Debian NEW review of dune-common 2.11.0-2: ACCEPTED

[awm at debian.org]

This is an automated message from the Debian DFSG, Licensing & New
Packages Team.

The Debian NEW review of dune-common 2.11.0-2 has been completed.

Decision: ACCEPTED
Reviewer: Andrew McMillan

Review comment:

Hi,

A bunch of issues found in the review, but they're all minor or trivial findings. Enjoy!

1. [minor] [licensing] pybind11 stanza omits copyright holders named in the shipped headers

 - Files: debian/copyright, stanza `Files: dune/python/pybind11/*.h dune/python/pybind11/_version.py`; dune/python/pybind11/detail/init.h, typing.h, stl/filesystem.h, eigen/common.h, gil_safe_call_once.h, type_caster_pyobject_ptr.h
 - Evidence: `Copyright (c) 2017 Jason Rhinelander <jason at imaginary.ca>`; `Copyright (c) 2023 The pybind Community.`; `Copyright (c) 2021 The Pybind Development Team.`; `Copyright (c) 2023 Dustin Spicuzza <dustin at virtualroadside.com>`
 - Problem: The stanza's Copyright list (retrieved from pybind11's LICENSE on 2021-08-21) does not represent four holders that appear in the shipped headers. Licence coverage itself is correct: under copyright-format glob rules `*` matches slashes, so `dune/python/pybind11/*.h` covers all 35 headers including the detail/, eigen/ and stl/ subdirectories, and the full BSD-3-clause text is included.
 - Fix: Add the missing holders to the stanza's Copyright field (or add a Comment noting that pybind11's LICENSE covers all contributors).

2. [minor] [licensing] Files:* Copyright list is missing two holders listed in upstream's own
 COPYING/LICENSE.md

 - Files: debian/copyright, `Files: *` stanza
 - Evidence: upstream `COPYING`/`LICENSE.md` contain `2024 andrthu` and `2025 Tobias Meyer Andersen`; neither line appears in the `Files: *` Copyright field.
 - Problem: Copyright is not fully accurate: two holders in the upstream holder list are not represented in debian/copyright's catch-all stanza.
 - Fix: Add the two lines when next refreshing debian/copyright.

3. [minor] [licensing] pybind11 stanza lists a file that is not in the tarball

 - Files: `debian/copyright pybind11 stanza; dune/python/pybind11/_version.py (absent)`
 - Evidence: _version.py does not exist under dune/python/pybind11/ (the vendored pybind11 2.12 header-only copy ships no such file).
 - Problem: A Files pattern matching nothing; harmless but stale.
 - Fix: Drop the `_version.py` pattern from the stanza.

4. [minor] [licensing] LGPL-3.0-or-later alternative of dual-licensed files not recorded

 - Files: `dune/common/hybridmultiindex.hh; dune/common/typetree/*.hh and dune/common/typetree/test/*`
 - Evidence: `SPDX-License-Identifier: LicenseRef-GPL-2.0-only-with-DUNE-exception OR LGPL-3.0-or-later`
 - Problem: debian/copyright describes these files only as `GPL-2 with DUNE exception`; the LGPL-3.0-or-later option a recipient may choose is not mentioned, so the licence is under-described.
 - Fix: Record both options, e.g. `License: GPL-2 with DUNE exception or LGPL-3.0`, and add the LGPL-3 text (or a reference to /usr/share/common-licenses/LGPL-3).

5. [minor] [licensing] Boost-derived pow() in quadmath.hh not credited

 - Files: `dune/common/quadmath.hh (around line 352)`
 - Evidence: comment: `modified version of boost::math::cstdfloat::detail::pown ... distributed under the Boost Software License, Version 1.0`
 - Problem: The file's SPDX header and debian/copyright only state the DUNE GPL-2-with-exception; the embedded function adapted from Boost Math is BSL-1.0 code whose notice/licence text is not reproduced or recorded in debian/copyright.
 - Fix: Record the Boost provenance for quadmath.hh in debian/copyright (holder + BSL-1.0 text).

6. [minor] [packaging] CXXFLAGS restore in patch uses a misspelled variable name, leaving flags empty

 - Files: `debian/patches/fix-linitian-file-references-package-build-path (cmake/modules/DuneProject.cmake)`
 - Evidence: saves `_configure_file_cxx_flags_backup ${CMAKE_CXX_FLAGS}` but restores `set(CMAKE_CXX_FLAGS ${_configure_file_cxxflags_backup})` (different name).
 - Problem: CMAKE_CXX_FLAGS is set to empty instead of being restored. Currently benign because the code runs inside finalize_dune_project() after all targets already captured their flags, but it is a latent defect: any later use of CMAKE_CXX_FLAGS would see an empty value (losing Debian's flags).
 - Fix: Use the same variable name in both statements.

7. [minor] [packaging] Vendored pybind11 is an embedded copy of a library Debian ships

 - Files: dune/python/pybind11/* (pybind11 2.12.0; see dune/python/pybind11/detail/common.h, `PYBIND11_VERSION_MAJOR 2 / MINOR 12`)
 - Evidence: Debian ships pybind11 (`python3-pybind11 3.1.0-2`); Policy 4.13: binary packages should reference the libraries already in Debian rather than a convenience copy.
 - Problem: The source embeds a pinned pybind11 2.12.0 and installs its headers into python3-dune-common instead of using the Debian-packaged pybind11-dev. Upstream deliberately pins a specific version for its bindings, so a justified choice is acceptable, but it should be documented.
 - Fix: Either build against the system pybind11-dev, or add a Comment in debian/copyright / a note in debian/* documenting why the pinned vendored copy is kept (its version differences matter to DUNE's bindings).

8. [minor] [packaging] debian/watch is in the old version 4 format

 - Files: `debian/watch`
 - Evidence: `version=4`
 - Problem: Version 5 is the current format of `debian/watch`.
 - Fix: Convert it to version 5; a mechanical conversion is proposed below:

================================
Version: 5

Source: https://gitlab.dune-project.org/core/@PACKAGE@/tags?sort=updated_desc
Matching-Pattern: -/archive/v?\d[\d.]+/@PACKAGE at -@ANY_VERSION@@ARCHIVE_EXT@
Filenamemangle: s%.*@PACKAGE at -v?@ANY_VERSION@\.(.*)\.bz2.*%@PACKAGE at -$1.$2\.bz2%
Searchmode: plain
Update-Script: uupdate
================================


Thanks!

Full review details: https://dfsg-new-queue.debian.org/reviews/dune-common