vielotus 2.0.1-1

Package Information

Description	VieLotusIM (Sen Viet) Vietnamese Input Method shared C-ABI core Shared C-ABI engine library (libVieLotusCAPI.so) implementing the VieLotusIM (Sen Viet) Vietnamese syllable state machine, SEN Flex free-tone Telex/VNI composition, and Smart Bilingual (English-Vietnamese) collision resolution. Built natively from C++20 source with zero external runtime dependencies beyond the standard C/C++ runtime.
Maintainer	Trần Phát Đạt (Steve Dat) <ttd1232004@gmail.com>
Changed By	Trần Phát Đạt (Steve Dat) <ttd1232004@gmail.com>
Sponsor	byang@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://github.com/stevedat/VieLotus-IM.git (browse)
Closes	#1152533
Tracker	https://tracker.debian.org/pkg/vielotus
Uploaded	3 hours ago

New Package Report

.changes◂

Version	2.0.1-1
Changed-By	Trần Phát Đạt (Steve Dat) <ttd1232004@gmail.com>
Architecture	source amd64 all
Distribution	unstable
Date	Mon, 02 Nov 2026 06:00:00 +0700
Source	vielotus

Changelog◂

vielotus (2.0.1-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1152533)
   * Official multi-arch (amd64 & arm64) release of Sen Việt (VieLotusIM).
   * Unobfuscated C++20 native engine with canonical UTF-8 (Unicode NFC)
     lexicon wordlists and build-time FNV-1a table generation (DFSG #2).
   * Native Fcitx5 addon (vielotus-telex, vielotus-vni) and IBus engine.
   * Ubuntu Language Support auto-registration for Vietnamese (vi).

.dsc◂

Priority	optional
Component	main
Package-List	fcitx5-vielotus deb utils optional arch=any ibus-vielotus deb utils optional arch=any libvielotus0 deb libs optional arch=any vielotus deb metapackages optional arch=all
Section	utils

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: VieLotusIM
Upstream-Contact: Trần Phát Đạt (Steve Dat) <ttd1232004@gmail.com>
Source: https://github.com/stevedat/VieLotus-IM

Files: *
Copyright: 2026 Trần Phát Đạt (Steve Dat) <ttd1232004@gmail.com>
License: Expat

Files: Sources/VieLotusCoreWindows/*
Copyright: 2026 Trần Phát Đạt (Steve Dat) <ttd1232004@gmail.com>
License: Expat
Comment:
 Directly maintained unobfuscated C++20 desktop/Linux engine
 (WindowsNativeEngine.{h,cpp}), canonical UTF-8 (Unicode NFC) Vietnamese
 phonotactic and English collision-escape wordlists (lexicon/*.txt,
 consolidated and bit-for-bit verified from upstream's pre-2.0.1 lookup tables
 and now maintained directly as canonical upstream source — see
 Sources/VieLotusCoreWindows/lexicon/README.md), and deterministic offline
 64-bit FNV-1a build-time table generator (scripts/generate_lexicon_hashes.py).

Files: CrossPlatform/packaging/linux/org.vielotus.VieLotus.metainfo.xml
Copyright: 2026 Trần Phát Đạt (Steve Dat) <ttd1232004@gmail.com>
License: FSFAP

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: FSFAP
 Copying and distribution of this file, with or without modification,
 are permitted in any medium without royalty provided the copyright
 notice and this notice are preserved.  This file is offered as-is,
 without any warranty.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 4 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for vielotus version 2.0.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 4 minor
debian/watch: old format (version 4)
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The whole source has one copyright holder, Trần Phát Đạt (Steve Dat), and is MIT/Expat throughout: LICENSE is the Expat text, Sources/VieLotusCoreWindows/WindowsNativeEngine.cpp carries 'SPDX-License-Identifier: MIT', and generate_lexicon_hashes.py and the generated .inc both say 'License: Expat (MIT)'. debian/copyright is DEP-5 with the correct Format line, states that in Files: * with the full licence text, and correctly carves out the one file under a different licence, CrossPlatform/packaging/linux/org.vielotus.VieLotus.metainfo.xml, as FSFAP (which that file itself declares as <metadata_license>FSFAP</metadata_license>) with the FSFAP text given. Nothing in the tree is non-free, and the only generated file has its generator and inputs shipped. The prescan's holder check found no unnamed holder, and I confirmed that: the only name in any notice is the one Files: * gives.

