thrift 0.25.0-1
Package Information
| Description | Thrift C++ library Thrift is a software framework for the development of reliable and performant communication and data serialization. It combines a software stack with code generation to build services that operate seamlessly across a number of different development languages. This package contains the runtime libraries needed for C++ applications using Thrift. |
|---|---|
| Maintainer | Laszlo Boszormenyi (GCS) <gcs@debian.org> |
| Changed By | Laszlo Boszormenyi (GCS) <gcs@debian.org> |
| Sponsor | gcs@debian.org |
| Distribution | experimental |
| Architecture | any all |
| Closes | #1150191 |
| Popcon Installs | 4411 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/thrift |
| Uploaded | 4 days ago |
New Package Report
.changes
| Changed-By | Laszlo Boszormenyi (GCS) <gcs@debian.org> |
|---|---|
| Architecture | source all amd64 |
| Distribution | experimental |
| Date | Thu, 05 Nov 2026 18:54:02 +0100 |
| Source | thrift |
| Version | 0.25.0-1 |
Changelog
thrift (0.25.0-1) experimental; urgency=medium
.
* New major upstream release (closes: #1150191):
- fixes CVE-2026-61373: allocation of resources without limits or
throttling vulnerability in the Java TSaslNonblockingServer,
- fixes CVE-2026-61374: allocation of resources without limits or
throttling vulnerability in the Java bindings,
- fixes CVE-2026-63772: allocation of resources without limits or
throttling vulnerability in the Go bindings,
- fixes CVE-2026-66054: allocation of resources without limits or
throttling, improper handling of highly compressed data vulnerability
in the C++ bindings,
- fixes CVE-2026-66055: allocation of resources without limits or
throttling in multiple language bindings,
- fixes CVE-2026-66081: access of uninitialized pointer vulnerability
in the c_glib bindings,
- fixes CVE-2026-66837: stack-based buffer overflow, integer overflow
or wraparound vulnerability in the PHP bindings,
- fixes CVE-2026-66858: the protocol skip routine in several language
bindings did not apply the binding's recursion limit,
- fixes CVE-2026-66859: NULL pointer dereference and use of
uninitialized variable vulnerability in the c_glib bindings,
- fixes CVE-2026-82458: memory allocation with excessive size value,
allocation of resources without limits or throttling vulnerability
in several language bindings,
- fixes CVE-2026-82459: integer underflow, out of bounds write
vulnerability in the C++ 32 bit THeaderTransport,
- fixes CVE-2026-83632: allocation of resources without limits or
throttling, integer overflow or wraparound, heap based buffer
overflow vulnerability,
- fixes CVE-2026-83663: uncontrolled recursion vulnerability in the
Go bindings,
- fixes CVE-2026-85086: improper certificate validation, initialization
of a resource with an insecure default vulnerability in the Perl
bindings,
- fixes CVE-2026-85087: improper certificate validation, return of
wrong status code vulnerability in the Python bindings,
- fixes CVE-2026-85088: improper validation of certificate with
host mismatch in the C++ and D libraries,
- fixes CVE-2026-85476: loop with unreachable exit condition, 'infinite
loop' vulnerability in the c_glib bindings,
- fixes CVE-2026-85483: use of uninitialized resource, return of
wrong status code vulnerability in the c_glib bindings,
- fixes CVE-2026-85494: improper handling of length parameter
inconsistency in multiple language bindings,
- fixes CVE-2026-91135: heap based buffer overflow vulnerability in
the C++ THeaderTransport,
- fixes CVE-2026-91137: improper validation of specified quantity in
input, allocation of resources without limits or throttling in the
PHP language bindings,
- fixes CVE-2026-92834: use of uninitialized resource, return of wrong
status code vulnerability in the C++ WebSocket server,
- fixes CVE-2026-93925: stack based buffer overflow, incorrect bitwise
shift of integer vulnerability in the C++ THeaderProtocol,
- fixes CVE-2026-93926: missing release of memory after effective
lifetime, missing release of resource after effective lifetime
