Bug#1135657: bmagic: DFSG Issues

[Reinhard Tartler]

Package: bmagic
Version: 7.13.4+dfsg-1
Severity: serious

Dear Maintainer,

I am filing this bug report with severity serious because the current
version of bmagic in the archive contains several violations of the
Debian Free Software Guidelines (DFSG) and licensing documentation
requirements.

1. Non-Free Attribution Requirement (DFSG 1 & 3)
The LICENSE file (and README.md) contains a clause that states:
"Proper BitMagic reference on your product/project page is a REQUIREMENT
for using the Library."
This "requirement" to maintain a specific reference on a project page
goes beyond standard attribution and imposes a specific redistribution
burden. This is effectively an advertising-style clause that restricts
free redistribution and the creation of derived works, making it
incompatible with the DFSG.

2. Binary Blobs (Policy 4.16, DFSG 2)
The source package contains a precompiled header file which is a
binary blob without source form:
msvc32/.vs/bm/v15/ipch/AutoPCH/60fd1a078cd898e5/PERF.ipch
This violates Debian Policy 4.16 ("Missing sources") and DFSG 2, as it
is not the "preferred form for modification". This file should have
been excluded from the +dfsg tarball.

3. Missing Authors and Licenses in debian/copyright
A scan with the `dnq` tool (available from
https://salsa.debian.org/dfsg-team/dfsg-new-queue) using
`dnq author-check` and manual inspection reveals several authors and
licenses that are not declared in debian/copyright:

- Francesco Nidito (MIT): lang-maps/libbm/src/try_throw_catch.h
- Kim Walisch (BSD-2-Clause): src/bmavx2.h, src/bmavx512.h (libpopcnt)
- Wojciech Muła (BSD-2-Clause): src/bmavx2.h, src/bmavx512.h (libpopcnt)
- Timo Bingmann (WTFPL-2.0): tests/stress/stacktrace_dbg.h
- Contributors to sse2neon.h (MIT): src/sse2neon.h

Because of the non-free attribution clause and the binary blob, this
package is currently not suitable for the main archive.

Regards,
-rt