venus-protocol 1.1.3-1

Package Information

Description	Venus Vulkan protocol headers for VirtIO GPU Venus protocol defines the Vulkan protocol used by the Venus Vulkan driver for VirtIO GPU.
Maintainer	Debian X Strike Force <debian-x@lists.debian.org>
Changed By	Timo Aaltonen <tjaalton@debian.org>
Sponsor	tjaalton@ubuntu.com
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/xorg-team/vulkan/venus-protocol.git (browse)
Closes	#1153795
Tracker	https://tracker.debian.org/pkg/venus-protocol
Uploaded	1 hour ago

New Package Report

.changes◂

Date	Thu, 12 Nov 2026 07:15:47 +0200
Source	venus-protocol
Version	1.1.3-1
Changed-By	Timo Aaltonen <tjaalton@debian.org>
Architecture	amd64 source
Distribution	unstable

Changelog◂

venus-protocol (1.1.3-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1153795)

.dsc◂

Priority	optional
Component	main
Package-List	venus-protocol-dev deb libdevel optional arch=any
Section	libdevel

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://gitlab.freedesktop.org/virgl/venus-protocol
Upstream-Name: venus-protocol
Upstream-Contact: Yiwei Zhang <zzyiwei@chromium.org>

Files:
 *
Copyright:
 2022 Google LLC
 2022 Collabora Ltd.
License: MIT

Files:
 include/*
Copyright:
 2015-2023 LunarG, Inc.
 2015-2023 Valve Corporation
 2015-2026 The Khronos Group Inc.
License: Apache-2.0

Files:
 xmls/VK_EXT_command_serialization.xml
 xmls/VK_MESA_venus_protocol.xml
Copyright:
 2020 Google LLC
License: Apache-2.0

Files:
 xmls/vk.xml
Copyright:
 2015-2026 The Khronos Group Inc.
License: Apache-2.0

Files:
 debian/*
Copyright:
 2026 Timo Aaltonen <tjaalton@debian.org>
License: MIT

License: Apache-2.0
 On Debian systems, the complete text of the Apache License version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included
 in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
 THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for venus-protocol version 1.1.3-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The licensing is DFSG-compliant: the tree is MIT (Google/Collabora code, templates, tests, generators) and Apache-2.0 (the vendored Khronos Vulkan headers and XML registries, which are actually offered under Apache-2.0 OR MIT), both licences are free and mutually compatible, the MIT text is reproduced in debian/copyright and Apache-2.0 is correctly referenced from /usr/share/common-licenses, and every copyright holder present in the tree is named. The only gap is accuracy, not freedom: the four Khronos stanzas record only Apache-2.0 and omit the MIT alternative the files also grant.

Packaging

Most of the packaging is clean: a minimal dh rules file, meson build system, 3.0 (quilt) with no patches, current Standards-Version, sane changelog and Vcs-*/upstream metadata. The one real defect is that venus-protocol-dev installs headers which unconditionally include the Vulkan headers but the package declares no dependency on libvulkan-dev, so it cannot be used to compile anything unless libvulkan-dev happens to be installed.

Issues

important packaging 1. venus-protocol-dev does not depend on libvulkan-dev although its headers include <vulkan/vulkan.h> ◂

Files: debian/control:18-19, debian/venus-protocol-dev.install:1, templates/driver_defines.h:13, templates/renderer_defines.h:16
Basis: checked, in the package or with a reference tool
Evidence: The installed headers are generated from templates/driver_defines.h (#include <vulkan/vulkan.h>) and templates/renderer_defines.h (#include "vulkan/vulkan.h"), and every generated command header includes one of them; debian/control has only Depends: / ${misc:Depends},.
Problem: Any consumer of venus-protocol-dev pulls in vn_protocol_driver_defines.h or vn_protocol_renderer_defines.h and therefore needs the Vulkan headers, which Debian ships in libvulkan-dev (verified with apt-cache: libvulkan-dev provides /usr/include/vulkan). The vendored copy under include/vulkan is not installed; meson.build installs only the generated headers and the .pc file. Policy 3.5 requires a package to declare the packages required for it to work correctly, and Policy 8.4 puts the same requirement on -dev packages: installing venus-protocol-dev alone leaves a header set that cannot be compiled. The trailing comma in the Depends field marks where the entry appears to have been dropped.
Fix: Add libvulkan-dev to Depends, e.g. Depends: libvulkan-dev, ${misc:Depends}, without the trailing comma. Optionally have upstream add requires: 'vulkan' to the pkg.generate call so the .pc file carries the requirement too.