vulnerability in THeaderTransport,
- fixes CVE-2026-94634: allocation of resources without limits or
throttling, initialization of a resource with an insecure default
vulnerability in the Python bindings,
- fixes CVE-2026-94636: improper handling of highly compressed data in
the Python bindings,
- fixes CVE-2026-94637: improper handling of highly compressed data in
the Go bindings,
- fixes CVE-2026-94638: allocation of resources without limits or
throttling vulnerability in the PHP bindings,
- fixes CVE-2026-94639: improper handling of exceptional conditions,
allocation of resources without limits or throttling, uncaught
exception vulnerability in the Java bindings,
- fixes CVE-2026-94642: uncaught exception vulnerability in the
PHP bindings,
- fixes CVE-2026-94644: allocation of resources without limits or
throttling vulnerability in the PHP bindings,
- fixes CVE-2026-94650: uncontrolled recursion vulnerability in the
c_glib bindings,
- fixes CVE-2026-94651: improper handling of exceptional conditions,
missing release of resource after effective lifetime vulnerability
in the java bindings,
- fixes CVE-2026-94652: missing release of memory after effective
lifetime vulnerability in the C++ bindings,
- fixes CVE-2026-94653: inefficient algorithmic complexity
vulnerability in the PHP bindings,
- fixes CVE-2026-94654: loop with unreachable exit condition, 'infinite
loop' vulnerability in the Python bindings,
- fixes CVE-2026-96286: uncaught exception vulnerability in the
Perl bindings,
- fixes CVE-2026-96287:inefficient algorithmic complexity vulnerability
in the Perl bindings,
- fixes CVE-2026-96289: uncontrolled recursion vulnerability in the
PHP bindings.
* Update patches.
* Rename related packages to -0.25.0 suffix.
* Update -dev packages dependencies.
* Add autopkgtest for php-thrift.
* Update copyright file..dsc
| Package-List | golang-thrift-dev deb devel optional arch=all libthrift-0.25.0 deb libs optional arch=any libthrift-c-glib-dev deb libdevel optional arch=any libthrift-c-glib0t64 deb libs optional arch=any libthrift-dev deb libdevel optional arch=any libthrift-perl deb perl optional arch=all php-thrift deb php optional arch=any python3-thrift deb python optional arch=any thrift-compiler deb devel optional arch=any |
|---|---|
| Section | devel |
| Priority | optional |
| Component | main |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: thrift
Source: https://www.apache.org/dist/thrift
Files: *
Copyright: Copyright 2006- Apache Software Foundation
License: Apache-2.0
Files: aclocal/ax_boost_base.m4 aclocal/ax_check_openssl.m4 aclocal/ax_compare_version.m4 aclocal/ax_cxx_compile_stdcxx_11.m4 aclocal/ax_cxx_compile_stdcxx.m4 aclocal/ax_dmd.m4 aclocal/ax_javac_and_java.m4 aclocal/ax_lib_event.m4 aclocal/ax_lib_zlib.m4 aclocal/ax_prog_dotnetcore_version.m4 aclocal/ax_prog_haxe_version.m4 aclocal/ax_prog_perl_modules.m4 aclocal/ax_signed_right_shift.m4 aclocal/ax_thrift_internal.m4 contrib/fb303/acinclude.m4 contrib/fb303/aclocal/ax_boost_base.m4 contrib/fb303/aclocal/ax_cxx_compile_stdcxx_11.m4 contrib/fb303/aclocal/ax_javac_and_java.m4 contrib/fb303/aclocal/ax_thrift_internal.m4
Copyright: 2008 Benjamin Kosnik <bkoz@redhat.com>,
2008 Tim Toolan <toolan@ele.uri.edu>,
2008 Thomas Porschberg <thomas@randspringer.de>,
2009 David Reiss,
2009 Dean Povey <povey@wedgetail.com>,
2009 Facebook,
2009 Peter Adolphs,
2009,2010 Zmanda Inc. <http://www.zmanda.com/>,
2009,2010 Dustin J. Mitchell <dustin@zmanda.com>,
2009,2010 Zmanda Inc. <http://www.zmanda.com/>,
2011 David Nadlinger,
2012 Zack Weinberg <zackw@panix.com>,
2013 Roy Stogner <roystgnr@ices.utexas.edu>,
2014, 2015 Google Inc.; contributed by Alexey Sokolov <sokolov@google.com>,
2015 Jens Geyer <jensg@apache.org>,
2015 Moritz Klammler <moritz@klammler.eu>,
2015 Paul Norman <penorman@mac.com>,
2016, 2018 Krzesimir Nowak <qdlacz@gmail.com>
License: FSFAP
Copying and distribution of this file, with or without modification, are
permitted in any medium without royalty provided the copyright notice
and this notice are preserved. This file is offered as-is, without any
warranty.
