DFSG NEW Queue

DFSG, Licensing & New Packages Team

thrift 0.25.0-1

Package Information

DescriptionThrift C++ library

Thrift is a software framework for the development of reliable and performant communication and data serialization. It combines a software stack with code generation to build services that operate seamlessly across a number of different development languages.

This package contains the runtime libraries needed for C++ applications using Thrift.

MaintainerLaszlo Boszormenyi (GCS) <gcs@debian.org>
Changed ByLaszlo Boszormenyi (GCS) <gcs@debian.org>
Sponsorgcs@debian.org
Distributionexperimental
Architectureany all
Closes#1150191
Popcon Installs4411
Binary NEWYes (new binary packages of a source already in sid)
Trackerhttps://tracker.debian.org/pkg/thrift
Uploaded4 days ago

New Package Report

.changes◂
Changed-ByLaszlo Boszormenyi (GCS) <gcs@debian.org>
Architecturesource all amd64
Distributionexperimental
DateThu, 05 Nov 2026 18:54:02 +0100
Sourcethrift
Version0.25.0-1
Changelog◂
thrift (0.25.0-1) experimental; urgency=medium
 .
   * New major upstream release (closes: #1150191):
     - fixes CVE-2026-61373: allocation of resources without limits or
       throttling vulnerability in the Java TSaslNonblockingServer,
     - fixes CVE-2026-61374: allocation of resources without limits or
       throttling vulnerability in the Java bindings,
     - fixes CVE-2026-63772: allocation of resources without limits or
       throttling vulnerability in the Go bindings,
     - fixes CVE-2026-66054: allocation of resources without limits or
       throttling, improper handling of highly compressed data vulnerability
       in the C++ bindings,
     - fixes CVE-2026-66055: allocation of resources without limits or
       throttling in multiple language bindings,
     - fixes CVE-2026-66081: access of uninitialized pointer vulnerability
       in the c_glib bindings,
     - fixes CVE-2026-66837: stack-based buffer overflow, integer overflow
       or wraparound vulnerability in the PHP bindings,
     - fixes CVE-2026-66858: the protocol skip routine in several language
       bindings did not apply the binding's recursion limit,
     - fixes CVE-2026-66859: NULL pointer dereference and use of
       uninitialized variable vulnerability in the c_glib bindings,
     - fixes CVE-2026-82458: memory allocation with excessive size value,
       allocation of resources without limits or throttling vulnerability
       in several language bindings,
     - fixes CVE-2026-82459: integer underflow, out of bounds write
       vulnerability in the C++ 32 bit THeaderTransport,
     - fixes CVE-2026-83632: allocation of resources without limits or
       throttling, integer overflow or wraparound, heap based buffer
       overflow vulnerability,
     - fixes CVE-2026-83663: uncontrolled recursion vulnerability in the
       Go bindings,
     - fixes CVE-2026-85086: improper certificate validation, initialization
       of a resource with an insecure default vulnerability in the Perl
       bindings,
     - fixes CVE-2026-85087: improper certificate validation, return of
       wrong status code vulnerability in the Python bindings,
     - fixes CVE-2026-85088: improper validation of certificate with
       host mismatch in the C++ and D libraries,
     - fixes CVE-2026-85476: loop with unreachable exit condition, 'infinite
       loop' vulnerability in the c_glib bindings,
     - fixes CVE-2026-85483: use of uninitialized resource, return of
       wrong status code vulnerability in the c_glib bindings,
     - fixes CVE-2026-85494: improper handling of length parameter
       inconsistency in multiple language bindings,
     - fixes CVE-2026-91135: heap based buffer overflow vulnerability in
       the C++ THeaderTransport,
     - fixes CVE-2026-91137: improper validation of specified quantity in
       input, allocation of resources without limits or throttling in the
       PHP language bindings,
     - fixes CVE-2026-92834: use of uninitialized resource, return of wrong
       status code vulnerability in the C++ WebSocket server,
     - fixes CVE-2026-93925: stack based buffer overflow, incorrect bitwise
       shift of integer vulnerability in the C++ THeaderProtocol,
     - fixes CVE-2026-93926: missing release of memory after effective
       lifetime, missing release of resource after effective lifetime
       vulnerability in THeaderTransport,
     - fixes CVE-2026-94634: allocation of resources without limits or
       throttling, initialization of a resource with an insecure default
       vulnerability in the Python bindings,
     - fixes CVE-2026-94636: improper handling of highly compressed data in
       the Python bindings,
     - fixes CVE-2026-94637: improper handling of highly compressed data in
       the Go bindings,
     - fixes CVE-2026-94638: allocation of resources without limits or
       throttling vulnerability in the PHP bindings,
     - fixes CVE-2026-94639: improper handling of exceptional conditions,
       allocation of resources without limits or throttling, uncaught
       exception vulnerability in the Java bindings,
     - fixes CVE-2026-94642: uncaught exception vulnerability in the
       PHP bindings,
     - fixes CVE-2026-94644: allocation of resources without limits or
       throttling vulnerability in the PHP bindings,
     - fixes CVE-2026-94650: uncontrolled recursion vulnerability in the
       c_glib bindings,
     - fixes CVE-2026-94651: improper handling of exceptional conditions,
       missing release of resource after effective lifetime vulnerability
       in the java bindings,
     - fixes CVE-2026-94652: missing release of memory after effective
       lifetime vulnerability in the C++ bindings,
     - fixes CVE-2026-94653: inefficient algorithmic complexity
       vulnerability in the PHP bindings,
     - fixes CVE-2026-94654: loop with unreachable exit condition, 'infinite
       loop' vulnerability in the Python bindings,
     - fixes CVE-2026-96286: uncaught exception vulnerability in the
       Perl bindings,
     - fixes CVE-2026-96287:inefficient algorithmic complexity vulnerability
       in the Perl bindings,
     - fixes CVE-2026-96289: uncontrolled recursion vulnerability in the
       PHP bindings.
   * Update patches.
   * Rename related packages to -0.25.0 suffix.
   * Update -dev packages dependencies.
   * Add autopkgtest for php-thrift.
   * Update copyright file.
.dsc◂
Package-Listgolang-thrift-dev deb devel optional arch=all
libthrift-0.25.0 deb libs optional arch=any
libthrift-c-glib-dev deb libdevel optional arch=any
libthrift-c-glib0t64 deb libs optional arch=any
libthrift-dev deb libdevel optional arch=any
libthrift-perl deb perl optional arch=all
php-thrift deb php optional arch=any
python3-thrift deb python optional arch=any
thrift-compiler deb devel optional arch=any
Sectiondevel
Priorityoptional
Componentmain
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: thrift
Source: https://www.apache.org/dist/thrift

