trust-store 2.0.3-1

Package Information

Description	C++11 library for persisting trust requests - runtime library Provides a common implementation of a trust store to be used by trusted helpers. This package includes the trust-store runtime libraries.
Maintainer	Debian UBports Team <team+ubports@tracker.debian.org>
Changed By	Jeremy Bícha <jbicha@ubuntu.com>
Sponsor	jbicha@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://salsa.debian.org/ubports-team/trust-store.git (browse)
Tracker	https://tracker.debian.org/pkg/trust-store
Uploaded	5 hours ago

New Package Report

.changes◂

Architecture	source amd64 all
Distribution	unstable
Date	Mon, 09 Nov 2026 16:34:42 +0100
Source	trust-store
Version	2.0.3-1
Changed-By	Jeremy Bícha <jbicha@ubuntu.com>

Changelog◂

trust-store (2.0.3-1) unstable; urgency=medium
 .
   * Initial release

.dsc◂

Priority	optional
Component	main
Package-List	libtrust-store-dev deb libdevel optional arch=any libtrust-store-doc deb doc optional arch=all libtrust-store2 deb libs optional arch=any trust-store-bin deb misc optional arch=any trust-store-tests deb libdevel optional arch=any
Section	libdevel

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://launchpad.net/trust-store
Upstream-Name: trust-store

Files: *
Copyright: 2013-2016 Canonical Ltd.
 2026 UBports Foundation
License: LGPL-3

Files: data/CMakeLists.txt
 doc/CMakeLists.txt
 src/CMakeLists.txt
Copyright: 2013, Canonical Ltd.
License: GPL-3

Files: po/*
Copyright: 2014-2017 Rosetta Contributors and Canonical Ltd
License: LGPL-3

Files: 3rd_party/xdg/*
Copyright: 2015 Thomas Voß <thomas.voss.bochum@gmail.com>
License: LGPL-3+
Comment: https://github.com/vosst/xdg

License: GPL-3
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, version 3 of the License.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program.  If not, see <http://www.gnu.org/licenses/>.
 .
 On Debian systems, the full text of the GNU General Public License
 version 3 can be found in the file /usr/share/common-licenses/GPL-3.

License: LGPL-3
 This package is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation, version 3 of
 the License.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 Lesser General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <http://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU Lesser General
 Public License can be found in /usr/share/common-licenses/LGPL-3.

License: LGPL-3+
 This package is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 3 of the License, or (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 Lesser General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <http://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU Lesser General
 Public License can be found in "/usr/share/common-licenses/LGPL-3".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 9 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 4 hours ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for trust-store version 2.0.3-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 9 minor
debian/watch: old format (version 4)
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

All of the code is free: src/, include/, tests/ and data/ are LGPL-3 only ('GNU Lesser General Public License version 3, as published by the Free Software Foundation'), the vendored 3rd_party/xdg is LGPL-3+, the three CMakeLists.txt files are GPL-3, and the 150 po files are under the package licence. Every licence is in /usr/share/common-licenses, and LGPL-3 + LGPL-3+ + build-only GPL-3 combine without a problem. debian/copyright is DEP-5 with the correct short names, a catch-all plus four overriding stanzas in the right order, and names Canonical, UBports, Thomas Voss and the Rosetta contributors. Its one inaccuracy is that the two verbatim FSF licence texts (COPYING, 3rd_party/xdg/LICENSE) are attributed to Canonical and Thomas Voss. No non-free terms, no unlicensed file, no prebuilt or minified file.

Packaging

The packaging is sound and close to upload quality: a sensible five-way split after libtrust-store2 with Multi-Arch: same, debhelper-compat 13 with a plain dh sequence and hardening=+all, 3.0 (quilt) with no patches, no maintainer scripts, build-dependencies that all exist, and Standards-Version 4.7.4, which is the current Policy. What remains is minor: a missing libwayland-dev dependency for an installed header, a wrong package name in the trust-store-tests synopsis, a pkg-config file that is not multiarch-aware, no man pages for the three installed programs, vestigial code in debian/rules, a get-orig-source target that Policy removed in 4.1.4, and two unused UBports leftovers in debian/.

