DFSG NEW review for zoitechat-otr version 0.2.2~git20260225-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 1 important, 4 minor
• debian/watch: absent
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The code itself is DFSG-free: all C sources and headers are GPL-2+, the metadata file is CC0-1.0 (a licence file is in /usr/share/common-licenses), there is no non-free wording, no vendored third-party code and no built binary. debian/copyright is however inaccurate: it omits Uli Meis as a copyright holder for src/makeformats.py (which carries his name and a GPL-2+ notice), and src/zoitechat_otr.c/.h carry the GPL boilerplate with the copyright line absent while the copyright file attributes them to other people.

Packaging

Packaging is simple and correct in the main: 3.0 (quilt), compat 14, meson build, hardening enabled, Rules-Requires-Root, single arch-dependent binary, shlibs dependencies added by debhelper itself. Issues found are minor: an outdated Standards-Version and a Build-Depends list that neither names the libraries/interpreters the build uses directly nor drops the one it does not need.

Issues

1. [blocker] [licensing] Copyright holder Uli Meis missing for src/makeformats.py

• Files: debian/copyright:5-8, debian/copyright:16-21, src/makeformats.py:1-20
• Basis: checked, in the package or with a reference tool
• Evidence: src/makeformats.py begins with # Uli Meis <a.sporto+bee@gmail.com> followed by the GPL-2+ boilerplate, but the only Uli Meis stanza covers src/otr.h, src/otr_key.c, src/otr_ops.c, src/otr_util.c; makeformats.py therefore falls under Files: * (Copyright: 2014 <adhux@lelantos.org> 2014-2016 Patrick Griffis), which does not name him.
• Problem: debian/copyright does not record the copyright holder of a file whose own header states it, so the copyright information is inaccurate and incomplete (a required part of DFSG review). Later Files stanzas override earlier ones, so the wrong stanza is what applies.
• Fix: Add src/makeformats.py to the Uli Meis, GPL-2+ stanza, and check src/formats.txt (the input it generates from, which appears to be the irssi-otr work) for the same attribution.

2. [important] [licensing] src/zoitechat_otr.c and .h have no copyright holder line, and the copyright file's attribution is unsupported

• Files: src/zoitechat_otr.c:1-15, src/zoitechat_otr.h:1-15, debian/copyright:5-8
• Basis: inferred from what was read, not seen directly
• Evidence: Both files open with the same GPL-2+ boilerplate as the four Uli Meis files, but with the Copyright (C) 2008 Uli Meis line removed; Readme.md:6 says the code is Originally forked from irssi-otr. debian/copyright attributes them to adhux (2014) and Patrick Griffis (2014-2016) under Files: *.
• Problem: A derived file should retain its upstream copyright notice (GPL-2 section 1 requires keeping notices intact). Nothing in the tree supports the adhux/Griffis attribution for these two files, while the identical boilerplate and the fork statement point to irssi-otr's author. As written the copyright file is likely wrong for them.
• Fix: Ask upstream and/or check the git history, then name the actual author(s) (probably Uli Meis, plus later contributors) for these files in debian/copyright.

3. [minor] [licensing] debian/* stanza names only the 2016 maintainer, not the author of the 2026 packaging

• Files: debian/copyright:23-25, debian/changelog:1-5, debian/control:6-7
• Basis: inferred from what was read, not seen directly
• Evidence: Files: debian/* / Copyright: 2016 Petter Reinholdtsen <pere@hungry.com>, while the changelog records a 2026 initial release by Bastian Germann and the control/rules were written for it.
• Problem: The packaging files are not all Petter Reinholdtsen's 2016 work (the copyright file itself appears to be carried over from the irssi-otr packaging), so the debian/* stanza is incomplete.
• Fix: Add Bastian Germann (and any other authors of the current debian/ files) to the debian/* stanza, keeping Petter Reinholdtsen for the inherited parts.

4. [minor] [packaging] Standards-Version 4.6.0 is older than current Policy

• Files: debian/control:8
• Basis: checked, in the package or with a reference tool
• Evidence: Standards-Version: 4.6.0; the reviewing system's Policy is 4.7.4.1.
• Problem: The first two components are older than the current Policy's, which is a (minor) packaging-currency issue.
• Fix: Bump to 4.7.4 (or 4.7.4.1) after checking the upgrading checklist (Policy A10).