Files: aclocal/ax_lua.m4
Copyright: 2014 Tim Perkins <tprk77@gmail.com>,
2015 Reuben Thomas <rrt@sc3d.org>
License: GPL3+-with-Autoconf-Macros-exception
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or (at
your option) any later version.
.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
.
You should have received a copy of the GNU General Public License version 3
along with this program; if not, see <https://www.gnu.org/licenses/>.
.
As a special exception, the respective Autoconf Macro's copyright
owner gives unlimited permission to copy, distribute and modify the
configure scripts that are the output of Autoconf when processing the
Macro. You need not follow the terms of the GNU General Public License
when using or distributing such scripts, even though portions of the
text of the Macro appear in them. The GNU General Public License (GPL)
does govern all other use of the material that constitutes the
Autoconf Macro.
.
This special exception to the GPL applies to versions of the Autoconf
Macro released by the GNU Autoconf Macro Archive. When you make and
distribute a modified version of the Autoconf Macro, you may extend
this special exception to the GPL to apply to your modified version as
well.
.
On Debian systems, the full text of the GNU General Public License version 3
can be found in the file `/usr/share/common-licenses/GPL-3'.
Files: aclocal/lt~obsolete.m4 aclocal/ltoptions.m4 aclocal/ltsugar.m4 aclocal/ltversion.m4 aclocal/tar.m4
Copyright: 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, Inc.
License: FSFULLR
This file is free software; the Free Software Foundation gives
unlimited permission to copy and/or distribute it, with or without
modifications, as long as this notice is preserved.
.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY, to the extent permitted by law; without even
the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Files: aclocal.m4 aclocal/libtool.m4
Copyright: 1996-2001, 2003-2015 Free Software Foundation, Inc.,
2004 Scott James Remnant <scott@netsplit.com>,
2012-2015 Dan Nicholson <dbn.lists@gmail.com>
License: FSFULLR and/or GPL-2+ with Libtool exception
GNU Libtool is free software; you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by the Free
Software Foundation; either version 2 of the License, or (at your option)
any later version.
.
As a special exception to the GNU General Public License, if you
distribute this file as part of a program or library that is built
using GNU Libtool, you may include this file under the same
distribution terms that you use for the rest of that program.
.
GNU Libtool is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License version 2
along with this program. If not, see <http://www.gnu.org/licenses/>.
Files: compile depcomp missing ylwrap
Copyright: 1992-2026 Free Software Foundation, Inc.
License: GPL2+-with-Autoconf-Macros-exception
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License as
published by the Free Software Foundation; either version 2 of the
License, or (at your option) any later version.
.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
.
You should have received a copy of the GNU General Public License version 2
along with this program.
.
As a special exception, the respective Autoconf Macro's copyright
owner gives unlimited permission to copy, distribute and modify the
configure scripts that are the output of Autoconf when processing
the Macro. You need not follow the terms of the GNU General Public
License when using or distributing such scripts, even though
portions of the text of the Macro appear in them. The GNU General
Public License (GPL) does govern all other use of the material that
constitutes the Autoconf Macro.
.
This special exception to the GPL applies to versions of the
Autoconf Macro released by the Autoconf Macro Archive. When you
make and distribute a modified version of the Autoconf Macro, you
may extend this special exception to the GPL to apply to your
modified version as well.
.
On Debian systems, the full text of the GNU General Public License version 2
can be found in the file `/usr/share/common-licenses/GPL-2'.
Files: config.guess config.sub
Copyright: 1992-2024 Free Software Foundation, Inc.
License: GPL3+-with-Autoconf-Macros-exception
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or (at
your option) any later version.
.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
.
You should have received a copy of the GNU General Public License version 3
along with this program; if not, see <https://www.gnu.org/licenses/>.