Packaging

A clean, conventional wrap: debhelper-compat 13 with a plain 'dh $@' plus overrides, four packages (the C-ABI shared library, the IBus engine, the Fcitx5 addon, and an architecture: all metapackage), Rules-Requires-Root: no, a DEP-5 copyright, debian/upstream/metadata, no patches, and Standards-Version 4.7.4, current against Policy 4.7.4.1. The rules build each component out of tree with CMake/Ninja and install every file the packaging references; dh's own build-flag export reaches those manual cmake calls, so the hardening=+all setting is effective. Three minor defects: a predictable /tmp fallback directory in the installed settings script, the metapackage Recommending both engines, and help text that names a 'vielotus' command no package provides.

Issues

minor packaging 1. vielotus-settings falls back to a predictable world-writable /tmp directory and writes its config there ◂

Files: CrossPlatform/packaging/linux/vielotus-settings:7-15, debian/rules:56-57
Basis: checked, in the package or with a reference tool
Evidence: CONFIG_DIR="${CONFIG_ROOT}/vielotus" ... if [ ! -w "${CONFIG_DIR}" ]; then CONFIG_DIR="/tmp/vielotus-cfg-${UID_CUR}" mkdir -p "${CONFIG_DIR}" 2>/dev/null || true fi CONFIG_FILE="${CONFIG_DIR}/config.env" / LOG_FILE="${CONFIG_DIR}/settings.log"
Problem: The script is installed as /usr/bin/vielotus-settings (debian/rules installs it into ibus-vielotus) and, whenever ~/.config/vielotus is not writable, creates /tmp/vielotus-cfg-, a name any local user can predict and create first — as a directory of their own or as a symlink to a directory the victim can write. It then creates/truncates config.env and settings.log and rewrites config.env through save_and_apply without ever checking the directory's owner or permissions, so another local user can redirect those writes into a file of their choosing in the victim's home. Nothing in the package sets TMPDIR-style isolation or uses mktemp.
Fix: Create the fallback with CONFIG_DIR=$(mktemp -d "${TMPDIR:-/tmp}/vielotus-cfg.XXXXXXXX") (mode 0700) and remove it on exit, or drop the fallback and report that the configuration directory is not writable.

minor packaging 2. The vielotus metapackage Recommends both engines, so installing it pulls in Fcitx5 on an IBus system and vice versa ◂

Files: debian/control:44-46
Basis: checked, in the package or with a reference tool
Evidence: Package: vielotus / Depends: ibus-vielotus (>= ${source:Version}) | fcitx5-vielotus (>= ${source:Version}), ${misc:Depends} / Recommends: ibus-vielotus, fcitx5-vielotus
Problem: Its own Depends already expresses the choice between the two engines, but front-ends install Recommends by default, so apt install vielotus on GNOME installs fcitx5-vielotus and hence the whole fcitx5 stack (and on KDE, the IBus engine and ibus) — the 'and/or' the package description promises becomes 'both'. Policy 7.2 says Recommends should list packages found together with this one in all but unusual installations, which the alternative engine is not.
Fix: Drop the Recommends (the Depends alternative is enough), or move both to Suggests.

minor packaging 3. Installed help text and the IBus engine's fallback invoke a 'vielotus' command that no binary package ships ◂

Files: CrossPlatform/packaging/linux/vielotus-settings:923-925, CrossPlatform/ibus-vielotus/src/main.c:633-635
Basis: checked, in the package or with a reference tool
Evidence: echo " • Chuyển sang Telex : vielotus --telex" / echo " • Kiểm tra cấu hình : vielotus --status" and g_spawn_command_line_async("vielotus", NULL);
Problem: debian/rules installs only libVieLotusCAPI.so, the fcitx5 addon, ibus-engine-vielotus, vielotus-settings, the .desktop, metainfo, man page and icons; the binary package named vielotus is an empty metapackage. A user who runs vielotus-settings without a graphical session is therefore told to run three commands that do not exist, and the IBus engine's 'more-settings' fallback spawns a program that is not installed. The engine package's own man page and option parser, by contrast, document and implement vielotus-settings --telex/--vni/--activate/--status.
Fix: Change the help lines to vielotus-settings --telex / --vni / --status, and either drop the vielotus fallback in main.c or point it at the settings tool (as the same code already does for /usr/bin/vielotus-settings).

