DFSG NEW review for vendor-ubuntu-touch version 0.1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 2 blocker, 0 important, 0 minor
• debian/watch: absent (native package)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The code is free (GPL-2-or-later, DFSG-compliant), but debian/copyright is not accurate: its Files: * stanza attributes the whole upstream tree to Thorsten Alteholz alone, while UbuntuTouch.pm's own header names Ian Jackson, Canonical Ltd. (Colin Watson), James Westby and Raphaël Hertzog, and it declares the file GPL-2 only although the notice grants version 2 or any later version.

Packaging

Small, clean packaging: debhelper compat 14 with a bare dh $@, four well-split arch:all binary packages, files installed to the paths dpkg's vendor mechanism expects, current Standards-Version, sound changelog, no patches and nothing for dh_missing to complain about. The split of the vendor class into vendor-ubuntu-touch-dpkg-hook is deliberate and dpkg degrades correctly when a vendor file has no module.

Issues

1. [blocker] [licensing] debian/copyright does not name the four upstream holders of UbuntuTouch.pm (Ian Jackson, Canonical Ltd., James Westby, Raphaël Hertzog)

• Files: UbuntuTouch.pm:1-6, debian/copyright:4-6
• Basis: checked, in the package or with a reference tool
• Evidence: UbuntuTouch.pm:1 # Copyright © 2008 Ian Jackson <ijackson@chiark.greenend.org.uk>, :2 # Copyright © 2008 Canonical, Ltd. (:3 written by Colin Watson <cjwatson@ubuntu.com>), :4 # Copyright © 2008 James Westby <jw+debian@jameswestby.net>, :5 # Copyright © 2009 Raphaël Hertzog <hertzog@debian.org>; debian/copyright Files: * / Copyright: 2026 Thorsten Alteholz
• Problem: The only upstream source file is a derivative of dpkg's Dpkg::Vendor::Ubuntu, and its header lists four holders besides the packager. Files: * names only 2026 Thorsten Alteholz, so the copyright file misstates the provenance of the code and omits holders DEP-5 requires (copyright-format 5.2: the Copyright field is required for each Files stanza; Policy 12.5 requires the copyright information to be included). The prescan flagged exactly these four names.
• Fix: Add a stanza (e.g. Files: UbuntuTouch.pm) listing 2008 Ian Jackson <ijackson@chiark.greenend.org.uk>, 2008 Canonical, Ltd. with 2008 Colin Watson <cjwatson@ubuntu.com>, 2008 James Westby <jw+debian@jameswestby.net>, 2009 Raphaël Hertzog <hertzog@debian.org> and 2026 Thorsten Alteholz <debian@alteholz.de>.

2. [blocker] [licensing] UbuntuTouch.pm is GPL-2-or-later but debian/copyright says GPL-2 (no "or later")

• Files: UbuntuTouch.pm:8-10, debian/copyright:7,13
• Basis: checked, in the package or with a reference tool
• Evidence: UbuntuTouch.pm:9-10 it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. versus License: GPL-2 in both Files stanzas
• Problem: The short name GPL-2 describes version 2 only, while the file grants GPL-2+; DEP-5 6.7/7.1 require the short name to match the grant, and a wrong one makes the file's permissions (and its compatibility with GPL-3 code) misstated.
• Fix: Use License: GPL-2+ for UbuntuTouch.pm, keeping the GPL-2 text pointer in a stand-alone License stanza for GPL-2+.

Verified

• Inventoried the whole tree (4 upstream files plus debian/): ubuntutouch, ubuntutouchdebian, ubuntutouchubuntu (dpkg origins data files, no copyright or licence notice of their own, covered by Files: *) and UbuntuTouch.pm (GPL-2+ notice, handled in the issues above).
• debian/copyright is DEP-5 with the canonical Format URL; the Files: debian/* stanza comes after Files: *, so the packaging is correctly attributed to Thorsten Alteholz. The GPL-2 pointer to /usr/share/common-licenses/GPL-2 is valid.
• Prescan's four "missing holders" all belong to UbuntuTouch.pm and are reported as one licensing issue; no other file carries a copyright notice.
• UbuntuTouch.pm derives from dpkg's own GPL-2+ Dpkg::Vendor::Ubuntu; GPL-2+ code combining with GPL-2 data raises no compatibility problem.
• Packaging files: debian/{changelog,control,copyright,rules,source/format} and four .install files; no patches, no maintainer scripts, no tests directory, nothing else to review.
• debhelper compat 14 with dh $@; each of the four upstream files is installed by one of the .install files, so dh_missing has no uninstalled files, and debhelper fills ${shlibs:Depends}/${misc:Depends} and the automatic relationship substvars at this compat level.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool): first two components match, so current.
• Changelog: single 0.1 entry, distribution unstable, urgency low, date Sat 24 Oct 2026, maintainer matching debian/control; native 3.0 format fits a package with no separate upstream.
• The origins-only packages name vendors UbuntuTouchDebian and UbuntuTouchUbuntu, for which no module is shipped; read /usr/share/perl5/Dpkg/Vendor.pm: get_vendor_object() tries the module, then falls back to the origins file's Parent: (Debian/Ubuntu), so dpkg does not fail — not a fault.
• The module hardcodes /usr/share/keyrings/ubports-keyring.gpg, which no Debian package ships (apt-cache), but /usr/share/perl5/Dpkg/Source/Package.pm:check_signature only adds keyrings that pass -r and reports skipping absent keyring, so the missing file is inert and does not break source or build operations.
• The module goes to /usr/share/perl5/Dpkg/Vendor/ (arch-independent, already in @INC) and depends on libdpkg-perl, which ships Dpkg::Vendor::Debian that it subclasses.
• There is no debian/watch, and the package is native, so none is needed.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed

• No build or installation was run; the vendor lookup fallback and keyring handling were read from the installed dpkg Perl modules rather than exercised.

Proposed changes

None.