.
As a special exception, the respective Autoconf Macro's copyright
owner gives unlimited permission to copy, distribute and modify the
configure scripts that are the output of Autoconf when processing the
Macro. You need not follow the terms of the GNU General Public License
when using or distributing such scripts, even though portions of the
text of the Macro appear in them. The GNU General Public License (GPL)
does govern all other use of the material that constitutes the
Autoconf Macro.
.
This special exception to the GPL applies to versions of the Autoconf
Macro released by the GNU Autoconf Macro Archive. When you make and
distribute a modified version of the Autoconf Macro, you may extend
this special exception to the GPL to apply to your modified version as
well.
.
On Debian systems, the full text of the GNU General Public License version 3
can be found in the file `/usr/share/common-licenses/GPL-3'.
Files: configure
Copyright: 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, Inc.
License: FSFUL
This configure script is free software; the Free Software Foundation
gives unlimited permission to copy, distribute and modify it.
Files: install-sh
Copyright: 1994 X Consortium
License: X11
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE X
CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
.
Except as contained in this notice, the name of the X Consortium shall not be
used in advertising or otherwise to promote the sale, use or other dealings in
this Software without prior written authorization from the X Consortium.
Files: ltmain.sh
Copyright: 1996-2015 Free Software Foundation, Inc.
License: GPL-2+ with Libtool exception
GNU Libtool is free software; you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by the Free
Software Foundation; either version 2 of the License, or (at your option)
any later version.
.
As a special exception to the GNU General Public License, if you
distribute this file as part of a program or library that is built
using GNU Libtool, you may include this file under the same
distribution terms that you use for the rest of that program.
.
GNU Libtool is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License version 2
along with this program. If not, see <http://www.gnu.org/licenses/>.
Files: compiler/cpp/src/thrift/generate/sha256.h
Copyright: 2012 Brad Conte <brad@bradconte.com>
License: public-domain
Files: compiler/cpp/tests/catch/catch.hpp
Copyright: 2012 Two Blue Cubes Ltd.
License: BSL-1.0
Boost Software License - Version 1.0 - August 17th, 2003
.
Permission is hereby granted, free of charge, to any person or organization
obtaining a copy of the software and accompanying documentation covered by
this license (the "Software") to use, reproduce, display, distribute,
execute, and transmit the Software, and to prepare derivative works of the
Software, and to permit third-parties to whom the Software is furnished to
do so, all subject to the following:
.
The copyright notices in the Software and this entire statement, including
the above license grant, this restriction and the following disclaimer,
must be included in all copies of the Software, in whole or in part, and
all derivative works of the Software, unless such copies or derivative
works are solely in the form of machine-executable object code generated by
a source language processor.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
Files: build/cmake/FindGLIB.cmake
Copyright: Copyright (C) 2012 Raphael Kubo da Costa <rakuco@webkit.org>
License: BSD-2-Clause
All rights reserved.
.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
.
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Files: compiler/cpp/src/thrift/generate/t_cl_generator.cc
Copyright: 2006- Facebook,
2006- Apache Software Foundation,
2008- Patrick Collison <patrick@collison.ie>
License: Apache-2.0
Files: compiler/cpp/src/thrift/generate/t_html_generator.h
Copyright: 2012 Twitter, Inc.
License: Apache-2.0
Files: compiler/cpp/src/thrift/thrifty.cc compiler/cpp/src/thrift/thrifty.hh
Copyright: Copyright (C) 1984, 1989-1990, 2000-2015, 2018-2021 Free Software Foundation, Inc.
License: GPL-3+ with Bison-2.2 exception
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License version 3
along with this program. If not, see <https://www.gnu.org/licenses/>.
.
As a special exception, you may create a larger work that contains
part or all of the Bison parser skeleton and distribute that work
under terms of your choice, so long as that work isn't itself a
parser generator using the skeleton or a modified version thereof
as a parser skeleton. Alternatively, if you modify or redistribute
the parser skeleton itself, you may (at your option) remove this
special exception, which will cause the skeleton and the resulting
Bison output files to be licensed under the GNU General Public
License without this special exception.