Issues

minor licensing 1. COPYING and 3rd_party/xdg/LICENSE are the FSF's LGPL-3 text but are attributed to Canonical Ltd. and Thomas Voss ◂

Files: debian/copyright, COPYING:4-5, 3rd_party/xdg/LICENSE:4-5
Basis: checked, in the package or with a reference tool
Evidence: Both files begin Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>, while Files: * says Copyright: 2013-2016 Canonical Ltd. / 2026 UBports Foundation and the later Files: 3rd_party/xdg/* stanza says Copyright: 2015 Thomas Voss <thomas.voss.bochum@gmail.com>.
Problem: No stanza names the Free Software Foundation as a holder, and because a Files pattern matches at any depth and later stanzas override earlier ones, 3rd_party/xdg/* assigns the FSF's licence text to Thomas Voss. debian/copyright therefore does not describe the copyright of these two files accurately, although their licence (LGPL-3) is right.
Fix: Add a stanza after the 3rd_party one: Files: COPYING 3rd_party/xdg/LICENSE, Copyright: 2007 Free Software Foundation, Inc., License: LGPL-3.

minor packaging 2. libtrust-store-dev does not depend on libwayland-dev, though the installed mir_agent.h includes wayland-client.h ◂

Files: debian/control, include/core/trust/mir_agent.h:27, include/CMakeLists.txt:1-4
Basis: checked, in the package or with a reference tool
Evidence: Depends: libtrust-store2 (= ${binary:Version}), ${misc:Depends} in Package: libtrust-store-dev; mir_agent.h:27: #include <wayland-client.h>; include/CMakeLists.txt installs the whole core directory, so that header is shipped.
Problem: A program that includes <core/trust/mir_agent.h> cannot be compiled with only this package and its dependencies installed, because wayland-client.h is in libwayland-dev. Policy 8.4 requires that installing the development package install all the development files needed to compile programs against the library.
Fix: Add libwayland-dev to the Depends of libtrust-store-dev (or stop installing mir_agent.h, whose agent is compiled out anyway).

minor packaging 3. trust-store-tests synopsis names the wrong library package (libtrust-store1) ◂

Files: debian/control
Basis: checked, in the package or with a reference tool
Evidence: Package: trust-store-tests, Description: Test files for libtrust-store1.
Problem: The runtime library package is libtrust-store2, as the package's own Depends on libtrust-store2 (= ${binary:Version}) shows. A wrong package name in the synopsis is shown by apt-cache, apt search and package pages and misleads users.
Fix: Description: Test files for libtrust-store2.

minor packaging 4. The installed trust-store.pc hardcodes libdir as ${exec_prefix}/lib, which is wrong in the multiarch directory ◂

Files: data/trust-store.pc.in:3, data/CMakeLists.txt:22-25, debian/libtrust-store-dev.install:3
Basis: checked, in the package or with a reference tool
Evidence: libdir=${exec_prefix}/lib in data/trust-store.pc.in, while the file is installed by install(FILES trust-store.pc DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig), i.e. /usr/lib/x86_64-linux-gnu/pkgconfig, and the library itself goes to the same triplet directory.
Problem: pkg-config --variable=libdir trust-store returns /usr/lib, not /usr/lib/x86_64-linux-gnu, so the file is not multiarch-aware and any consumer that uses that variable (or relies on the -L) is pointed at the wrong directory.
Fix: Generate libdir from @CMAKE_INSTALL_FULL_LIBDIR@ in a small quilt patch, or set it from CMAKE_INSTALL_LIBDIR at configure time.

minor packaging 5. debian/rules keeps a dead dpkg-vendor branch and forces DH_COMPAT=12 on one command while declaring compat 13 ◂

Files: debian/rules:9-12, debian/rules:24-25
Basis: checked, in the package or with a reference tool
Evidence: TRUST_STORE_MIR_AGENT_ENABLED = OFF followed by ifeq ($(shell dpkg-vendor --derives-from Ubuntu && echo yes),yes) / TRUST_STORE_MIR_AGENT_ENABLED = OFF; override_dh_auto_test: DH_COMPAT=12 dh_auto_test --no-parallel.
Problem: Both branches of the vendor test set the same value, so the ifeq cannot change anything and only runs dpkg-vendor on every build. DH_COMPAT in the environment is honoured in preference to the level declared in debian/control (Dh_Lib.pm, _load_compat_info), so the override runs one debhelper command at compat 12 while the package builds at 13; nothing dh_auto_test does for the cmake build system depends on the compat level, so the setting is dead and hides the declared level from later readers.
Fix: Delete the ifeq block, keep the plain TRUST_STORE_MIR_AGENT_ENABLED = OFF, and drop the DH_COMPAT=12 prefix.

