DFSG NEW Queue

DFSG, Licensing & New Packages Team

tdlib 1.8.66-1

Package Information

Descriptiontelegram database library - E2E module

TDLib is an open-source software library that implements Telegram's client APIs in a way you can embed into your own apps.

It is mainly used by developers to build Telegram bots and messaging clients. The library takes care of all networking, local storage, and data consistency details, you can focus exclusively on application logic. You run TDLib as a service in your program, send it "requests" (like send message, get chats, download files), and receive "updates" (like new messages, message status changes) through a consistent API.

This package provides only the E2E module with the minimal set of functions to organize end-to-end encrypted chats and calls.

MaintainerNicholas Guriev <guriev-ns@ya.ru>
Changed ByNicholas Guriev <guriev-ns@ya.ru>
Sponsormitya57@debian.org
Distributionunstable
Architectureany all
VCSgit: https://salsa.debian.org/mymedia/tdlib.git (browse)
Closes#1066960
Blocked Bugs#1066940 (wishlist)
Trackerhttps://tracker.debian.org/pkg/tdlib
Uploaded6 hours ago

New Package Report

.changes◂
Distributionunstable
DateSat, 29 Aug 2026 12:57:11 +0300
Sourcetdlib
Version1.8.66-1
Changed-ByNicholas Guriev <guriev-ns@ya.ru>
Architecturesource amd64 all
Changelog◂
tdlib (1.8.66-1) unstable; urgency=low
 .
   * Initial upload. (Closes: #1066960)
.dsc◂
Sectionlibs
Priorityoptional
Componentmain
Package-Listlibtde2e1 deb libs optional arch=any
libtdjson1 deb libs optional arch=any
tdlib-dev deb libdevel optional arch=any
tdlib-doc deb doc optional arch=all profile=!nodoc profile:v1=!nodoc
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/tdlib/td
Upstream-Name: TDLib
Upstream-Contact: Aliaksei Levin <levlam@telegram.org>, Arseny Smirnov <arseny30@gmail.com>

Files: *
License: BSL-1.0
Copyright: 2014-2026 Aliaksei Levin <levlam@telegram.org>
           2014-2026 Arseny Smirnov <arseny30@gmail.com>

Files: debian/*
License: BSL-1.0
Copyright: 2026 Nicholas Guriev <guriev-ns@ya.ru>

Files: example/web/tdweb/*
License: Expat
Copyright: Arseny Smirnov

Files: td/generate/tl-parser/*
License: GPL-2+
Copyright: 2012-2013 Vkontakte Ltd
           2012-2014 Vitaliy Valtman

Files: td/generate/tl-parser/crc32.c
       td/generate/tl-parser/crc32.h
License: LGPL-2+
Copyright: 2009-2012 Vkontakte Ltd
           2009-2012 Nikolai Durov
           2009-2012 Andrei Lopatin
                2012 Anton Maydell

Files: td/generate/tl-parser/portable_endian.h
License: Public-Domain
Copyright: Mathias Panzenböck

Files: td/generate/tl-parser/tl-parser-tree.h
License: LGPL-2.1+
Copyright: 2013-2014 Vitaly Valtman

Files: td/generate/tl-parser/tl-tl.h
License: GPL-2+ with OpenSSL exception
Copyright: 2012-2013 Vkontakte Ltd
           2012-2013 Vitaliy Valtman

License: BSL-1.0
 Permission is hereby granted, free of charge, to any person or organization
 obtaining a copy of the software and accompanying documentation covered by
 this license (the "Software") to use, reproduce, display, distribute, execute,
 and transmit the Software, and to prepare derivative works of the Software,
 and to permit third-parties to whom the Software is furnished to do so, all
 subject to the following:
 .
 The copyright notices in the Software and this entire statement, including the
 above license grant, this restriction and the following disclaimer, must be
 included in all copies of the Software, in whole or in part, and all
 derivative works of the Software, unless such copies or derivative works are
 solely in the form of machine-executable object code generated by a source
 language processor.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
 SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE FOR
 ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
 ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the " Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: GPL-2+
 tl-parser is free software: you can redistribute it and/or modify it under the
 terms of the GNU General Public License as published by the Free Software
 Foundation, either version 2 of the License, or (at your option) any later
 version.
 .
 tl-parser is distributed in the hope that it will be useful, but WITHOUT ANY
 WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 A PARTICULAR PURPOSE. See the GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License along with
 this tl-parser. If not, see <http://www.gnu.org/licenses/>. On Debian-based
 systems the complete text of the GNU General Public License version 2 can be
 found in file "/usr/share/common-licenses/GPL-2".