Files: lib/cpp/src/thrift/windows/SocketPair.cpp
Copyright: 2007 Nathan C. Myers <ncm@cantrip.org>
License: socketpair and Apache-2.0
Files: lib/nodejs/lib/thrift/json_parse.js
Copyright: 2015 Douglas Crockford <douglas@crockford.com>
License: public-domain
Files: lib/php/src/ext/thrift_protocol/config.m4
Copyright: 2009 Facebook
License: Apache-2.0 or FSFAP
Files: lib/py/compat/win32/stdint.h
Copyright: 2006-2008 Alexander Chemeris
License: BSD-3-Clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
.
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
.
* Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
.
* Neither the name of Kitware, Inc. nor the names of Contributors
may be used to endorse or promote products derived from this
software without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Files: debian/*
Copyright: Copyright 2012-2014 Eric Evans <eevans@debian.org>,
Copyright 2014- Laszlo Boszormenyi (GCS) <gcs@debian.org>
License: GPL-2+
License: GPL-2+
This program is free software; you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by the Free
Software Foundation; either version 2 of the License, or (at your option)
any later version.
.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
for more details.
.
You should have received a copy of the GNU General Public License version 2
along with this program. If not, see <https://www.gnu.org/licenses/>.
.
On Debian systems, the full text of the GNU General Public License version 2
can be found in the file `/usr/share/common-licenses/GPL-2'.
License: GPL-3+
This program is free software: you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option)
any later version.
.
This package is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License version 3
along with this program. If not, see <https://www.gnu.org/licenses/>.
.
On Debian systems, the full text of the GNU General Public License
version 3 can be found in the file `/usr/share/common-licenses/GPL-3'.
License: Apache-2.0
Licensed to the Apache Software Foundation (ASF) under one or more contributor
license agreements. The ASF licenses this work to You under the Apache License,
Version 2.0 (the "License"); you may not use this work except in compliance
with the License. You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
On Debian systems, the complete text of the Apache License Version 2.0
can be found in the file '/usr/share/common-licenses/Apache-2.0'.
License: FSFAP
Copying and distribution of this file, with or without modification, are
permitted in any medium without royalty provided the copyright notice
and this notice are preserved. This file is offered as-is, without any
warranty.
License: public-domain
These files were granted to the public domain.
.
No copyright is claimed. This code is in the public domain; do with
it what you wish.
License: socketpair
This code is Free Software. It may be copied freely, in original or
modified form, subject only to the restrictions that (1) the author is
relieved from all responsibilities for any use for any purpose, and (2)
this copyright notice must be retained, unchanged, in its entirety. If
for any reason the author might be held responsible for any consequences
of copying or use, license is withheld.
DFSG Assistant LLM REVIEW 0 blocker, 3 important, 3 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 4 days ago.
Report
DFSG NEW review for thrift version 0.25.0-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: No
- Issues: 0 blocker, 3 important, 3 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 12 found
Licensing
All code in the tree is under free, mutually compatible licences (Apache-2.0 with permissive FSF/BSD/MIT/BSL/X11/public-domain build scripts and components), so there is no DFSG problem. debian/copyright is machine-readable and covers the third-party components, but it is not fully accurate: the lib/py/compat/win32/stdint.h stanza reproduces a BSD-3-Clause text naming Kitware, Inc., which appears in neither the file nor LICENSE, and which turns a permission in the file into an endorsement restriction; the automake-generated */Makefile.in and */Makefile files (FSF copyright, FSFULLR) are not covered by any stanza and so fall under Files: * (ASF, Apache-2.0); and the compile/depcomp/missing/ylwrap and config.guess/config.sub stanzas quote the wrong Autoconf exception.
Packaging
Build mechanics check out at compat 13 (install globs, ${DEB_HOST_MULTIARCH} substitution, the hand-written shlibs entries match the real soname libthrift-0.25.0.so as dpkg-shlibdeps splits it, bootstrap.sh's autotools needs are satisfied through debhelper -> dh-autoreconf, and /etc/php/8.5/mods-available matches the php8.5 in the archive). Two binary packages are nevertheless missing runtime dependencies their own files need: libthrift-dev headers include <boost/...> and <event.h> without depending on libboost-dev or libevent-dev, and libthrift-perl loads Bit::Vector and IO::Socket::SSL/LWP/IO::String without depending on their packages. The one autopkgtest asserts nothing.
