[Debian-pan-maintainers] quanty_0.0~git20250119191535.560ae00-1_amd64.changes REJECTED

[Andrew McMillan]

Hi,

Several issues that should be fixed here...

Licensing / DFSG
================

1. Inaccurate debian/copyright — bundled Lua is mislabeled as CC-BY-4.0.

debian/copyright claims Files: * ... License: CC-BY-4.0 for the whole upstream tree, but the tree embeds a full copy of the Lua 5.2.3 interpreter (LuaInterface/lua/), whose header states Copyright (C) 1994-2013 Lua.org, PUC-Rio (LuaInterface/lua/lua.h:26) and is MIT-licensed. The copyright file never mentions Lua or its MIT license, so it violates the machine-readable format's requirement to identify all files and their licenses. This bundled Lua is also actually compiled into the binary via #include "lua/includeLua.c" (LuaInterface/main.cpp:24).


2. The effective license deviates from the CC-BY-4.0 that debian/copyright claims.

LICENSE adds an obligation beyond CC-BY-4.0: "For our scientific code this means you need to site the proper papers in scientific work that is based on this code or derivatives of this code." This is an extra, field-of-use-style requirement that debian/copyright neither reproduces nor flags, and it's the part of the licensing most likely to raise DFSG concerns. (CC-BY-4.0 itself is generally treated as DFSG-free, so the copyright inaccuracy + added clause are the real problems, not the base license per se.)

If you can persuade them to, I think that upstream would be better to word it as something like "... this means you should cite the proper papers ...", which would not override the CC-BY-4.0, so you should propose that to them. It also corrects a spelling mistake (site -> cite).


3. debian/copyright upstream holder is just Copyright: Quanty with no years/names. I guess if you don't know the years, you don't, but perhaps they can be discovered from the upstream repository?  Is that really the copyright holder, or should it list the paper authors?



Packaging Quality Observations
==============================

None of these are showstoppers, but some of them definitely seem worth fixing.  The vendored Lua should be explained, ideally, and definitely exposed.

4. Test loop bug (duplicated in two files).

debian/rules:13 iterates for i in $$(find TestScripts -name *.Quanty) but then only echoes $$i while always running the hardcoded TestScripts/BitMaskToIndex.Quanty. The exact same bug is repeated in debian/tests/control:1. Only one script is ever exercised.


5. Redundant tests.

The same test runs in override_dh_auto_test (debian/rules:12) and as an autopkgtest (debian/tests/control) — duplicate coverage.


6. Vendored Lua, no system liblua, no Build-Depends.

The build (debian/rules:10) compiles only LuaInterface/main.cpp and relies on the amalgamated #include of the bundled Lua, rather than linking Debian's liblua. debian/control has no lua Build-Depends, and debian/copyright doesn't disclose the vendored copy (see #1). liblua*-dev should be a Build-Depends and the bundled copy dropped or at least documented.


7. Hardcoded -O2 in debian/rules:10 after $(CXXFLAGS)

This can conflict with the optimizer level chosen by dpkg-buildflags (e.g. a -O3 from CXXFLAGS would be overridden by the trailing -O2), so reproducible/optimized builds aren't fully honored.


8. debian/watch version scheme likely mismatches the changelog.

watch uses Mode: git + Matching-Pattern: HEAD + Git-Date: %Y%m%d%H%M%S, but the changelog version is 0.0~git20250119191535.560ae00-1 with a Dversionmangle: s/\+ds\d+// that doesn't align with the ~git... suffix. uscan/gbp may fail to match and update the version properly.

Further information may be found at:
   https://dfsg-new-queue.debian.org/reviews/quanty

Regards, Andrew McMillan
Member of the DFSG, Licensing & New Packages Team



===

Please feel free to respond to this email if you don't understand why
your files were rejected, or if you upload new files which address our
concerns.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/debian-pan-maintainers/attachments/20260927/09369fd0/attachment.sig>