Files: *
Copyright: Copyright 2006- Apache Software Foundation
License: Apache-2.0

Files: aclocal/ax_boost_base.m4 aclocal/ax_check_openssl.m4 aclocal/ax_compare_version.m4 aclocal/ax_cxx_compile_stdcxx_11.m4 aclocal/ax_cxx_compile_stdcxx.m4 aclocal/ax_dmd.m4 aclocal/ax_javac_and_java.m4 aclocal/ax_lib_event.m4 aclocal/ax_lib_zlib.m4 aclocal/ax_prog_dotnetcore_version.m4 aclocal/ax_prog_haxe_version.m4 aclocal/ax_prog_perl_modules.m4 aclocal/ax_signed_right_shift.m4 aclocal/ax_thrift_internal.m4 contrib/fb303/acinclude.m4 contrib/fb303/aclocal/ax_boost_base.m4 contrib/fb303/aclocal/ax_cxx_compile_stdcxx_11.m4 contrib/fb303/aclocal/ax_javac_and_java.m4 contrib/fb303/aclocal/ax_thrift_internal.m4
Copyright: 2008 Benjamin Kosnik <bkoz@redhat.com>,
 2008 Tim Toolan <toolan@ele.uri.edu>,
 2008 Thomas Porschberg <thomas@randspringer.de>,
 2009 David Reiss,
 2009 Dean Povey <povey@wedgetail.com>,
 2009 Facebook,
 2009 Peter Adolphs,
 2009,2010 Zmanda Inc. <http://www.zmanda.com/>,
 2009,2010 Dustin J. Mitchell <dustin@zmanda.com>,
 2009,2010 Zmanda Inc. <http://www.zmanda.com/>,
 2011 David Nadlinger,
 2012 Zack Weinberg <zackw@panix.com>,
 2013 Roy Stogner <roystgnr@ices.utexas.edu>,
 2014, 2015 Google Inc.; contributed by Alexey Sokolov <sokolov@google.com>,
 2015 Jens Geyer <jensg@apache.org>,
 2015 Moritz Klammler <moritz@klammler.eu>,
 2015 Paul Norman <penorman@mac.com>,
 2016, 2018 Krzesimir Nowak <qdlacz@gmail.com>
License: FSFAP
 Copying and distribution of this file, with or without modification, are
 permitted in any medium without royalty provided the copyright notice
 and this notice are preserved. This file is offered as-is, without any
 warranty.

