DFSG NEW review for spdlog version 1:1.17.0+ds-1~exp1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 1 important, 2 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is Expat/MIT throughout (LICENSE plus Distributed under the MIT License headers), no non-free wording appears anywhere, and the DFSG repack is consistent: include/spdlog/fmt/bundled is gone from both the tarball and the tree, and the external-fmt patch makes the installed headers use Debian's libfmt. But debian/copyright is not accurate: it names only Gabi Melman, while installed headers and one source file name four other holders (Victor Zverovich, Alexander Dalshov, ZVYAGIN.Alexander, mguludag), the third-party JetBrains logo in logos/ has no licence and is attributed to the upstream holder by Files: *, and debian/ itself has no stanza of its own.

Packaging

The packaging is in good order: debhelper compat 13 (still supported by the installed debhelper 14.5), Standards-Version 4.7.2 against Policy 4.7.4.1, hard-dependency ${misc:Depends}/${shlibs:Depends} handled by compat 13, correct Multi-Arch: same, a runtime package named after the CMake SOVERSION (1.17) with the established ${spdlog:Provides}/dh_makeshlibs fmt-ABI scheme already used by libspdlog1.15 in the archive, DEP-3-headed patches that are marked not-needed, and an autopkgtest that rebuilds the test suite and the example against the installed package. No packaging issue rises to the reporting threshold; two test-environment details I could not settle are under Not confirmed.

Issues

blocker licensing 1. debian/copyright omits the holders named in msvc_sink.h, systemd_sink.h, qt_sinks.h and src/bundled_fmtlib_format.cpp ◂

• Files: debian/copyright, include/spdlog/sinks/msvc_sink.h:1, include/spdlog/sinks/systemd_sink.h:1, include/spdlog/sinks/qt_sinks.h:1, src/bundled_fmtlib_format.cpp:2-3
• Basis: checked, in the package or with a reference tool
• Evidence: The only Files stanza is Files: * with Copyright: (c) 2014-2016 Gabi Melman <gmelman1@gmail.com> / (c) 2016-present Gabi Melman and spdlog contributors. The files say: // Copyright(c) 2016 Alexander Dalshov & spdlog contributors. (msvc_sink.h), // Copyright(c) 2019 ZVYAGIN.Alexander@gmail.com (systemd_sink.h), // Copyright(c) 2015-present, Gabi Melman, mguludag and spdlog contributors. (qt_sinks.h), and // Slightly modified version of fmt lib's format.cc source file. / // Copyright (c) 2012 - 2016, Victor Zverovich / // All rights reserved. (bundled_fmtlib_format.cpp).
• Problem: The three headers are installed by libspdlog-dev and the .cpp is distributed in the source package, so their named copyright holders must be represented in debian/copyright; the catch-all names only Gabi Melman and an unqualified collective. The changelog entry for this upload even claims to update upstream copyright, but no holder was added. bundled_fmtlib_format.cpp is additionally upstream's modified copy of fmt's format.cc, i.e. third-party code whose origin and licence (Expat/MIT) should be stated.
• Fix: List the holders, e.g. add Copyright: 2016 Alexander Dalshov (msvc_sink.h), 2019 ZVYAGIN.Alexander <ZVYAGIN.Alexander@gmail.com> (systemd_sink.h), mguludag (qt_sinks.h) and 2012-2016 Victor Zverovich with a note that src/bundled_fmtlib_format.cpp is a modified copy of fmt's format.cc under Expat, or split them into separate Files paragraphs with License: Expat.

important licensing 2. logos/jetbrains-variant-4.svg is a third-party JetBrains brand logo with no licence, attributed to Gabi Melman by Files: * ◂

• Files: logos/jetbrains-variant-4.svg, debian/copyright
• Basis: checked, in the package or with a reference tool
• Evidence: The SVG contains only drawing data (gradients and the JetBrains mark and lettering) and no copyright or licence notice; it is the same logo README.md:552 shows via https://resources.jetbrains.com/storage/products/company/brand/logos/jetbrains.svg. debian/copyright's only stanza puts the whole tree under Gabi Melman and spdlog contributors, License: Expat.
• Problem: This is not upstream's work but a corporate brand asset, and neither the file nor debian/copyright states any terms under which Debian may distribute or modify it (DFSG 1 and 3, Policy 2.1). Nothing in the package uses the local copy - the README embeds the remote URL - so the file is only a licensing liability.
• Fix: Either record JetBrains' permission in debian/copyright, or remove the file: add logos/jetbrains-variant-4.svg to Files-Excluded and repack the orig tarball (the +ds repack is already being done for the bundled fmt).

minor licensing 3. debian/copyright has no Files: debian/* stanza, so the packaging is attributed to Gabi Melman ◂

• Files: debian/copyright
• Basis: checked, in the package or with a reference tool
• Evidence: Files: * is the only stanza: Copyright: (c) 2014-2016 Gabi Melman <gmelman1@gmail.com> / (c) 2016-present Gabi Melman and spdlog contributors.
• Problem: debian/ is the Debian contributors' work (rules, control, the two patches, tests), not the upstream author's; the catch-all gives the wrong holder for it and leaves the packaging licence unstated.
• Fix: Add a Files: debian/* paragraph naming the Debian packagers (Aron Xu, Shengqi Chen and Michael R. Crusoe per debian/changelog) with their licence, after the Files: * stanza so that it overrides it.

