Review: volio 0.0.0~dev1-1

Package Information

Description	API to load/save tomography volumes at ESRF Volume load/save for tomography data at ESRF. Volio reads and writes tomography reconstruction volumes stored in several formats: HDF5 (HDF5Volume) single frame EDF (EDFVolume) single frame or multi-frame TIFF (TIFFVolume, MultiTIFFVolume) JPEG2000 (JP2KVolume) raw / .vol (RawVolume) It also provides utilities to guess volumes from a file or folder, concatenate volumes, and map reconstruction metadata to the drac/icat data-portal metadata model.
Maintainer	Debian PaN Maintainers <debian-pan-maintainers@alioth-lists.debian.net>
Changed By	Roland Mas <lolando@debian.org>
Sponsor	lolando@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/python-team/packages/volio.git (browse)
Tracker	https://tracker.debian.org/pkg/volio
Uploaded	25 days ago

New Package Report

.changes◂

Architecture	source all
Distribution	unstable
Date	Tue, 13 Oct 2026 17:55:33 +0200
Source	volio
Version	0.0.0~dev1-1
Changed-By	Roland Mas <lolando@debian.org>

Changelog◂

volio (0.0.0~dev1-1) unstable; urgency=low
 .
   * Initial packaging.

.dsc◂

Priority	optional
Component	main
Package-List	python3-volio deb python optional arch=all
Section	python

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: volio
Upstream-Contact: data analysis unit <henri.payno@esrf.fr>
Source: https://gitlab.esrf.fr/tomotools/volio

Files: *
Copyright: (c) European Synchrotron Radiation Facility (ESRF)
License: MIT

Files: debian/*
Copyright: 2026 Roland Mas <lolando@debian.org>
License: MIT

License: MIT
 .
 The volio library goal is to provide a python interface to read ESRF tomography dataset.
 .
 volio is distributed under the MIT license.
 .
 The MIT license follows:
 .
 Copyright (c) European Synchrotron Radiation Facility (ESRF)
 .
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in
 the Software without restriction, including without limitation the rights to
 use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
 the Software, and to permit persons to whom the Software is furnished to do so,
 subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
 FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
 COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 4 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 24 days ago.

Report◂

DFSG NEW review for volio version 0.0.0~dev1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 4 minor
debian/watch: version 5
debian/copyright: machine-readable

Licensing

Every upstream file is MIT, held by ESRF: the only notices in the tree are LICENSE (MIT, "Copyright (c) European Synchrotron Radiation Facility (ESRF)"), license = "MIT" in pyproject.toml, and copyright = "2026, ESRF" in doc/conf.py; no source file carries a conflicting or additional licence. debian/copyright is DEP-5 with the correct Format, a Files: * stanza (ESRF, MIT), a debian/* stanza (Roland Mas, MIT, later so it overrides), and a full MIT text paragraph (MIT is not in /usr/share/common-licenses, so the text is required and present). No non-free terms, no missing licences, no sourceless binaries (no .so/.jar/.pyc/minified JS; the only binaries are the ESRF project logos and an Inkscape SVG), and nothing asks the reviewer to fetch anything. No errors found.

Packaging

The packaging is essentially good: debian/copyright, Source/Section/Maintainer/Uploaders, Vcs-* pointing at salsa, Standards-Version 4.7.4 (current is 4.7.4.1), debhelper-compat 14 with a clean dh/pybuild rules file, 3.0 (quilt) with no patches, changelog in order and targeted at unstable, and all runtime imports map to existing Debian python3-* packages (python3-tomobase is built by the tomobase upload in NEW). The only things a sponsor would ask for are small: two directly imported modules are not named in Build-Depends, one declared Build-Depends is unused, the conf.py deletion in rules masks an upstream packaging quirk, and there is no autopkgtest.

Issues

minor packaging 1. Build-Depends omits python3-fabio and python3-packaging, which the package imports ◂

Files: debian/control (Build-Depends, lines 8-24); volio/volumes/edfvolume.py:10; volio/volumes/jp2kvolume.py:10
Evidence: volio/volumes/edfvolume.py:10 import fabio and volio/volumes/jp2kvolume.py:10 from packaging.version import parse as parse_version; volio/volumes/__init__.py imports both modules, so import volio needs fanio/packaging; only python3-silx in Build-Depends pulls them in (its Depends list python3-fabio, python3-packaging). Also python3-numpy, declared as <!nocheck>, is listed in pyproject [build-system] requires.
Problem: Imports needed at test-build time are satisfied only transitively through python3-silx. Debian practice (and the Python team's) is to declare every module the tests import; a change in python3-silx's dependencies would break the build with no hint in this package.
Fix: Add python3-fabio <!nocheck> and python3-packaging <!nocheck> to Build-Depends (and make python3-numpy unconditional if the build backend truly needs it).