Files: aclocal/ax_lua.m4
Copyright: 2014 Tim Perkins <tprk77@gmail.com>,
 2015 Reuben Thomas <rrt@sc3d.org>
License: GPL3+-with-Autoconf-Macros-exception
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 3 of the License, or (at
 your option) any later version.
 .
 This program is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 General Public License for more details.
 .
 You should have received a copy of the GNU General Public License version 3
 along with this program; if not, see <https://www.gnu.org/licenses/>.
 .
 As a special exception, the respective Autoconf Macro's copyright
 owner gives unlimited permission to copy, distribute and modify the
 configure scripts that are the output of Autoconf when processing the
 Macro. You need not follow the terms of the GNU General Public License
 when using or distributing such scripts, even though portions of the
 text of the Macro appear in them. The GNU General Public License (GPL)
 does govern all other use of the material that constitutes the
 Autoconf Macro.
 .
 This special exception to the GPL applies to versions of the Autoconf
 Macro released by the GNU Autoconf Macro Archive. When you make and
 distribute a modified version of the Autoconf Macro, you may extend
 this special exception to the GPL to apply to your modified version as
 well.
 .
 On Debian systems, the full text of the GNU General Public License version 3
 can be found in the file `/usr/share/common-licenses/GPL-3'.

Files: aclocal/lt~obsolete.m4 aclocal/ltoptions.m4 aclocal/ltsugar.m4 aclocal/ltversion.m4 aclocal/tar.m4
Copyright: 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, Inc.
License: FSFULLR
 This file is free software; the Free Software Foundation gives
 unlimited permission to copy and/or distribute it, with or without
 modifications, as long as this notice is preserved.
 .
 This program is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY, to the extent permitted by law; without even
 the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Files: aclocal.m4 aclocal/libtool.m4
Copyright: 1996-2001, 2003-2015 Free Software Foundation, Inc.,
 2004 Scott James Remnant <scott@netsplit.com>,
 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
License: FSFULLR and/or GPL-2+ with Libtool exception
 GNU Libtool is free software; you can redistribute it and/or modify it
 under the terms of the GNU General Public License as published by the Free
 Software Foundation; either version 2 of the License, or (at your option)
 any later version.
 .
 As a special exception to the GNU General Public License, if you
 distribute this file as part of a program or library that is built
 using GNU Libtool, you may include this file under the  same
 distribution terms that you use for the rest of that program.
 .
 GNU Libtool is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License version 2
 along with this program.  If not, see <http://www.gnu.org/licenses/>.

Files: compile depcomp missing ylwrap
Copyright: 1992-2026 Free Software Foundation, Inc.
License: GPL2+-with-Autoconf-Macros-exception
 This program is free software; you can redistribute it and/or
 modify it under the terms of the GNU General Public License as
 published by the Free Software Foundation; either version 2 of the
 License, or (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 General Public License for more details.
 .
 You should have received a copy of the GNU General Public License version 2
 along with this program.
 .
 As a special exception, the respective Autoconf Macro's copyright
 owner gives unlimited permission to copy, distribute and modify the
 configure scripts that are the output of Autoconf when processing
 the Macro. You need not follow the terms of the GNU General Public
 License when using or distributing such scripts, even though
 portions of the text of the Macro appear in them. The GNU General
 Public License (GPL) does govern all other use of the material that
 constitutes the Autoconf Macro.
 .
 This special exception to the GPL applies to versions of the
 Autoconf Macro released by the Autoconf Macro Archive. When you
 make and distribute a modified version of the Autoconf Macro, you
 may extend this special exception to the GPL to apply to your
 modified version as well.
 .
 On Debian systems, the full text of the GNU General Public License version 2
 can be found in the file `/usr/share/common-licenses/GPL-2'.