License: GPL-2+ with OpenSSL exception
 VK/KittenPHP-DB-Engine is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by the Free
 Software Foundation, either version 2 of the License, or (at your option) any
 later version.
 .
 VK/KittenPHP-DB-Engine is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
 details.
 .
 You should have received a copy of the GNU General Public License along with
 VK/KittenPHP-DB-Engine. If not, see <http://www.gnu.org/licenses/>. On
 Debian-based systems the complete text of the GNU General Public License
 version 2 can be found in file "/usr/share/common-licenses/GPL-2".
 .
 This program is released under the GPL with the additional exemption that
 compiling, linking, and/or using OpenSSL is allowed. You are free to remove
 this exemption from derived works.

License: LGPL-2+
 VK/KittenPHP-DB-Engine Library is free software: you can redistribute it
 and/or modify it under the terms of the GNU Lesser General Public License as
 published by the Free Software Foundation, either version 2 of the License, or
 (at your option) any later version.
 .
 VK/KittenPHP-DB-Engine Library is distributed in the hope that it will be
 useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser
 General Public License for more details.
 .
 You should have received a copy of the GNU Lesser General Public License along
 with VK/KittenPHP-DB-Engine Library. If not, see <http://www.gnu.org/licenses/>.
 On Debian-based systems the complete text of the GNU Library General Public
 License version 2 can be found in file "/usr/share/common-licenses/LGPL-2".

License: LGPL-2.1+
 This library is free software; you can redistribute it and/or modify it under
 the terms of the GNU Lesser General Public License as published by the Free
 Software Foundation; either version 2.1 of the License, or (at your option)
 any later version.
 .
 This library is distributed in the hope that it will be useful, but WITHOUT
 ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
 details.
 .
 You should have received a copy of the GNU Lesser General Public License along
 with this library; if not, write to the Free Software Foundation, Inc.,
 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. On Debian-based
 systems the complete text of the GNU Lesser General Public License version 2.1
 can be found in file "/usr/share/common-licenses/LGPL-2.1".

License: Public-Domain
 I, Mathias Panzenböck, place this file hereby into the public domain. Use it
 at your own risk for whatever you like.  In case there are jurisdictions that
 don't support putting things in the public domain you can also consider it to
 be "dual licensed" under the BSD, MIT and Apache licenses, if you want to.
 This code is trivial anyway. Consider it an example on how to get the endian
 conversion functions on different platforms.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 6 hours ago.

Report◂

DFSG NEW review for tdlib version 1.8.66-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 1 blocker, 0 important, 2 minor
  • debian/watch: absent
  • debian/copyright: machine-readable
  • Scan before the review: 1 found

Licensing

The licensing is DFSG-compliant: the bulk of the tree is Boost Software License 1.0, example/web/tdweb is Expat/MIT, and the GPL-2+/LGPL-2+/LGPL-2.1+ and public-domain files in td/generate/tl-parser are correctly identified, free, and used only to build the code generator, never linked into the shipped libraries. debian/copyright is DEP-5 and mostly accurate, but it is not complete: the Files: * catch-all attributes the files created by the Debian patch series to the upstream authors, one of which carries an explicit Copyright Nicholas Guriev <nicholas@guriev.su> 2026 notice, and example/uwp/Telegram.Td.UWP.nuspec names Telegram FZ-LLC as holder, which is not listed either.

Packaging

Good quality throughout: compat 14 with dpkg-build-api 1 and correct use of $(DH_OVERRIDDEN_COMMAND), Build-Depends/-Arch/-Indep split to match what each step runs (gawk for the arch-only pkg-config rewriting, doxygen and php-cli only for the doc build), system SQLCipher via patch 0001, symbols files for both libraries with Build-Depends-Package, Multi-Arch: same, patches with DEP-3 headers, Standards-Version 4.7.4 against Policy 4.7.4.1, and a doc package whose doc-base path agrees with where dh_installdocs puts the HTML given X-Doc-Main-Package. No packaging defect worth reporting; the only missing things are optional (no debian/tests, no man pages), and the upstream tests do run at build time.