minor packaging 4. debian/watch is in the old version 4 format ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

debian/copyright read in full: DEP-5, Format line exactly the 1.0 URL, Upstream-Name/Source/Upstream-Contact present, a Files: * stanza (Expat) and two further Files stanzas, plus stand-alone License paragraphs for Expat and FSFAP. No Files-Excluded, and no repack, so nothing is claimed to have been removed.
Licence evidence collected over the whole tree (Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU/Lesser/Apache/MPL, public domain, All rights reserved, MIT License): every hit is the single Expat/MIT statement of the one holder. No other licence notice exists anywhere in the tree.
Files: * covers debian/*, README.md, Resources/typing-modes.yml, Sources/VieLotusCAPI/include/vielotus.h and the CrossPlatform CMake/conf/desktop/man/settings files, none of which carries its own notice; the same terms apply, so no separate stanza is needed.
The only differently licensed file, CrossPlatform/packaging/linux/org.vielotus.VieLotus.metainfo.xml, is correctly carved out as FSFAP: the file itself has <metadata_license>FSFAP</metadata_license> and the FSFAP text is reproduced in debian/copyright (it is not in /usr/share/common-licenses). Expat and FSFAP are both DFSG-free and compatible.
Sources/VieLotusCoreWindows/prebuilt/VieLotusLexicon/WindowsNativeLexiconGenerated.inc is a generated file, not an opaque one: headers name it as generated from lexicon/*.txt by scripts/generate_lexicon_hashes.py, both are in the tree, capi-native/CMakeLists.txt regenerates it into the build directory and never puts prebuilt/ on the include path. Its preferred form for modification is present.
No compiled artefacts in the tree: the tree contains only text sources plus 12 PNG icons under CrossPlatform/linux-icons/ (790 B to 249 kB, a normal icon set of upstream artwork, covered by Files: ); the four status_indicators/.png are not installed by debian/rules, the eight hicolor_*_apps/vielotus.png are. Nothing else binary, no PDF, no minified code, no archives.
The prescan found no copyright holder missing from debian/copyright, and I confirmed that the only holder anywhere in the tree is Trần Phát Đạt (Steve Dat) ttd1232004@gmail.com, as named in Files: *.
No orphaned or mismatched build input: every path debian/rules and the three CMakeLists.txt files reference exists, and the library header Sources/VieLotusCAPI/include/vielotus.h implements the C API that WindowsNativeEngine.cpp exports (VIELOTUS_CAPI_EXPORT with attribute((visibility("default"))) under -fvisibility=hidden).
debian/rules: dh_auto_configure and dh_auto_test are not overridden but are no-ops because the source root has no build system (Dh_Buildsystems autoselect returns nothing), so nothing there can fail; the overrides build and install all three components, and dh_clean still runs. DEB_BUILD_MAINT_OPTIONS=hardening=+all is effective: Dh_Lib::setup_buildenv exports dpkg-buildflags' CFLAGS/CXXFLAGS/LDFLAGS into the environment, which the manual cmake invocations pick up.
Build-Depends spot-checked against the archive: fcitx5-modules-dev, libfcitx5core-dev and the other fcitx5/ibus/glib dev packages exist and provide what the CMakeLists find_package/pkg_check_modules calls ask for; python3:any is the plain host-architecture dependency build-dependencies already default to, so it is redundant rather than wrong.
The lintian override libvielotus0: package-name-doesnt-match-sonames hides a deliberate naming choice (soname libVieLotusCAPI.so.0, package libvielotus0) for a library only these two engines link against; Policy 8.1 makes the soname-derived name the normal case but states the package name 'need not' follow it, and the override documents the deviation, so it is not reported.
debian/ contains exactly changelog, control, copyright, libvielotus0.lintian-overrides, rules, source/format, upstream/metadata and watch (checked against vielotus_2.0.1-1.debian.tar.xz): no patches, no tests, no maintainer scripts, so there is nothing else to review; changelog is 2.0.1-1, unstable, closes #1152533, with a valid date and signature/format.
uscan found the packaged version as the newest upstream release (upstream 2.0.1, packaged 2.0.1).

Not confirmed ◂

I did not build the package or run vielotus-settings, the IBus engine or the Fcitx5 addon, so their runtime behaviour is inferred from the source and the packaging only.
The 12 PNG icons were judged by name, size and location only; I did not open them, so their artwork cannot be checked for third-party origin beyond the licence statement in debian/copyright.

Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Template: Github
Dist: https://github.com/stevedat/VieLotus-IM
Update-Script: uupdate

Uploader's response to the LLM review

The uploader was emailed about the review 1 hour ago.

Back to Dashboard | View all reviews for this package