Files: config.guess config.sub
Copyright: 1992-2024 Free Software Foundation, Inc.
License: GPL3+-with-Autoconf-Macros-exception
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 3 of the License, or (at
 your option) any later version.
 .
 This program is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 General Public License for more details.
 .
 You should have received a copy of the GNU General Public License version 3
 along with this program; if not, see <https://www.gnu.org/licenses/>.
 .
 As a special exception, the respective Autoconf Macro's copyright
 owner gives unlimited permission to copy, distribute and modify the
 configure scripts that are the output of Autoconf when processing the
 Macro. You need not follow the terms of the GNU General Public License
 when using or distributing such scripts, even though portions of the
 text of the Macro appear in them. The GNU General Public License (GPL)
 does govern all other use of the material that constitutes the
 Autoconf Macro.
 .
 This special exception to the GPL applies to versions of the Autoconf
 Macro released by the GNU Autoconf Macro Archive. When you make and
 distribute a modified version of the Autoconf Macro, you may extend
 this special exception to the GPL to apply to your modified version as
 well.
 .
 On Debian systems, the full text of the GNU General Public License version 3
 can be found in the file `/usr/share/common-licenses/GPL-3'.

Files: configure
Copyright: 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, Inc.
License: FSFUL
 This configure script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it.

Files: install-sh
Copyright: 1994 X Consortium
License: X11
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE X
 CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 .
 Except as contained in this notice, the name of the X Consortium shall not be
 used in advertising or otherwise to promote the sale, use or other dealings in
 this Software without prior written authorization from the X Consortium.

Files: ltmain.sh
Copyright: 1996-2015 Free Software Foundation, Inc.
License: GPL-2+ with Libtool exception
 GNU Libtool is free software; you can redistribute it and/or modify it
 under the terms of the GNU General Public License as published by the Free
 Software Foundation; either version 2 of the License, or (at your option)
 any later version.
 .
 As a special exception to the GNU General Public License, if you
 distribute this file as part of a program or library that is built
 using GNU Libtool, you may include this file under the  same
 distribution terms that you use for the rest of that program.
 .
 GNU Libtool is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License version 2
 along with this program.  If not, see <http://www.gnu.org/licenses/>.

Files: compiler/cpp/src/thrift/generate/sha256.h
Copyright: 2012 Brad Conte <brad@bradconte.com>
License: public-domain

Files: compiler/cpp/tests/catch/catch.hpp
Copyright: 2012 Two Blue Cubes Ltd.
License: BSL-1.0
 Boost Software License - Version 1.0 - August 17th, 2003
 .
 Permission is hereby granted, free of charge, to any person or organization
 obtaining a copy of the software and accompanying documentation covered by
 this license (the "Software") to use, reproduce, display, distribute,
 execute, and transmit the Software, and to prepare derivative works of the
 Software, and to permit third-parties to whom the Software is furnished to
 do so, all subject to the following:
 .
 The copyright notices in the Software and this entire statement, including
 the above license grant, this restriction and the following disclaimer,
 must be included in all copies of the Software, in whole or in part, and
 all derivative works of the Software, unless such copies or derivative
 works are solely in the form of machine-executable object code generated by
 a source language processor.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
 SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
 FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
 ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

Files: build/cmake/FindGLIB.cmake
Copyright: Copyright (C) 2012 Raphael Kubo da Costa <rakuco@webkit.org>
License: BSD-2-Clause
 All rights reserved.
 .
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
 IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
 PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Files: compiler/cpp/src/thrift/generate/t_cl_generator.cc
Copyright: 2006- Facebook,
 2006- Apache Software Foundation,
 2008- Patrick Collison <patrick@collison.ie>
License: Apache-2.0

Files: compiler/cpp/src/thrift/generate/t_html_generator.h
Copyright: 2012 Twitter, Inc.
License: Apache-2.0

Files: compiler/cpp/src/thrift/thrifty.cc compiler/cpp/src/thrift/thrifty.hh
Copyright: Copyright (C) 1984, 1989-1990, 2000-2015, 2018-2021 Free Software Foundation, Inc.
License: GPL-3+ with Bison-2.2 exception
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License version 3
 along with this program.  If not, see <https://www.gnu.org/licenses/>.
 .
 As a special exception, you may create a larger work that contains
 part or all of the Bison parser skeleton and distribute that work
 under terms of your choice, so long as that work isn't itself a
 parser generator using the skeleton or a modified version thereof
 as a parser skeleton.  Alternatively, if you modify or redistribute
 the parser skeleton itself, you may (at your option) remove this
 special exception, which will cause the skeleton and the resulting
 Bison output files to be licensed under the GNU General Public
 License without this special exception.