Issues

blocker licensing 1. debian/copyright's Files: * gives the files added by the Debian patches upstream copyright and omits Nicholas Guriev, whose notice is in tde2e/test/e2e_api.cpp ◂
  • Files: debian/copyright:8-10, tde2e/test/e2e_api.cpp:2-3, tde2e/tde2e.expmap, tde2eConfig.cmake, sqlite/redir2sys/sqlite/sqlite3.h, tdjson_linux.expmap, tdjson_mac.expmap
  • Basis: checked, in the package or with a reference tool
  • Evidence: Files: * / Copyright: 2014-2026 Aliaksei Levin <levlam@telegram.org> / 2014-2026 Arseny Smirnov <arseny30@gmail.com> (debian/copyright); // Copyright Aliaksei Levin <levlam@telegram.org>, Arseny Smirnov <arseny30@gmail.com> 2014-2026 / // Copyright Nicholas Guriev <nicholas@guriev.su> 2026 (tde2e/test/e2e_api.cpp:2-3); patch 0003 lists create mode 100644 tde2e/test/e2e_api.cpp, tde2e/tde2e.expmap, tde2eConfig.cmake, patch 0001 create mode 100644 sqlite/redir2sys/sqlite/sqlite3.h, patch 0005 tdjson_linux.expmap and tdjson_mac.expmap.
  • Problem: Every path in the tree is claimed by the Files: * stanza unless a later stanza matches it, and Files: debian/* matches only the packaging directory. None of the seven paths above is matched by any later stanza, so debian/copyright declares them to be the upstream authors' BSL-1.0 code, although they were written by the Debian maintainer: tde2e/test/e2e_api.cpp carries his notice on line 3, and the other six are new files created by patches 0001, 0003 and 0005 and carry no notice at all. A copyright file that misstates the authorship of files in the source is inaccurate, and for a new package that is what an ftp-master or NEW review rejects.
  • Fix: Add a stanza before Files: * (or at the end of the file) such as Files: tde2e/test/e2e_api.cpp tde2e/tde2e.expmap tde2eConfig.cmake sqlite/redir2sys/sqlite/sqlite3.h tdjson_linux.expmap tdjson_mac.expmap with Copyright: 2026 Nicholas Guriev <nicholas@guriev.su> and License: BSL-1.0; keep the upstream holder for tde2e/test/e2e_api.cpp as a second Copyright line since that file also retains the upstream notice.
minor licensing 2. debian/copyright does not name Telegram FZ-LLC, declared as the copyright holder in example/uwp/Telegram.Td.UWP.nuspec ◂
  • Files: example/uwp/Telegram.Td.UWP.nuspec:14, debian/copyright:8-10
  • Basis: checked, in the package or with a reference tool
  • Evidence: <copyright>© Telegram FZ-LLC. All rights reserved.</copyright> in example/uwp/Telegram.Td.UWP.nuspec, whose <license type="file">LICENSE_1_0.txt</license> is the BSL-1.0 copy next to it; debian/copyright names only Aliaksei Levin and Arseny Smirnov for Files: *, which covers example/uwp/.
  • Problem: A copyright holder stated in a file in the tree is not represented in debian/copyright, so the copyright information is incomplete for example/uwp. The line is NuGet packaging metadata, not a licence grant: the same nuspec declares the BSL-1.0 licence file, so "All rights reserved" is boilerplate and creates no DFSG or licence-compatibility problem, which is why this is small rather than a blocker.
  • Fix: Give example/uwp/* its own stanza (Files: example/uwp/*; Copyright: 2026 Telegram FZ-LLC, plus the upstream authors if desired; License: BSL-1.0) so that the holder is recorded.
minor packaging 3. There is no debian/watch ◂
  • Files: debian/watch
  • Basis: found by the review tooling's own checks
  • Problem: Without a watch file new upstream releases are not noticed by uscan, the tracker or the maintainer's tools.
  • Fix: Add a debian/watch in version 5 format, or, if upstream has no usable release channel, one holding a comment that says so.
Verified ◂
  • Read debian/copyright in full: it is DEP-5 with the exact 1.0 Format URL, Files: *, Files: debian/*, and stanzas for example/web/tdweb/* (Expat), td/generate/tl-parser/* (GPL-2+), crc32.c/h (LGPL-2+), portable_endian.h (public domain), tl-parser-tree.h (LGPL-2.1+) and tl-tl.h (GPL-2+ with OpenSSL exception); every short name used has a stand-alone License paragraph, and the GPL/LGPL ones point at /usr/share/common-licenses.
  • Grepped the whole tree (all directories except .pc/) for Copyright, (C), ©, SPDX-License-Identifier, GNU GPL/LGPL, Apache/MPL, 'public domain', 'All rights reserved', 'Permission is hereby granted', 'Licensed under' and non-commercial wording. Outside debian/, the only hits are the BSL headers of the upstream .cpp/.h files, the two BSL LICENSE_1_0.txt copies (root and example/uwp), the GPL text in td/generate/tl-parser/LICENSE, the tl-parser file headers, the 'license': 'MIT' field of example/web/tdweb/package.json and package-lock.json, and identifiers such as reportReasonCopyright; no file has a licence notice that debian/copyright fails to match.
  • Checked the tl-parser headers against their stanzas: tl-parser.c, tl-parser.h and tlc.c are GPL-2+ by Vitaly Valtman 2014 and Vkontakte Ltd 2012-2013; tl-tl.h carries the OpenSSL exemption quoted in the copyright file; crc32.c/h are LGPL-2+ by Vkontakte, Nikolai Durov, Andrei Lopatin and Anton Maydell; tl-parser-tree.h is LGPL-2.1+; portable_endian.h is Mathias Panzenböck's public-domain file with the BSD/MIT/Apache fallback. All free, and correctly labelled.
