Free Software Foundation, Inc at GPL-2:4 is the copyright line of the GPLv2 text shipped as GPL-2, not a claim on package files; the file is a verbatim copy of the licence.
Documentation/sphinx/cdoc.py and ir.py state SPDX_License-Identifier: MIT (misspelt, but MIT) with Luc Van Oostenryck's copyright; bits.h, dominate.c, flowgraph.c, ir.c, optimize.c, options.c, predefine.c, ptrmap.c, scheck.c, ssa.c, test-show-type.c, utils.c and check_netdev_priv.c carry SPDX-License-Identifier: MIT.
No built binaries, minified code or PDFs in the tree: globs found no .o, .a, .so, .sqlite, .pdf or .pyc; smatch_data/* and smatch_data/db/* are plain-text data, SQL schemas and shell/perl helpers (the only SQLite content is smdb.py, issue 3).
No non-commercial, no-modification or field-of-use wording was found; greps for Copyright, (C), ©, SPDX, Permission is hereby granted, GNU General/Lesser, Open Software License, public domain and All rights reserved covered the whole 1744-file tree, and source headers were read in sample across the sparse, smatch-check, cwchash and script parts rather than every file in full.
The compiled smatch is an aggregate of GPL-2+ smatch code with MIT sparse code plus MIT avl.c and BSD-3-clause cwchash, all GPL-2-compatible; semind and smdb.py are separate programs.
Standards-Version: 4.7.4 is current against Policy 4.7.4.1 (same first two components); debhelper compat 13 and 3.0 (quilt) are current practice; Conflicts: sparse matches the fact that smatch installs /usr/bin/sparse, /usr/bin/cgcc, sparse.1 and cgcc.1 from Makefile:112-113.
.pc/ was ignored throughout and debian/cargo-checksum.json is absent. debian/watch was not reviewed, as instructed.
uscan found the packaged version as the newest upstream release (upstream 1.75, packaged 1.75).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed ◂

Documentation/logo.svg is an image and was not opened; it carries no licence notice of its own and its provenance is not stated anywhere in the package (issue 1's wrong Dan Carpenter/GPL-2+ attribution covers it by default).
Whether the license of the Documentation/ texts (release notes, sparse-README.txt, the Sphinx templates) is MIT is not stated: LICENSE grants MIT to the Sparse source, and these are Sparse's documents. I treated them as Sparse material in issue 1.
Suspicion only: Makefile:114-116 builds INST_ASSETS from $(wildcard smatch_data/*), which also yields the smatch_data/db directory; install -D copies files and cannot install a directory as /usr/share/smatch/db, so make install (and therefore dh_auto_install) may fail. A build would show it.
debian/watch looks at github.com/error27/@package@, but the Source field of debian/copyright names github.com/error27/smatch. Whether these are the same upstream was not checked.
debian/watch looks at github.com/error27/@package@, but Repository in debian/upstream/metadata names github.com/error27/smatch. Whether these are the same upstream was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-14 00:27 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package