Files: lib/cpp/src/thrift/windows/SocketPair.cpp
Copyright: 2007 Nathan C. Myers <ncm@cantrip.org>
License: socketpair and Apache-2.0

Files: lib/nodejs/lib/thrift/json_parse.js
Copyright: 2015 Douglas Crockford <douglas@crockford.com>
License: public-domain

Files: lib/php/src/ext/thrift_protocol/config.m4
Copyright: 2009 Facebook
License: Apache-2.0 or FSFAP

Files: lib/py/compat/win32/stdint.h
Copyright: 2006-2008 Alexander Chemeris
License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 .
 * Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
 .
 * Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.
 .
 * Neither the name of Kitware, Inc. nor the names of Contributors
   may be used to endorse or promote products derived from this
   software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Files: debian/*
Copyright: Copyright 2012-2014 Eric Evans <eevans@debian.org>,
           Copyright 2014-     Laszlo Boszormenyi (GCS) <gcs@debian.org>
License: GPL-2+

License: GPL-2+
 This program is free software; you can redistribute it and/or modify it
 under the terms of the GNU General Public License as published by the Free
 Software Foundation; either version 2 of the License, or (at your option)
 any later version.
 .
 This program is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 for more details.
 .
 You should have received a copy of the GNU General Public License version 2
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the full text of the GNU General Public License version 2
 can be found in the file `/usr/share/common-licenses/GPL-2'.

License: GPL-3+
 This program is free software: you can redistribute it and/or modify it
 under the terms of the GNU General Public License as published by the Free
 Software Foundation, either version 3 of the License, or (at your option)
 any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License version 3
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the full text of the GNU General Public License
 version 3 can be found in the file `/usr/share/common-licenses/GPL-3'.

License: Apache-2.0
 Licensed to the Apache Software Foundation (ASF) under one or more contributor
 license agreements. The ASF licenses this work to You under the Apache License,
 Version 2.0 (the "License"); you may not use this work except in compliance
 with the License.  You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 On Debian systems, the complete text of the Apache License Version 2.0
 can be found in the file '/usr/share/common-licenses/Apache-2.0'.

License: FSFAP
 Copying and distribution of this file, with or without modification, are
 permitted in any medium without royalty provided the copyright notice
 and this notice are preserved. This file is offered as-is, without any
 warranty.

License: public-domain
 These files were granted to the public domain.
 .
 No copyright is claimed.  This code is in the public domain; do with
 it what you wish.

License: socketpair
 This code is Free Software. It may be copied freely, in original or
 modified form, subject only to the restrictions that (1) the author is
 relieved from all responsibilities for any use for any purpose, and (2)
 this copyright notice must be retained, unchanged, in its entirety. If
 for any reason the author might be held responsible for any consequences
 of copying or use, license is withheld.

DFSG Assistant LLM REVIEW 0 blocker, 3 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 4 days ago.

Report◂

DFSG NEW review for thrift version 0.25.0-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: No
  • Issues: 0 blocker, 3 important, 3 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 12 found

Licensing

All code in the tree is under free, mutually compatible licences (Apache-2.0 with permissive FSF/BSD/MIT/BSL/X11/public-domain build scripts and components), so there is no DFSG problem. debian/copyright is machine-readable and covers the third-party components, but it is not fully accurate: the lib/py/compat/win32/stdint.h stanza reproduces a BSD-3-Clause text naming Kitware, Inc., which appears in neither the file nor LICENSE, and which turns a permission in the file into an endorsement restriction; the automake-generated */Makefile.in and */Makefile files (FSF copyright, FSFULLR) are not covered by any stanza and so fall under Files: * (ASF, Apache-2.0); and the compile/depcomp/missing/ylwrap and config.guess/config.sub stanzas quote the wrong Autoconf exception.