  • The GPL/LGPL tl-parser is a build-time code generator (td/generate/tl-parser is built and run to produce td/generate/auto), not part of libtdjson1 or libtde2e1, which contain only BSL-1.0 code; so no incompatible licences are combined in either binary and the GPL-2+/OpenSSL-exception files impose no obligation on the shipped libraries.
  • The one binary the scan lists, example/uwp/app/TdApp_TemporaryKey.pfx, is the PKCS#12 temporary signing key of the Windows UWP sample app (the manifest's Publisher is CN=arseny30); it is upstream example data for a platform neither built nor installed by this source package, it is not produced by the build, and it is covered by the Files: * BSL-1.0 stanza. The PNGs under example/uwp/app/Assets/ are the sample app's logos and splash screens.
  • example/web/tdweb/src/*.js carry no notices but package.json declares "author": "Arseny Smirnov" and "license": "MIT", which is the Expat stanza; package-lock.json is npm lock data derived from package.json, not vendored third-party code.
  • No generated-code-without-generator problem: td/generate/auto, tdutils/generate/auto and the Doxygen output docs/ are produced during the build from the sources present (td/generate/scheme/*.tl, generator in td/generate/, Doxyfile with INPUT pointing at the generated headers) and removed again by execute_after_dh_auto_clean; build.html is a hand-written standalone HTML build guide that is not installed.
  • The repacked upstream tarball omits exactly the paths filtered by debian/gbp.conf (.gitattributes, CMake/GetGitRevisionDescription.cmake and .in, sqlite/sqlite/*, td/generate/tl-parser/wgetopt.[ch]); the build copes because patch 0002 makes the Git revision optional, tl-parser.h includes wgetopt.h only under _WIN32, and rules passes -DTDSQLITE_USE_BUNDLED=OFF so the bundled SQLite is not needed; nothing has been left in the tree that debian/copyright would have to exclude.
  • Packaging: debian/control (Build-Depends, Build-Depends-Arch: gawk for debian/choose-last.awk, Build-Depends-Indep: doxygen and php-cli under <!nodoc>), rules (compat 14 + dpkg-build-api 1, $(DH_OVERRIDDEN_COMMAND) confirmed in dh(1) as available since debhelper 13.25, hardening=+bindnow, symbols check level 2), all 13 patches with From/Date/Subject and descriptive bodies, both .symbols files with Build-Depends-Package, the .install and not-installed files, Multi-Arch: same, the .docs/doc-base pair, gbp.conf, salsa-ci.yaml, source/format and upstream/metadata were read; the doc-base Files: /usr/share/doc/tdlib-dev/html is right because dh_installdocs installs a -doc package's docs under the X-Doc-Main-Package directory inside that package (checked in /usr/bin/dh_installdocs), and not-installed's usr/lib/*/pkgconfig does cover the upstream .pc files it matched (dh_missing treats a matched directory as covering its contents).
  • dpkg-build-api (= 1) is provided by dpkg-dev (= 1) in the archive; libsqlcipher-dev 4.19.0-1 (>= the 4.5.1 that patch 0013's PRAGMA cipher_log_level needs) and gperf are available; the four binary names are new packages from this source. Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 (same first two components).
  • There is no debian/tests, but the upstream test suite runs during the build through dh_auto_test, with TD_TEST_FORBID_NETWORK=YES exported and patch 0012 making the network tests return early, so the build does not depend on network access.
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2, LGPL-2, LGPL-2.1).
Not confirmed ◂
  • The package was not built: whether the two .symbols files list exactly the exported symbols is unverified.
  • The contents of example/uwp/app/TdApp_TemporaryKey.pfx cannot be inspected with the allowed tools (binary), so nothing beyond its role as the sample app's temporary signing key is confirmed.
  • debian/upstream/commit (a9966eb3704a3351568c28013fed67d797c17828) could not be compared with the upstream repository.
Proposed changes ◂

None.

Uploader's response to the LLM review

The machine-readable d/copyright format does not clearly specify whether Files stanzas match the source with applied patches or not. I wrote the d/copyright file on assumption that the Files patterns match the unpacked source with non-applied patches as you receive after git clone of my packaging repository or with the --skip-patches flag of dpkg-source(1). The examples in the d/copyright specification (§ 5.2.1) give clues that documenting license on the d/patches folder is enough. It is impractical to list files added via patches in d/copyright as their copyright information is already provided by the debian/* pattern.

Two other minor issues have been already fixed in the Git repository on Salsa (commit 0df418462), and the fixes will surely be in the next revision. They can be included into the initial upload if the DFSG team decides so.

— Nicholas Guriev (mymedia), 3 hours ago

Back to Dashboard | View all reviews for this package