[Debian-ha-maintainers] Bug#1142847: Debian NEW review of kronosnet 1.35-1: ACCEPTED

[awm at debian.org]

The Debian NEW review of kronosnet 1.35-1 has been completed.

Decision: ACCEPTED
Reviewer: Andrew McMillan

Review comment:

Hi,

The package is accepted, and DFSG compliance is OK, however the review finds some minor issues...


Licensing accuracy issues

1. Wrong LGPL version in debian/copyright — the main issue.

debian/copyright:12 declares libknet/* and libnozzle/* as LGPL-2.1+ and references /usr/share/common-licenses/LGPL-2.1 (line 38). But every source file header says LGPL-2.0+ (the older GNU Library GPL v2.0, a different license from LGPL-2.1). E.g.:
- libknet/common.c:6, libknet/handle.c:7, libknet/libknet.h:7, libnozzle/libnozzle.c:6 → all "LGPL-2.0+".
The copyright file therefore states the wrong license version and points to the wrong common-license file. (Upstream's own README.licence also says 2.1, so the mismatch likely came from copying that rather than the per-file headers — but debian/copyright must reflect the source headers.)

2. Wireshark dissector mis-declared as GPL.

libknet/wireshark/packet-kronosnet.{c,h} are LGPL-2.0+ (packet-kronosnet.c:8). But the glob libknet/* in DEP-5 does not match subdirectories, so these files fall through to the catch-all Files: * → GPL-2+ (debian/copyright:5-7). Wrong license declared for the shipped kronosnet-wireshark plugin.

3. Build files under the libraries declared LGPL but actually GPL.

libknet/Makefile.am:7, libnozzle/Makefile.am:7 (and generated Makefile.in) are GPL-2.0+, yet they sit directly in libknet//libnozzle/ so they match the libknet/*/libnozzle/* globs and are declared LGPL-2.1+. Wrong.

4. Minor: config.guess/config.sub mis-versioned.

These are GPL-3+ (with the FSF exception), but the copyright file only lists them under the catch-all Files: * → GPL-2+. Note the maintainer did single out build-aux/git-version-gen as GPL-3+ (debian/copyright:18-21) but missed these two.

Non-license packaging note

debian/rules:15 sets --docdir=/usr/share/doc/libknet1, pointing at the pre-time64 name (the package is now libknet1t64). The files it installs there are then discarded via debian/not-installed, so only man pages actually ship (in libknet-doc). This works but is stale/inconsistent with the current package naming.


I hope this is useful.

Thanks!

Full review details: https://dfsg-new-queue.debian.org/reviews/kronosnet