Packaging

Build mechanics check out at compat 13 (install globs, ${DEB_HOST_MULTIARCH} substitution, the hand-written shlibs entries match the real soname libthrift-0.25.0.so as dpkg-shlibdeps splits it, bootstrap.sh's autotools needs are satisfied through debhelper -> dh-autoreconf, and /etc/php/8.5/mods-available matches the php8.5 in the archive). Two binary packages are nevertheless missing runtime dependencies their own files need: libthrift-dev headers include <boost/...> and <event.h> without depending on libboost-dev or libevent-dev, and libthrift-perl loads Bit::Vector and IO::Socket::SSL/LWP/IO::String without depending on their packages. The one autopkgtest asserts nothing.

Issues

important licensing 1. debian/copyright quotes a BSD-3-Clause text naming Kitware, Inc. for lib/py/compat/win32/stdint.h, not the licence text in the file ◂
  • Files: debian/copyright:328-356, lib/py/compat/win32/stdint.h:15-17
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/copyright: * Neither the name of Kitware, Inc. nor the names of Contributors may be used to endorse or promote products derived from this software without specific prior written permission. -- lib/py/compat/win32/stdint.h (and the copy in LICENSE): 3. The name of the author may be used to endorse or promote products derived from this software without specific prior written permission.
  • Problem: The stanza documents a restriction that the file does not contain, and names a third party (Kitware, Inc.) that has nothing to do with this file. The file's third clause is a permission, not a non-endorsement condition, so the two real conditions are those of BSD-2-Clause. copyright-format 1.0 (Policy, copyright-format section 6.7) requires the License field to carry the licence that actually applies, so the copyright file misdescribes this file.
  • Fix: Replace the quoted text with the file's own notice (its two conditions are BSD-2-Clause) and use the matching short name, or at least quote clause 3 verbatim instead of the Kitware text.
important packaging 2. libthrift-dev lacks Depends on libboost-dev and libevent-dev although its installed headers include <boost/...> and <event.h>/<event2/...> ◂
  • Files: debian/control:47, lib/cpp/src/thrift/TUuid.h:26, lib/cpp/src/thrift/processor/TMultiplexedProcessor.h:26, lib/cpp/src/thrift/server/TNonblockingServer.h:44-46, debian/libthrift-dev.install:1-6
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/control: Depends: libthrift-0.25.0 (= ${binary:Version}), ${misc:Depends}, libssl-dev, zlib1g-dev, pkgconf; installed headers: #include <boost/uuid/uuid.hpp>, #include <boost/tokenizer.hpp>, #include <event.h>, #include <event2/event_compat.h>.
  • Problem: Policy 8.4: installing a development package must give everything needed to compile against the library. libthrift-dev installs /usr/include/thrift/TUuid.h, processor/TMultiplexedProcessor.h and server/TNonblockingServer.h, so a program using them fails to compile unless libboost-dev and libevent-dev happen to be installed for other reasons. The build does not catch this because both are Build-Depends.
  • Fix: Add libboost-dev and libevent-dev to libthrift-dev's Depends (they can be dropped again only if those headers stop being installed).
important packaging 3. libthrift-perl does not depend on the Perl modules its shipped code loads: Bit::Vector, IO::Socket::SSL, LWP::UserAgent, IO::String ◂
  • Files: debian/control:132, lib/perl/lib/Thrift/BinaryProtocol.pm:24, lib/perl/lib/Thrift/SSLSocket.pm:27, lib/perl/lib/Thrift/HttpClient.pm:24-27
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/control: Depends: ${perl:Depends}, ${misc:Depends}; files: use Bit::Vector;, use IO::Socket::SSL;, use HTTP::Request; use IO::String; use LWP::UserAgent;
  • Problem: Thrift::BinaryProtocol compiles use Bit::Vector when it is loaded, and Thrift::Server loads Thrift::BinaryProtocol, so every generated Perl client and server dies with "Can't locate Bit/Vector.pm" on a system with only libthrift-perl installed. The SSL and HTTP transports fail the same way for libio-socket-ssl-perl, libwww-perl and libio-string-perl. Policy chapter 7 requires the dependencies of a package to cover what it needs at run time.