Issues
important licensing 1. debian/copyright quotes a BSD-3-Clause text naming Kitware, Inc. for lib/py/compat/win32/stdint.h, not the licence text in the file ◂
- Files:
debian/copyright:328-356,lib/py/compat/win32/stdint.h:15-17 - Basis: checked, in the package or with a reference tool
- Evidence: debian/copyright:
* Neither the name of Kitware, Inc. nor the names of Contributors may be used to endorse or promote products derived from this software without specific prior written permission.-- lib/py/compat/win32/stdint.h (and the copy in LICENSE):3. The name of the author may be used to endorse or promote products derived from this software without specific prior written permission. - Problem: The stanza documents a restriction that the file does not contain, and names a third party (Kitware, Inc.) that has nothing to do with this file. The file's third clause is a permission, not a non-endorsement condition, so the two real conditions are those of BSD-2-Clause. copyright-format 1.0 (Policy, copyright-format section 6.7) requires the License field to carry the licence that actually applies, so the copyright file misdescribes this file.
- Fix: Replace the quoted text with the file's own notice (its two conditions are BSD-2-Clause) and use the matching short name, or at least quote clause 3 verbatim instead of the Kitware text.
important packaging 2. libthrift-dev lacks Depends on libboost-dev and libevent-dev although its installed headers include <boost/...> and <event.h>/<event2/...> ◂
- Files:
debian/control:47,lib/cpp/src/thrift/TUuid.h:26,lib/cpp/src/thrift/processor/TMultiplexedProcessor.h:26,lib/cpp/src/thrift/server/TNonblockingServer.h:44-46,debian/libthrift-dev.install:1-6 - Basis: checked, in the package or with a reference tool
- Evidence: debian/control:
Depends: libthrift-0.25.0 (= ${binary:Version}), ${misc:Depends}, libssl-dev, zlib1g-dev, pkgconf; installed headers:#include <boost/uuid/uuid.hpp>,#include <boost/tokenizer.hpp>,#include <event.h>,#include <event2/event_compat.h>. - Problem: Policy 8.4: installing a development package must give everything needed to compile against the library. libthrift-dev installs /usr/include/thrift/TUuid.h, processor/TMultiplexedProcessor.h and server/TNonblockingServer.h, so a program using them fails to compile unless libboost-dev and libevent-dev happen to be installed for other reasons. The build does not catch this because both are Build-Depends.
- Fix: Add
libboost-devandlibevent-devto libthrift-dev's Depends (they can be dropped again only if those headers stop being installed).
important packaging 3. libthrift-perl does not depend on the Perl modules its shipped code loads: Bit::Vector, IO::Socket::SSL, LWP::UserAgent, IO::String ◂
- Files:
debian/control:132,lib/perl/lib/Thrift/BinaryProtocol.pm:24,lib/perl/lib/Thrift/SSLSocket.pm:27,lib/perl/lib/Thrift/HttpClient.pm:24-27 - Basis: checked, in the package or with a reference tool
- Evidence: debian/control:
Depends: ${perl:Depends}, ${misc:Depends}; files:use Bit::Vector;,use IO::Socket::SSL;,use HTTP::Request; use IO::String; use LWP::UserAgent; - Problem: Thrift::BinaryProtocol compiles
use Bit::Vectorwhen it is loaded, and Thrift::Server loads Thrift::BinaryProtocol, so every generated Perl client and server dies with "Can't locate Bit/Vector.pm" on a system with only libthrift-perl installed. The SSL and HTTP transports fail the same way for libio-socket-ssl-perl, libwww-perl and libio-string-perl. Policy chapter 7 requires the dependencies of a package to cover what it needs at run time. - Fix: Add
libbit-vector-perl, libio-socket-ssl-perl, libwww-perl, libio-string-perlto libthrift-perl's Depends (or Recommends for the SSL/HTTP ones if they are considered optional).
