This is an automated message from the Debian DFSG, Licensing & New
Packages Team.

The Debian NEW review of python-adjusttext 1.4.0+ds-1 has been completed.

Decision: ACCEPTED
Reviewer: Andrew McMillan

Review comment:

Hi,

Some issues found during the review which you may wish to resolve.  The use of 
a valid short name for the licesing of figures/mtcars.csv is probably the only 
strictly necessary one, to bring the debian/copyright into syntactic 
correctness.

1. [minor] [licensing] `intersect` in adjustText/__init__.py is adapted from a 
gist with no licence; permission unverified

 - Files: adjustText/__init__.py (lines 21-32, comment `# Modified from 
https://gist.github.com/kylemcdonald/...  `); debian/copyright `Files: 
adjustText/__init__.py` stanza
 - Evidence: The source comment reads `# Modified from 
https://gist.github.com/kylemcdonald/6132fc1c29fd3767691442ba4bc84018`; 
debian/copyright itself states `The gist has no license notice; the author's 
permission remains unverified.` yet the stanza labels the file only `License: 
Expat and CC-BY-SA-4.0`, which does not cover this function.
 - Problem: A third-party-derived function whose underlying permission has not 
been confirmed is being redistributed. This is the one place where 
debian/copyright is accurate but cannot assign a licence; a truthful DD would 
want the provenance closed before acceptance.
 - Fix: Ask upstream to rewrite the ~12-line segment-intersection helper 
(trivial, standard algorithm) or obtain/gist-verify a licence, then it stays 
covered by the file's own Expat grant. Update the stanza Comment when resolved.

2. [important] [licensing] figures/mtcars.csv uses a prose License synopsis, 
not a copyright-format short name, with garbled text

 - Files: debian/copyright `Files: figures/mtcars.csv` stanza
 - Evidence: `License: considered public domain, used in R distributed with 
Debian` and `Copyright: 1981 Harold V.  Henderson und Paul F. Vellemandie` with 
a trailing German sentence fragment (`Appeared in ... von im Juni 1981 the 
journal Biometrics`).
 - Problem: copyright-format 1.0 requires the License synopsis to be a short 
name (no spaces); prose here is invalid and no matching License paragraph 
supplies text. The holder line also mixes German (`und`) and a misspelling 
(`Vellemandie`). The underlying claim (factual Motor Trend data, effectively 
public domain, shipped with R) is fine for DFSG.
 - Fix: Use `License: public-domain` (a defined short name) and move the 
explanation plus a corrected bibligraphic note („Building Multiple Regression 
Models Interactively“, Biometrics 37(2), 391-411, June 1981, Henderson & 
Velleman) into the stanza body/Comment.

3. [minor] [packaging] Standards-Version one point behind current

 - Files: `debian/control (line with Standards-Version)`
 - Evidence: `Standards-Version: 4.7.4`; the reviewing system's Debian Policy 
is 4.7.4.1 (released 2026-03-31).
 - Problem: Initial upload dated October 2026 could trivially claim the current 
version; stale on day one.
 - Fix: Bump to `4.7.4.1` (no policy changes expected to apply).

4. [minor] [packaging] debian/README.source contradicts the actual source 
provenance

 - Files: `debian/README.source (opening paragraph)`
 - Evidence: `It includes generated documentation and bundled JavaScript, 
covered by debian/copyright` and `This revision does not repack the archive or 
modify upstream code.`
 - Problem: The archive is in fact repacked (`1.4.0+ds`): docs/build and two 
CSVs are excluded, and the tree and tarball contain no JavaScript and no 
copyright stanza for any; the text misleads a future maintainer about what was 
removed and how.
 - Fix: Reword: the 1.4.0 source is the upstream GitHub archive minus the 
Files-Excluded items (sphinx `docs/build` output and the two unlicensed CSVs), 
and the package is repacked with the `+ds` suffix.

5. [minor] [packaging] The repack suffix is not removed before versions are 
compared

 - Files: `debian/watch`
 - Evidence: uscan compares `1.4.0+ds` with upstream's `1.4.0` (status: `only 
older package available`)
 - Problem: The packaged version carries a repack suffix that `debian/watch` 
does not remove before comparing, so uscan compares it as it is with upstream's 
version and never finds them equal.
 - Fix: Remove the suffix for the comparison, with `Dversion-Mangle: auto`


Thanks!

Full review details: https://dfsg-new-queue.debian.org/reviews/python-adjusttext

Reply via email to