minor packaging 4. debian/watch is in the old version 4 format ◂

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

• Full inventory of the tree outside .pc/ and debian/ (~160 files) built from glob and the directory listings; the only licence texts are LICENSE (MIT/Expat, Copyright (c) 2016 - present, Gabi Melman and spdlog contributors) and per-file Distributed under the MIT License headers. Greps for Copyright/(C)/SPDX/GNU/Apache/MPL/public domain/non-commercial found nothing else; no non-free term anywhere.
• Files-Excluded: include/spdlog/fmt/bundled is absent from both the unpacked tree and the +ds tarball, so the repack is consistent; include/spdlog/fmt/ holds only spdlog's own wrappers (fmt.h, chrono.h, ranges.h, ...), all Gabi Melman headers. CMakeLists.txt:364 also excludes the bundled directory from the install and rules:24 deletes it defensively.
• src/bundled_fmtlib_format.cpp is upstream's modified copy of fmt's format.cc; with SPDLOG_FMT_EXTERNAL (tweakme.h patched to #define SPDLOG_FMT_EXTERNAL 1, plus CMakeLists.txt:234 target_compile_definitions) it compiles to nothing and is not installed. Its Victor Zverovich copyright is reported above.
• include/spdlog/sinks/msvc_sink.h:1, systemd_sink.h:1 and qt_sinks.h:1 carry their own copyright lines (reported above); all three are installed in libspdlog-dev.
• CMakeLists.txt:1, bench/CMakeLists.txt:1, cmake/spdlogConfig.cmake.in:1 and example/CMakeLists.txt:1 read Copyright(c) 2019 spdlog authors, the project's own collective name for the same body of code as spdlog contributors in Files: *, so no separate holder is needed for them.
• logos/spdlog.png is the project's own logo; being an image I did not open it, and it carries no separate notice, so it falls under the project's Expat licence in LICENSE (unlike the JetBrains file reported above).
• No built artefacts, minified code, archives or PDFs in the tree; scripts/.sh, .github/workflows/.yml, appveyor.yml, .clang-format, .clang-tidy, .gitattributes, .gitignore are ordinary source text under the project LICENSE. The .github workflow uses GitHub secrets, no checked-in credentials.
• Packaging files read in full: debian/control, rules, changelog (head), source/format (3.0 quilt), libspdlog-dev.install/.docs/.examples, libspdlog1.17.install, patches/series and both patches, tests/control and tests/run-tests, salsa-ci.yml, upstream/metadata, plus the .dsc.
• Standards-Version 4.7.2 against Policy 4.7.4.1 (first two components match the current Policy, so not an issue); debhelper-compat (= 13) is still supported by the installed debhelper 14.5. Depends/Breaks/Replaces, Multi-Arch: same and the libdevel/libs sections are consistent, and the Maintainer alioth address is the one the archive shows for the current libspdlog-dev.
• SONAME coherence: CMakeLists.txt:200 sets SOVERSION to ${SPDLOG_VERSION_MAJOR}.${SPDLOG_VERSION_MINOR} = 1.17, matching the libspdlog1.17 package name and the usr/lib/*/libspdlog.so.* glob, and the ${spdlog:Provides} / dh_makeshlibs -V fmt-ABI scheme reproduces what libspdlog1.15 already ships (macOS archive shows Provides: libspdlog1.15-fmt11); libfmt-dev in unstable is 12.2.0 (libfmt12), so rules' fmtabi yields 12.
• The three find debian -name ... -delete lines in rules only drop mongo_sink.h, tcp_client-windows.h and udp_client-windows.h, none of which is included by another installed header (tcp_client.h and udp_client.h include the -windows variants only under _WIN32), so the installed header set stays self-consistent.
• Compression is consistent with the autopkgtest: /usr/bin/dh_compress prunes usr/share/doc/<pkg>/examples from compat 12 on, so examples/example.cpp stays intact for the test's cmake ../example; make, while files over 4k under usr/share/doc/libspdlog-dev/tests are gzipped, which run-tests' gunzip *.gz loop expects. cmake/utils.cmake (3.2 KB) is installed into the doc dir uncompressed for the same test.
• Both patches carry From/Author/Subject and Forwarded: not-needed; use-external-fmt changes the CMake default and tweakme.h consistently, autopkgtest.patch makes the installed example build against the installed package.
• uscan found the packaged version as the newest upstream release (upstream 1.17.0, packaged 1.17.0+ds).

Not confirmed ◂

• Whether spdlog 1.17.0 actually compiles against fmt 12.2.0 (the archive's libfmt-dev); not buildable here, and the package is not old enough to tell from the archive.
• debian/tests/run-tests configures the example with cmake's default Unix Makefiles generator and then runs make, while debian/tests/control lists only cmake, g++, ninja-build and not make; make is only a Recommends of cmake, so whether the debci testbed has it could not be checked here. The tests themselves are built with ninja, which is listed.