minor licensing 4. No copyright stanza covers the automake-generated Makefile.in and Makefile files, so Files: * attributes FSF-copyrighted, FSFULLR-licensed files to the ASF under Apache-2.0 ◂
- Files:
debian/copyright:5-7,lib/Makefile.in:4-8,lib/d/Makefile:4-8 - Basis: checked, in the package or with a reference tool
- Evidence: lib/Makefile.in:
# Copyright (C) 1994-2021 Free Software Foundation, Inc./# This Makefile.in is free software; the Free Software Foundation gives unlimited permission to copy and/or distribute it, with or without modifications, as long as this notice is preserved.; no Files: pattern in debian/copyright matches Makefile or Makefile.in. - Problem: Every generated */Makefile.in (about 100 files) and */Makefile (about 35) falls through to
Files: *(Copyright: Copyright 2006- Apache Software Foundation,License: Apache-2.0), which is the wrong holder and the wrong licence for them; with last-match-wins (copyright-format 6.9) these files are documented inaccurately even though their licence is more permissive and compatible. - Fix: Add a stanza such as
Files: */Makefile.in */MakefilewithCopyright: <years> Free Software Foundation, Inc.and the FSFULLR text already used for aclocal/lt*.m4.
minor licensing 5. The compile/depcomp/missing/ylwrap and config.guess/config.sub stanzas quote the Autoconf-macro exception instead of the "configuration script" exception in those files ◂
- Files:
debian/copyright:103-136,debian/copyright:137-170,depcomp:21-24,compile:22-25 - Basis: checked, in the package or with a reference tool
- Evidence: debian/copyright:
As a special exception, the respective Autoconf Macro's copyright owner gives unlimited permission to copy, distribute and modify the configure scripts that are the output of Autoconf when processing the Macro.-- depcomp/compile:As a special exception to the GNU General Public License, if you distribute this file as part of a program that contains a configuration script generated by Autoconf, you may include it under the same distribution terms that you use for the rest of that program. - Problem: These are automake helper scripts and config.guess/config.sub, which carry the generic Autoconf exception for programs containing a generated configure script; the text quoted is the autoconf-archive macro exception, which grants a different thing. The licence text in debian/copyright therefore does not match the files it is attached to, and the short name
GPL2+-with-Autoconf-Macros-exceptiondescribes the wrong exception. - Fix: Quote the exception as it appears in the files and name it accordingly (GPL-2+ with Autoconf exception for compile/depcomp/missing/ylwrap, GPL-3+ with Autoconf exception for config.guess/config.sub).
minor packaging 6. The only autopkgtest (install-php-thrift) asserts nothing, so it cannot detect a broken php-thrift ◂
- Files:
debian/tests/install-php-thrift:1-3,debian/tests/control:1-2 - Basis: checked, in the package or with a reference tool
- Evidence:
#!/bin/sh -efollowed byecho php-thrift is installed. - Problem: The test only checks that the package installs; it never loads the thrift_protocol extension or the PHP classes, so a mis-built extension, a wrong extension directory or a missing mods-available file would still pass. The changelog advertises this as an autopkgtest for php-thrift.
- Fix: Enable the module and assert the extension loads, e.g.
phpenmod thrift_protocol && php -r 'exit(extension_loaded("thrift_protocol") ? 0 : 1);', plus a small use of Thrift\Protocol\TBinaryProtocol.