minor packaging 6. debian/rules still provides a get-orig-source target and a lintian override suppresses the warning about it ◂

Files: debian/rules:28-30, debian/source/lintian-overrides:1-2
Basis: checked, in the package or with a reference tool
Evidence: get-orig-source: uscan --noconf --force-download --rename --download-current-version --destdir=.. and source: debian-rules-contains-unnecessary-get-orig-source-target [debian/rules].
Problem: Policy 4.9 has had no get-orig-source target since 4.1.4: 'The get-orig-source rules target has been removed. Packages should transition to debian/watch and use uscan where possible' (upgrading checklist A10.18). The package does have debian/watch, so the target only duplicates uscan, and the override hides the diagnostic instead of removing the cause.
Fix: Remove the get-orig-source target and the override line.

minor packaging 7. No manual pages for the three programs installed in /usr/bin ◂

Files: debian/trust-store-bin.install:1, src/CMakeLists.txt:348-360
Basis: checked, in the package or with a reference tool
Evidence: install(TARGETS trust-stored-skeleton ... trust-stored-stub ... trust-store-preseed RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}); debian/trust-store-bin.install takes usr/bin/trust*; the tree has no man pages and there is no debian/*.manpages.
Problem: trust-stored-skeleton, trust-stored-stub and trust-store-preseed are user-visible programs with no documentation in the package; Policy 12.1 says each program should have a manual page, and considers the lack of one a bug.
Fix: Write man pages for the three programs and install them with a debian/trust-store-bin.manpages file (or debian/manpages).

minor packaging 8. debian/ ships an unfinished licensecheck draft (copyright.in) and a UBports Jenkins pipeline file ◂

Files: debian/copyright.in:1-6, debian/Jenkinsfile:1
Basis: checked, in the package or with a reference tool
Evidence: Disclaimer: Autogenerated by licensecheck, Upstream-Name: FIXME, Copyright: NONE, License: UNKNOWN throughout debian/copyright.in; @Library('ubports-build-tools') _ in debian/Jenkinsfile.
Problem: Nothing in the package uses either file. copyright.in is a half-finished copyright file that contradicts debian/copyright (FIXME placeholders, UNKNOWN licences) and invites a later maintainer or a copyright checker to read the wrong file; the Jenkinsfile drives UBports' own Jenkins with a private shared library and has no meaning in Debian.
Fix: Delete debian/copyright.in and debian/Jenkinsfile.

minor packaging 9. debian/watch is in the old version 4 format ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