minor licensing 2. debian/copyright records include/* and xmls/* as Apache-2.0 only, while those files are Apache-2.0 OR MIT ◂

Files: debian/copyright:19, debian/copyright:26, debian/copyright:32, include/vulkan/vulkan_core.h:7, include/vk_video/vulkan_video_codec_h264std.h:7, xmls/vk.xml:5, xmls/VK_EXT_command_serialization.xml:6, xmls/VK_MESA_venus_protocol.xml:6
Basis: checked, in the package or with a reference tool
Evidence: Every include/vulkan/*.h, every include/vk_video/*.h and all three xmls/*.xml carry SPDX-License-Identifier: Apache-2.0 OR MIT, but the three stanzas covering them say License: Apache-2.0.
Problem: The Files stanzas give only one of the two licences the files offer, so the stated terms are incomplete (copyright-format 6.7: a Files stanza's License field gives the licensing terms of the listed files). Choosing Apache-2.0 keeps the package DFSG-free, so this is not a licensing problem, but debian/copyright does not describe what the upstream notices actually grant.
Fix: Change the License: of the include/* and the three xmls/* stanzas to Apache-2.0 or MIT; the stand-alone MIT stanza needed for it is already present.

Verified ◂

Prescan accounted for: it listed no files and no missing holders (79 files scanned, every holder found is named in debian/copyright); no built binaries, minified code, PDFs or non-free licence wording were found, and the tree is entirely text.
Header survey: include/vulkan/.h and include/vk_video/.h are Copyright ... The Khronos Group Inc. (plus Valve/LunarG in vk_icd.h and vk_layer.h) under SPDX-License-Identifier: Apache-2.0 OR MIT; xmls/.xml are Google/Khronos Apache-2.0 OR MIT; meson.build, vn_protocol.py, vkxml.py, utils/.py, templates/* and tests/* are Google (plus Collabora in templates/renderer_util.h) under SPDX-License-Identifier: MIT.
Files with no notice of their own (README, TODO, .gitignore, .gitlab-ci.yml, templates/banner.in, docs/VK_EXT_command_serialization.txt, utils/update_vk_xml.sh) fall under the Files: * MIT stanza and are project files of the same upstream; a search for GPL/LGPL/MPL/BSD/CC/zlib wording found no other licence anywhere in the tree.
include/ (with vk_video/) is a vendored snapshot of Vulkan-Headers, refreshed per README and utils/update_vk_xml.sh; meson.build installs only the generated vn_protocol_*.h and the .pc file, so these third-party headers are build inputs only and are not duplicated in the binary.
The installed generated headers have their preferred form for modification in the source package: vn_protocol.py, vkxml.py, templates/ and xmls/ are all shipped and are the declared meson inputs.
MIT and Apache-2.0 are DFSG-free and compatible; /usr/share/common-licenses/Apache-2.0 exists on the reviewing system and debian/copyright's MIT text matches the notices in the tree.
debian/rules uses the dh sequencer; debhelper reports compat 13, at which dh_missing defaults to --fail-missing, and the only installed trees are usr/include and usr/lib/*/pkgconfig/venus-protocol.pc.
No debian/patches, no maintainer scripts and no debian/tests; tests/meson.build builds a vn_protocol_tests executable but registers no meson test(), so dh_auto_test runs nothing that could fail on a clean build.
Standards-Version 4.7.4 shares its first two components with the reviewing system's Policy 4.7.4.1 and is therefore current; changelog 1.1.3-1 targets unstable and closes #1153795; Vcs-Git/Vcs-Browser and debian/upstream/metadata agree with Homepage.
debian/watch was not reviewed, as it is checked separately.
uscan found the packaged version as the newest upstream release (upstream 1.1.3, packaged 1.1.3).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

meson's vcs_tag runs git rev-parse while Build-Depends does not list git; the fallback to the project version in a git-less sbuild tree was not verified (it is implied by the package having been built without git in Build-Depends).
Whether meson installs venus-protocol.pc under /usr/lib//pkgconfig as the install file's wildcard expects; I did not run a build, and this rests on meson's Debian libdir default.

Proposed changes ◂

None.

Uploader's response to the LLM review

fixes pushed to https://salsa.debian.org/xorg-team/vulkan/venus-protocol/-/commits/debian/latest?ref_type=HEADS

— Timo Aaltonen (tjaalton), 0 hours ago

Back to Dashboard | View all reviews for this package