DFSG NEW review for tomobase version 0.0.0~dev1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable

Licensing

Every file in the tree is under the MIT licence held by ESRF; debian/copyright is valid machine-readable format and matches the evidence. The only licence statements in the package are the top-level LICENSE (MIT, 'Copyright (c) European Synchrotron Radiation Facility (ESRF)'), pyproject.toml (license = "MIT") and doc/conf.py (copyright = "2026, ESRF"); no file carries another licence, SPDX tag or copyright holder. The Files: * paragraph covers the whole tree and the debian/* paragraph covers the packaging, the MIT short name matches the appended text, and full MIT text is included (it is not in /usr/share/common-licenses).

Packaging

The packaging is close but has a real defect in the test configuration: debian/rules sets pytest-style PYBUILD_TEST_ARGS without selecting the pytest test runner, so the arguments go to pybuild's default unittest discover command, which does not accept -m. There is also no autopkgtest, and an unexplained find debian -name conf.py -delete workaround in debian/rules. Dependencies, debhelper compat, Vcs-*, changelog and copyright are otherwise in order.

Issues

1. [important] [packaging] PYBUILD_TEST_ARGS are pytest options but the pytest runner is not selected, and the needs_network marker does not exist

• Files: debian/rules:5
• Evidence: export PYBUILD_TEST_ARGS=-m 'not needs_network' -vv
• Problem: pybuild uses pytest as the test runner only when PYBUILD_TEST_PYTEST=1 (pybuild(1), 'TESTS'); it is not set here, so cfg.test_pytest is false and pybuild's fallback command is cd {build_dir}; {interpreter} -m unittest discover -v {args} (dhpython/build/base.py:323-334). The -m 'not needs_network' argument is therefore passed to unittest, whose argument parser has no -m option, so the test step is not run as intended. In addition, no test in the suite uses a needs_network marker (grep finds it nowhere in the source), and pytest is in Build-Depends but never used as the runner. This also means the upstream pytest suite is not exercised at build time.
• Fix: Add export PYBUILD_TEST_PYTEST=1 (or pass --test-pytest) so the arguments reach pytest, and drop or define the needs_network marker (it is currently a no-op; with pytest it would only warn).

2. [minor] [packaging] No autopkgtest

• Files: debian/
• Evidence: no debian/tests/control; the upstream suite lives in tomobase/tests/
• Problem: The package ships a pytest suite but declares no autopkgtest, so the archive's CI will not exercise it and regressions are not caught in testing; this is expected practice for new Python packages.
• Fix: Add debian/tests/control with Tests: pytest (and Depends: @, python3-pytest) running the upstream tests.

3. [minor] [packaging] Undocumented post-install deletion of conf.py works around a setuptools namespace-package issue

• Files: debian/rules:7-8, pyproject.toml:64-65

• Evidence:

  execute_after_dh_auto_install:
  find debian -name conf.py -delete

• Problem: [tool.setuptools.packages.find] where = ["."] uses setuptools' default namespaces = true, so setuptools treats the top-level doc/ directory as a PEP 420 namespace package and installs doc/conf.py into /usr/lib/python3/dist-packages. The rule removes it after installation instead of excluding it; it is unexplained, silently deletes any file named conf.py under debian/, and would let any other stray .py under a non-package directory leak into the package.

• Fix: Exclude doc from packaging instead of deleting afterwards - upstream by setting namespaces = false or include = ["tomobase*"] in [tool.setuptools.packages.find], or in Debian via debian/python3-tomobase.pyremove containing doc/conf.py - and drop the find command.

Verified

• Read all of debian/: changelog, control, copyright, rules, source/format (3.0 (quilt)), source/options, python3-tomobase.docs. There are no patches, no maintainer scripts, no debian/tests, no gbp.conf, no debian/upstream/metadata.
• Inventoried the whole tree (glob and grep with gitignore:false, .pc/ excluded) and read every file under tomobase/, plus LICENSE, pyproject.toml, README.md, CHANGELOG.md, doc/conf.py, doc/index.rst, doc/api.rst, doc/_templates/version.html, .gitlab-ci.yml, .readthedocs.yaml, .gitignore.
• Grepped the tree for Copyright/(C)/(c)/SPDX-License-Identifier/Licensed under/GNU/GPL/LGPL/Apache/Mozilla/public domain/All rights reserved/permission is hereby granted: the only hits are the MIT texts in LICENSE, debian/copyright and the license = "MIT" in pyproject.toml; no conflicting licence or holder exists.
• debian/copyright is DEP-5 with the exact approved Format line; the Files: * and debian/* stanzas cover the whole tree (including doc and the images) and the packaging; the MIT short name is backed by the appended full text required for a licence not in /usr/share/common-licenses.
• Runtime imports are numpy, h5py and silx (tomobase/series.py, geometry/bounding_box.py, utils/io.py, utils/hdf5.py, utils/url.py); pyproject declares dependencies h5py>=3.0, silx>=2.0, numpy, which dh_python3 translates from Requires-Dist into ${python3:Depends}, so Depends is not missing anything by inspection.
• Checked on the reviewing system: python3-silx (2.2.2-6), python3-h5py (3.16.0-7), python3-setuptools (84.0.0-2) and pybuild-plugin-pyproject exist; pybuild-plugin-pyproject pulls python3-build and python3-installer, so the pyproject build plugin's tools are present.
• Standards-Version 4.7.4 (current is 4.7.4.1) is acceptable; Vcs-Git/Vcs-Browser/Homepage are present; debhelper-compat 14 with dh-sequence-python3 is current; the changelog distribution is unstable, the version 0.0.0~dev1-1 correctly sorts the upstream 0.0.0dev1 pre-release before 0.0.0.
• doc/img/tomobase-lockup.svg, doc/img/tomobase.png and doc/img/tomobase.svg were recorded by name and location; they are covered by Files: *.
• uscan found the packaged version as the newest upstream release (upstream 0.0.0~dev1, packaged 0.0.0~dev1).

Not confirmed

• The package was not built. The pybuild test step would run cd .pybuild/.../build; python3 -m unittest discover -v -m 'not needs_network' -vv (fallback path in dhpython/build/base.py since PYBUILD_TEST_PYTEST is unset); unittest's argparse does not define -m, so dh_auto_test would fail with a non-zero exit. A build (dh_auto_test) or an autopkgtest would confirm this.
• Binary files (doc/img/tomobase.png and the two SVGs) were not opened or decoded; their licensing is taken from debian/copyright's Files: * and the project LICENSE.
• The actual contents of ${python3:Depends} (python3-h5py/numpy/silx generated from Requires-Dist) could only be checked by building; it was reasoned from dh_python3(1) rather than observed.

Proposed changes

None.