Inventory and notices: 258 files outside .pc/ and debian/ were listed; I read every file under src/ (57 files), include/ (10), tests/ (19), 3rd_party/xdg/ (6), data/, doc/, po/CMakeLists.txt and the four top-level files for notices, and grepped the whole tree for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/public domain/All rights reserved/GNU * Public.
Library and test code is LGPL-3 ('GNU Lesser General Public License version 3, as published by the Free Software Foundation', no 'or any later version') © 2013-2016 Canonical Ltd., plus src/core/trust/common/agent.cpp and agent.h © 2026 UBports Foundation; matches Files: *.
3rd_party/xdg/xdg.cpp, xdg.h and xdg_test.cpp are LGPL-3+ © 2015 Thomas Voss and match their stanza; the vendored code is linked statically into libtrust-store, and LGPL-3+ combined with LGPL-3 yields an LGPL-3 library, so the catch-all's LGPL-3 is correct for the result. No Debian package of vosst/xdg was found, so vendoring is not a duplicate.
data/CMakeLists.txt, doc/CMakeLists.txt and src/CMakeLists.txt are GPL-3 ('GNU General Public License version 3 as published') © 2013 Canonical Ltd. and are matched by their own stanza. They are build scripts only, not compiled into any binary, so there is no GPL-3/LGPL-3 compatibility question.
All 150 po/.po files say 'This file is distributed under the same license as the trust-store package' and name 'Rosetta Contributors and Canonical Ltd' with years 2014-2017 (some still carry the 'YEAR' placeholder); covered by the po/ stanza in the same licence. Translations added later through Weblate are covered by the same collective holder; only year drift, which is not noteworthy.
COPYING and 3rd_party/xdg/LICENSE are verbatim LGPL-3 texts (165/166 lines); they are the files reported above as attributed to the wrong holder, but their licence is correct and the full text is present in the package, so no licence text is missing.
data/trust-prompt.png is the prompt icon installed to /usr/share/icons/hicolor/512x512/apps; it has no internal notice and is covered by Files: *, which names Canonical Ltd. as the holder. Not opened (binary), and its dimensions were not checked.
No file states terms outside these licences: greps for 'All rights reserved', 'public domain', 'SPDX-License-Identifier' and 'Licensed under' found nothing, and the pre-scan reported no non-free wording. No file with no licence: the few without a header (symbols.map, po/CMakeLists.txt, include/CMakeLists.txt, tests/CMakeLists.txt, 3rd_party/xdg/CMakeLists.txt, data/trust-store.pc.in) fall under Files: *.
No prebuilt files: the pre-scan listed none and there is no object, library, bytecode, minified or PDF file in the tree; the only binary is the icon above.
debian/copyright is DEP-5 with the exact 1.0 Format URL, no Files-Excluded, complete stand-alone License paragraphs for GPL-3, LGPL-3 and LGPL-3+ and correct pointers to /usr/share/common-licenses.
Packaging files read in full: control, rules, changelog, copyright, copyright.in, source/format, source/lintian-overrides, all five .install files, upstream/metadata, salsa-ci.yml, Jenkinsfile. There are no patches, no maintainer scripts, no debian/tests and no debian/*.manpages.
Build-dependencies exist in the archive: libdbus-cpp-dev 5.0.6-6 and libprocess-cpp-dev 3.1.0-2 (both from the Debian UBports Team) are found by apt-cache; cmake-extras supplies FindCoverageReport/FindGMock/FindGettext which CMakeLists uses.
debhelper compat 13 with a bare %: dh $@; the override_dh_auto_test is skipped under DEB_BUILD_OPTIONS=nocheck by dh itself at this level, so no check is needed in the target. Building in-source with cmake, hardening=+all is passed through by dh_auto_build.
Standards-Version 4.7.4 is the version of the Policy manual on the reviewing system (upgrading checklist A10.2), so it is current.
Library packaging: SOVERSION 2 matches the libtrust-store2 package name, Multi-Arch: same is consistent with the shlibs-based dependencies, and the version script symbols.map is used to export only core::trust::*.
libtrust-store-doc installs the doxygen HTML at /usr/share/doc/trust-store/html (upstream's CMAKE_INSTALL_DOCDIR) while dh_installdocs gives the package /usr/share/doc/libtrust-store-doc; unconventional, but no file is installed into another package's directory, so not a policy violation.
The debian/ directory is maintained upstream too (ChangeLog: 'debian: Ship new files for standalone trust prompts'), which is where debian/Jenkinsfile and debian/copyright.in come from; the package is separately maintained on salsa.debian.org.
uscan found the packaged version as the newest upstream release (upstream 2.0.3, packaged 2.0.3).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3, LGPL-3).

Not confirmed ◂

No autopkgtest: the tests are built and shipped in trust-store-tests instead. Whether they pass in a clean chroot was not checked, and cannot be without running them.
Homepage says https://gitlab.com/ubports/core/trust-store while debian/upstream/metadata gives .../ubports/development/core/trust-store; one may redirect to the other, which needs network access to tell.
Whether data/trust-prompt.png is really 512x512 (the hicolor directory it is installed into) was not checked, as the file was not opened.

Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Source: https://gitlab.com/ubports/development/core/@PACKAGE@/tags?sort=updated_desc
Matching-Pattern: -/archive/v?\d[\d.]+/@PACKAGE@-@ANY_VERSION@@ARCHIVE_EXT@
Searchmode: plain

Uploader's response to the LLM review

The uploader was emailed about the review 4 hours ago.

Back to Dashboard | View all reviews for this package