Verified ◂
- Prescan
lib/d/src/base.o: relocatable ELF object for D module thrift.base; its sourcelib/d/src/thrift/base.dis in the tree. It is build output swept into the upstream tarball by lib/Makefile.am (EXTRA_DIST lists theddirectory whole), nothing references it, the D bindings are not configured (no --with-d) and no binary package ships it. Covered byFiles: *. - Prescan
lib/delphi/test/serializer/SerializerData.res: compiled Delphi resource (version information) sitting with SerializerData.dpr/-dproj; test data, Apache-2.0 underFiles: *. - Prescan
lib/java/src/crossTest/resources/.clientkeystore,.serverkeystore,.truststore,test/keys/client.p12,test/keys/server.p12,tutorial/netstd/Client/ThriftTest.pfx,tutorial/netstd/Server/ThriftTest.pfx: test key and certificate stores, generated as documented intest/keys/README.md("must never be used on production systems") and used by the cross-language and tutorial programs; Apache-2.0. - Prescan
lib/netstd/Thrift/thrift.snk: .NET strong-name key referenced by Thrift/Thrift.csproj and Thrift.AspNetCore/Thrift.AspNetCore.csproj; part of the Apache-licensed source. - Prescan
lib/nodejs/test/test_header_payload: binary fixture read bylib/nodejs/test/header.test.js:29; Apache-2.0. - Prescan
AGENTS.md:14("CC-BY-NC"): prose in the ASF AI-contribution guidelines listing licences that must not be introduced into the project; not a licence term of the file, which is Apache-2.0. - Licence sweep: grepped the tree (excluding .pc/ and debian/) for SPDX headers, "Permission is hereby granted", GNU GPL/LGPL, Apache, BSD, MIT, Boost, X11, public-domain and non-commercial/no-derivatives wording, and read LICENSE, NOTICE, lib/rs/LICENSE, lib/dart/LICENSE, contrib/fb303/LICENSE and the source file behind every Files: stanza. No non-free terms found; all licences are free and mutually compatible.
- Prescan holder check: both "possibly named" holders are already named - Nathan C. Myers in
debian/copyright:317(SocketPair.cpp stanza) and The Apache Software Foundation inFiles: *. No undeclared holder found by my own grep of Copyright/(C)/© notices. - Prescan binaries keystores/.p12/.pfx/.res contents not opened; judged from the documented generation procedure and their use in tests.
- Read in full: debian/control, rules, changelog head and tail, source/format, all .install/.docs/.examples/.manpages/dirs files, tests/control and the test, the 20 patches and series, and the .dsc.
- Checked the hand-written
debian/libthrift-0.25.0.shlibsagainst dpkg-shlibdeps: split_soname() splits libthrift-0.25.0.so into libthrift/0.25.0, solibthrift 0.25.0 libthrift-0.25.0 (>= 0.25.0-1~)(and the nb/z lines) match correctly. - Checked debhelper at compat 13: ${DEB_HOST_MULTIARCH} substitution in .install files is supported; debian/package.shlibs is installed by dh_makeshlibs; the override_dh_auto_test target is skipped under nocheck; dh_auto_test is not overridden in a way that needs its own nocheck check.
- Checked build dependencies: bootstrap.sh needs libtoolize/automake/autoconf, supplied transitively by debhelper -> dh-autoreconf (Depends: autoconf, automake, autopoint, libtool); php8.5-cli exists in the archive, so the hard-coded /etc/php/8.5/mods-available path in php-thrift.install is valid; php-http-discovery exists.
- Configured languages match the binary packages: --without-java/nodejs/erlang/lua/rust/kotlin, so no jar/node/lua/rust artefacts are expected in the build.
- uscan found the packaged version as the newest upstream release (upstream
0.25.0, packaged0.25.0). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0,GPL-2,GPL-3).
Not confirmed ◂
- Whether debian/tests/install-php-thrift carries the executable bit, which autopkgtest requires; the file mode cannot be read here.
- The exact content of ${phpcomposer:Debian-require} and ${python3:Depends} without running pkg-php-tools/dh_python3; I therefore did not judge php-thrift's PHP API-level dependency.
- No build or test run was attempted, so I cannot say whether the PHP classes end up on PHP's include path (upstream installs them under PHP_PREFIX=/usr/lib/php, not /usr/share/php).
- Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused:
grep: "xd://apt-cache" is not a file of the package or of the reviewing system.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader hasn't responded yet, and is welcome to at any time. The 24-hour hold has ended, so the package is now open for review as usual.
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 0.25.0-1 | b29a0727… | 2026-11-10 17:58 | 2026-11-10 17:58 | dfsg-uploader | rejected | VIEW |
| 0.24.0-1 | 8a502788… | 2026-08-08 16:30 | 2026-08-08 16:33 | mechtilde | accepted | VIEW |
| 0.23.0-1 | 148779b3… | 2026-05-02 14:17 | 2026-05-02 14:26 | mechtilde | rejected | VIEW |
| 0.23.0-1 | dd628534… | 2026-05-03 11:43 | 2026-05-03 12:29 | mechtilde | accepted | VIEW |