  • Fix: Add libbit-vector-perl, libio-socket-ssl-perl, libwww-perl, libio-string-perl to libthrift-perl's Depends (or Recommends for the SSL/HTTP ones if they are considered optional).
minor licensing 4. No copyright stanza covers the automake-generated Makefile.in and Makefile files, so Files: * attributes FSF-copyrighted, FSFULLR-licensed files to the ASF under Apache-2.0 ◂
  • Files: debian/copyright:5-7, lib/Makefile.in:4-8, lib/d/Makefile:4-8
  • Basis: checked, in the package or with a reference tool
  • Evidence: lib/Makefile.in: # Copyright (C) 1994-2021 Free Software Foundation, Inc. / # This Makefile.in is free software; the Free Software Foundation gives unlimited permission to copy and/or distribute it, with or without modifications, as long as this notice is preserved.; no Files: pattern in debian/copyright matches Makefile or Makefile.in.
  • Problem: Every generated */Makefile.in (about 100 files) and */Makefile (about 35) falls through to Files: * (Copyright: Copyright 2006- Apache Software Foundation, License: Apache-2.0), which is the wrong holder and the wrong licence for them; with last-match-wins (copyright-format 6.9) these files are documented inaccurately even though their licence is more permissive and compatible.
  • Fix: Add a stanza such as Files: */Makefile.in */Makefile with Copyright: <years> Free Software Foundation, Inc. and the FSFULLR text already used for aclocal/lt*.m4.
minor licensing 5. The compile/depcomp/missing/ylwrap and config.guess/config.sub stanzas quote the Autoconf-macro exception instead of the "configuration script" exception in those files ◂
  • Files: debian/copyright:103-136, debian/copyright:137-170, depcomp:21-24, compile:22-25
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/copyright: As a special exception, the respective Autoconf Macro's copyright owner gives unlimited permission to copy, distribute and modify the configure scripts that are the output of Autoconf when processing the Macro. -- depcomp/compile: As a special exception to the GNU General Public License, if you distribute this file as part of a program that contains a configuration script generated by Autoconf, you may include it under the same distribution terms that you use for the rest of that program.
  • Problem: These are automake helper scripts and config.guess/config.sub, which carry the generic Autoconf exception for programs containing a generated configure script; the text quoted is the autoconf-archive macro exception, which grants a different thing. The licence text in debian/copyright therefore does not match the files it is attached to, and the short name GPL2+-with-Autoconf-Macros-exception describes the wrong exception.
  • Fix: Quote the exception as it appears in the files and name it accordingly (GPL-2+ with Autoconf exception for compile/depcomp/missing/ylwrap, GPL-3+ with Autoconf exception for config.guess/config.sub).
minor packaging 6. The only autopkgtest (install-php-thrift) asserts nothing, so it cannot detect a broken php-thrift ◂
  • Files: debian/tests/install-php-thrift:1-3, debian/tests/control:1-2
  • Basis: checked, in the package or with a reference tool
  • Evidence: #!/bin/sh -e followed by echo php-thrift is installed.
  • Problem: The test only checks that the package installs; it never loads the thrift_protocol extension or the PHP classes, so a mis-built extension, a wrong extension directory or a missing mods-available file would still pass. The changelog advertises this as an autopkgtest for php-thrift.
  • Fix: Enable the module and assert the extension loads, e.g. phpenmod thrift_protocol && php -r 'exit(extension_loaded("thrift_protocol") ? 0 : 1);', plus a small use of Thrift\Protocol\TBinaryProtocol.
Verified ◂
  • Prescan lib/d/src/base.o: relocatable ELF object for D module thrift.base; its source lib/d/src/thrift/base.d is in the tree. It is build output swept into the upstream tarball by lib/Makefile.am (EXTRA_DIST lists the d directory whole), nothing references it, the D bindings are not configured (no --with-d) and no binary package ships it. Covered by Files: *.
  • Prescan lib/delphi/test/serializer/SerializerData.res: compiled Delphi resource (version information) sitting with SerializerData.dpr/-dproj; test data, Apache-2.0 under Files: *.