5. [minor] [packaging] Build-Depends does not match what the build uses

• Files: debian/control:9-16, meson.build:47-49, src/makeformats.py:1, debian/rules:8-9
• Basis: checked, in the package or with a reference tool
• Evidence: meson calls dependency('libgcrypt', required: true) and compiles against <gcrypt.h>, but libgcrypt20-dev is not in Build-Depends; src/makeformats.py is run by a custom_target with #!/usr/bin/env python3, but python3 is not in Build-Depends; zoitechat is depended on though the only use of the zoitechat binary is inside the if get_option('local_install') branch, and debian/rules passes -Dlocal_install=false.
• Problem: The build works today only because libotr5-dev Depends on libgcrypt20-dev and meson Depends on python3 (checked with apt-cache), i.e. through transitive dependencies that Policy does not guarantee; and one build-dependency is unnecessary weight.
• Fix: Add libgcrypt20-dev and python3 to Build-Depends and drop zoitechat (keep it only if it is wanted deliberately).

6. [minor] [packaging] There is no debian/watch

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Problem: Without a watch file new upstream releases are not noticed by uscan, the tracker or the maintainer's tools.
• Fix: Add a debian/watch in version 5 format, or, if upstream has no usable release channel, one holding a comment that says so.

Verified

• Full tree read: 18 upstream files (.clang-format, .editorconfig, .gitignore, LICENSE, Readme.md, meson.build, meson_options.txt, data/ 2 files, src/ 9 files) and 5 debian/ files; .pc/ ignored throughout.
• No compiled objects, libraries, archives, minified code, PDFs, fonts, images or vendored third-party code are present. The only generated files are zoitechat-formats.c and otr-formats.h, produced at build time by src/meson.build from src/formats.txt via src/makeformats.py, which are both in the source.
• LICENSE is the verbatim GPL-2 text; every C source/header carries GPL-2+ ('either version 2 ... or any later version'); the metainfo file is CC0-1.0 and /usr/share/common-licenses/CC0-1.0 exists, so debian/copyright's pointer is valid. No non-free terms, no 'All rights reserved', no field-of-use or no-modification clauses.
• Prescan author check: all 17 scanned files' holders matched debian/copyright. The only in-file holders are Uli Meis (src/otr.h, otr_key.c, otr_ops.c, otr_util.c) and the metainfo contact deepend_AT_zoite.net; both are named, though Uli Meis is missing from the stanza that in fact covers src/makeformats.py (reported above).
• debian/copyright is DEP-5 (correct Format URL), so no replacement was proposed; stanzas are ordered correctly and later stanzas override Files: * as intended.
• Compat 14: dh_gencontrol adds ${misc:Depends}/${shlibs:Depends} itself, so their absence from debian/control is not a fault.
• debian/rules sets hardening=+all, uses dh with --buildsystem=meson, and overrides dh_auto_configure harmlessly (local_install defaults to false). No patches, no maintainer scripts, no .install/.links/.docs files are needed.
• Build-Depends names exist in the archive: libotr5-dev 4.1.1-7, zoitechat 2.19.1-1, zoitechat-dev 2.19.1-1, meson 1.12.1-2 (apt-cache); pkgconf provides the pkg-config program the build looks up.
• Changelog version 0.2.2~git20260225-1, distribution unstable, initial release closing #1137179; debian/source/format is 3.0 (quilt); section net, priority optional, Multi-Arch: same, Rules-Requires-Root: no.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC0-1.0, GPL-2).

Not confirmed

• Whether src/makeformats.py is executable in the source archive: meson's find_program is used on it, and grep/read do not expose file modes. A meson configure would show it immediately.
• The provenance of the 2014 adhux / 2014-2016 Patrick Griffis attribution for src/zoitechat_otr.c and .h: the tarball has no VCS history, so the file headers alone cannot confirm or refute it.
• Whether zoitechat-plugin.pc defines the zoitechatlibdir variable and whether that install path is architecture-specific, which matters for the correctness of Multi-Arch: same; zoitechat-dev is not installed on this system.

Proposed changes

None.