This is an automated message from the Debian DFSG, Licensing & New
Packages Team.
The Debian NEW review of ocaml-checkseum 0.5.4-1 has been completed.
Decision: ACCEPTED
Reviewer: Andrew McMillan
Review comment:
Hi,
One important issue you should please fix in your next upload, the other at
your option...
1. [important] [licensing] `Files:` glob uses brace expansion, so the zlib
stanza matches no file
- Files: `debian/copyright:7`
- Evidence: `Files: src-c/native/{adler32,crc32}.c`; the copyright-format 1.0
spec (§6.9) admits only `*`, `?` and the `\` escape as pattern syntax (`[]` are
explicitly *not* recognized), so `{}` has no special meaning and the pattern is
literal.
- Problem: The pattern matches no path in the tree, so `adler32.c` and
`crc32.c` -- whose in-file headers say `Copyright (C) 1995-2016 Mark Adler` /
zlib (`for conditions of distribution and use, see copyright notice in zlib.h`)
-- are instead matched by the earlier `Files: *` stanza and recorded under
`Copyright: 2014, Romain Calascibetta` and `License: MIT`. debian/copyright
therefore states the wrong holder and the wrong licence for the only zlib
files. It is not a DFSG violation (the files remain under a free, compatible
licence and the full zlib text is already reproduced), but the record is
inaccurate and an automated per-file comparison (e.g. licensecheck) would flag
the mismatch.
- Fix: List the two files without braces, e.g. `Files: src-c/native/adler32.c
src-c/native/crc32.c` (or one stanza per file), so the Mark Adler / Zlib stanza
actually applies.
2. [minor] [packaging] -dev package installs the upstream debug CLI via a bare
`usr/bin` line; no man page
- Files: `debian/libcheckseum-ocaml-dev.install`
- Evidence: The file is exactly `usr/bin`; `bin/dune` has `(executable (name
main) (public_name checkseum.checkseum))`; CHANGES.md (v0.2.0) calls the tool
"used only for debugging".
- Problem: A single-item install line makes dh_install guess its destination,
copying the whole `usr/bin` directory (the dune-built `checkseum` CLI) into
`libcheckseum-ocaml-dev`; a /usr/bin program in a library -dev package is an
unusual placement and, per Policy 12.1, it should come with a man page, which
is not shipped anywhere in the package. The line only resolves if dh-ocaml's
dune install stages `bin/` under `debian/tmp`; a build should confirm the
resulting binary name and path.
- Fix: Confirm at build time that the binary is found and what it is named; if
the CLI is kept, add a man page or relocate/ship it more appropriately -- or
drop the line entirely since the tool is debug-only.
Full review details: https://dfsg-new-queue.debian.org/reviews/ocaml-checkseum