  • Prescan lib/java/src/crossTest/resources/.clientkeystore, .serverkeystore, .truststore, test/keys/client.p12, test/keys/server.p12, tutorial/netstd/Client/ThriftTest.pfx, tutorial/netstd/Server/ThriftTest.pfx: test key and certificate stores, generated as documented in test/keys/README.md ("must never be used on production systems") and used by the cross-language and tutorial programs; Apache-2.0.
  • Prescan lib/netstd/Thrift/thrift.snk: .NET strong-name key referenced by Thrift/Thrift.csproj and Thrift.AspNetCore/Thrift.AspNetCore.csproj; part of the Apache-licensed source.
  • Prescan lib/nodejs/test/test_header_payload: binary fixture read by lib/nodejs/test/header.test.js:29; Apache-2.0.
  • Prescan AGENTS.md:14 ("CC-BY-NC"): prose in the ASF AI-contribution guidelines listing licences that must not be introduced into the project; not a licence term of the file, which is Apache-2.0.
  • Licence sweep: grepped the tree (excluding .pc/ and debian/) for SPDX headers, "Permission is hereby granted", GNU GPL/LGPL, Apache, BSD, MIT, Boost, X11, public-domain and non-commercial/no-derivatives wording, and read LICENSE, NOTICE, lib/rs/LICENSE, lib/dart/LICENSE, contrib/fb303/LICENSE and the source file behind every Files: stanza. No non-free terms found; all licences are free and mutually compatible.
  • Prescan holder check: both "possibly named" holders are already named - Nathan C. Myers in debian/copyright:317 (SocketPair.cpp stanza) and The Apache Software Foundation in Files: *. No undeclared holder found by my own grep of Copyright/(C)/© notices.
  • Prescan binaries keystores/.p12/.pfx/.res contents not opened; judged from the documented generation procedure and their use in tests.
  • Read in full: debian/control, rules, changelog head and tail, source/format, all .install/.docs/.examples/.manpages/dirs files, tests/control and the test, the 20 patches and series, and the .dsc.
  • Checked the hand-written debian/libthrift-0.25.0.shlibs against dpkg-shlibdeps: split_soname() splits libthrift-0.25.0.so into libthrift/0.25.0, so libthrift 0.25.0 libthrift-0.25.0 (>= 0.25.0-1~) (and the nb/z lines) match correctly.
  • Checked debhelper at compat 13: ${DEB_HOST_MULTIARCH} substitution in .install files is supported; debian/package.shlibs is installed by dh_makeshlibs; the override_dh_auto_test target is skipped under nocheck; dh_auto_test is not overridden in a way that needs its own nocheck check.
  • Checked build dependencies: bootstrap.sh needs libtoolize/automake/autoconf, supplied transitively by debhelper -> dh-autoreconf (Depends: autoconf, automake, autopoint, libtool); php8.5-cli exists in the archive, so the hard-coded /etc/php/8.5/mods-available path in php-thrift.install is valid; php-http-discovery exists.
  • Configured languages match the binary packages: --without-java/nodejs/erlang/lua/rust/kotlin, so no jar/node/lua/rust artefacts are expected in the build.
  • uscan found the packaged version as the newest upstream release (upstream 0.25.0, packaged 0.25.0).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-2, GPL-3).
Not confirmed ◂
  • Whether debian/tests/install-php-thrift carries the executable bit, which autopkgtest requires; the file mode cannot be read here.
  • The exact content of ${phpcomposer:Debian-require} and ${python3:Depends} without running pkg-php-tools/dh_python3; I therefore did not judge php-thrift's PHP API-level dependency.
  • No build or test run was attempted, so I cannot say whether the PHP classes end up on PHP's include path (upstream installs them under PHP_PREFIX=/usr/lib/php, not /usr/share/php).
  • Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: grep: "xd://apt-cache" is not a file of the package or of the reviewing system.
Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader hasn't responded yet, and is welcome to at any time. The 24-hour hold has ended, so the package is now open for review as usual.

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
0.25.0-1 b29a0727… 2026-11-10 17:58 2026-11-10 17:58 dfsg-uploader rejected VIEW
0.24.0-1 8a502788… 2026-08-08 16:30 2026-08-08 16:33 mechtilde accepted VIEW
0.23.0-1 148779b3… 2026-05-02 14:17 2026-05-02 14:26 mechtilde rejected VIEW
0.23.0-1 dd628534… 2026-05-03 11:43 2026-05-03 12:29 mechtilde accepted VIEW

Back to Dashboard | View all reviews for this package