minor packaging 2. python3-zarr is an unused Build-Depends ◂

Files: debian/control:23 (python3-zarr <!nocheck>)
Evidence: No zarr import anywhere in the tree or the tests; in pyproject it is only an optional extra (full_no_compression_plugins = [..., "zarr"], tifffile[zarr]).
Problem: It is installed for every build for no purpose, slowing builds and adding a delta no test uses.
Fix: Drop python3-zarr from Build-Depends, or add a test that actually exercises the Zarr path if one is intended.

minor packaging 3. debian/rules deletes installed conf.py to work around upstream packaging of doc/ ◂

Files: debian/rules:10-11
Evidence: execute_after_dh_auto_install:\n\tfind debian -name conf.py -delete
Problem: Upstream's [tool.setuptools.packages.find] where = ["."] uses setuptools' default namespace discovery, so the doc/ directory (which has no __init__.py but contains conf.py) is treated as a namespace package and its conf.py lands in the global site-packages directory; deleting the file afterwards leaves at best an empty doc/ directory in the package and is a symptom rather than a fix.
Fix: Exclude it from the start: e.g. ask upstream for [tool.setuptools.packages.find] include = ["volio*"] in pyproject.toml, or override dh_auto_install to remove the whole debian/python3-volio/usr/lib/python3*/dist-packages/doc directory. Could not confirm the exact installed tree without building (see unconfirmed).

minor packaging 4. No autopkgtest ◂

Files: debian/tests/ (absent); debian/control (no Testsuite field)
Evidence: pybuild runs the unit tests at build time (PYBUILD_TEST_ARGS=-m 'not needs_network' -vv), but there is no debian/tests/control and no Testsuite: field.
Problem: A new Python library should ship an autopkgtest so the installed module is exercised on the archive's test runners and after transitions; without it regressions are only caught by rebuilds.
Fix: Add Testsuite: autopkgtest-pkg-python to the source stanza and a debian/tests/control with Tests: python3 (plus Depends: @, python3-pytest and the modules the tests import).

Verified ◂

Licence inventory: grepped the whole tree (excluding .pc) case-insensitively for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU General Public/GNU Lesser/Apache License/Mozilla Public/public domain/All rights reserved and read every LICENSE/COPYING/NOTICE/AUTHORS match (only the top-level LICENSE). Notices appear only in LICENSE (MIT, ESRF), doc/conf.py:27 (copyright = "2026, ESRF"), pyproject.toml:12 (license = "MIT") and debian/copyright; the single Files: * MIT stanza plus debian/* stanza therefore covers every file accurately.
Read all of debian/: control, rules, changelog (0.0.0~dev1-1, unstable, no bug closures), copyright, source/format (3.0 (quilt)), source/options and python3-volio.docs; debian/patches does not exist, so zero patches and no DEP-3 questions.
debian/copyright starts with the exact copyright-format 1.0 Format line and includes the full MIT text (required, since MIT is not in /usr/share/common-licenses); Files: * precedes debian/*, so the ordering is correct.
Checked build/runtime dependencies against the archive: python3-fabio, python3-packaging, python3-pint, python3-tifffile, python3-zarr, python3-glymur, python3-dicttoxml all exist; python3-silx Depends on python3-fabio/python3-packaging (so the tests' transitive needs are met at build time); python3-tomobase is built by the tomobase upload waiting in NEW, so its absence from the archive is not a fault.
No network access in the tests: grepped volio/tests for socket/urlopen/urllib/requests/pooch/http/ftp — no matches, so -m 'not needs_network' (a marker that appears nowhere in the tree) is a no-op rather than hiding a test.
No sourceless artefacts: the orig tarball is a git archive of the named commit with no .so/.jar/.pyc/minified assets; the only binary files are doc/img/volio.png and SVG logos, which are their own source.
Sampled the Python sources (factory.py, utils.py, volumebase.py, the identifiers/ and volumes/ modules, drac/, tests/) — all consistent, plain MIT-licensed ESRF code with no vendored third-party copies.
uscan found the packaged version as the newest upstream release (upstream 0.0.0~dev1, packaged 0.0.0~dev1).

Not confirmed ◂

Could not build the package: it is inferred from upstream's [tool.setuptools.packages.find] where = ["."] plus the deletion line in debian/rules that conf.py is installed as part of a spurious doc namespace package, and therefore that an empty dist-packages/doc/ directory may remain in the binary. A build and dpkg -c would confirm.
The CHANGELOG says the code was "extracted from tomoscan (2.5.1)"; tomoscan is not in scope (no file and no URL I may read), so I could not compare it with tomoscan's own copyright notices. Both are ESRF projects and the upstream LICENSE attributes everything to ESRF, so this is not expected to matter.

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Hi,

The LLM review finds that your Build-Depends could do with some edits. It may (or may not) be correct, but it's worth a quick check. It also has some interesting commentary about deleting "conf.py".

It's last recommendation may well be bogus, but I'd be interested if you could confirm or deny that in a reply e-mail, because it can help me fine tune this analysis.

Thanks!

Back to Dashboard | View all reviews for this package