Bug#1143198: Debian NEW review of openmpi 6.0.0~rc2-3: ACCEPTED

[awm at debian.org]

This is an automated message from the Debian DFSG, Licensing & New
Packages Team.

The Debian NEW review of openmpi 6.0.0~rc2-3 has been completed.

Decision: ACCEPTED
Reviewer: Andrew McMillan

Review comment:

Hi,

Some interesting licensing observations which really should be resolved, but the package is accepted as-is since it is already in Debian...

A bunch of other minor notes you could do - the debian/watch thing might just be because this is an experimental packaging of a pre-release, etc.

1. [important] [licensing] Vendored 3rd-party/treematch library is CeCILL-B but debian/copyright covers it under the Open MPI licence (Files: *)

 - Files: `debian/copyright`, `3rd-party/treematch/LICENSE`, `3rd-party/treematch/fibo.c`, `3rd-party/treematch/uthash.h`, `3rd-party/treematch/tm_mt.c`, `docs/license/treematch.txt`
 - Evidence: `fibo.c`: "This software is governed by the CeCILL-B license under French law..." and `LICENSE` begins "CeCILL-B FREE SOFTWARE LICENSE AGREEMENT"; `docs/license/treematch.txt` is the full CeCILL-B text (index.rst lists Treematch among "Redistributed code"). debian/copyright has no stanza for `3rd-party/treematch/*`, so every file falls under `Files: *` / `License: other`.
 - Problem: Treematch is a third-party codebase (Inria's TreeMatch) built into the shipped binaries (ompi/mca/topo/treematch links the 3rd-party library). Labeling it with the Open MPI per-file licence and OMPI copyright holders misstates its licence and removes CeCILL-B's attribution terms; `uthash.h` (BSD-2-Clause, Troy D.  Hanson) and `tm_mt.c` (BSD-3-Clause, Matsumoto et al.) carry separate notices. CeCILL-B is DFSG-free, so this is a d/copyright accuracy defect, not a non-free upload.
 - Fix: Add a `Files: 3rd-party/treematch/*` stanza with the Inria copyright and `License: CeCILL-B` (full text supplied in the file), plus separate BSD-2-Clause/BSD-3-Clause notes for uthash.h and tm_mt.c.

2. [important] [licensing] ptmalloc stanza claims FSF-2001/LGPL-2; actual files are public-domain dlmalloc and BSD-3-Clause-Open-MPI

 - Files: `debian/copyright`, `oshmem/mca/memheap/ptmalloc/malloc.c`, `oshmem/mca/memheap/ptmalloc/memheap_ptmalloc.c`
 - Evidence: debian/copyright: `Files: oshmem/mca/memheap/ptmalloc/*` with `Copyright: (C) 2001 Free Software Foundation, Inc.` `License: LGPL-2`. malloc.c: "This is a version (aka dlmalloc) of malloc/free/realloc written by Doug Lea and released to the public domain" (adapted for ptmalloc3 by Wolfram Gloger); memheap_ptmalloc.c: `SPDX-License-Identifier: BSD-3-Clause-Open-MPI`.
 - Problem: No file in that directory is LGPL or FSF-2001: the vendored allocator is Doug Lea's public-domain dlmalloc, and the memheap glue files are Open MPI's BSD licence. The stanza overrides the catch-all with a wrong holder and licence for these files.
 - Fix: Split the stanza: `malloc.c` → `License: public-domain` (with the required explanation), `memheap_ptmalloc*` → `License: BSD-3-Clause-Open-MPI` under the Files:* licence, dropping the stale FSF/LGPL claim.

3. [minor] [licensing] Bundled hwloc/libevent tarballs claimed under the Open MPI licence by Files: * and left in the source

 - Files: `debian/copyright`, `3rd-party/hwloc-2.15.0.tar.gz`, `3rd-party/libevent-2.1.12-stable-ompi.tar.gz`
 - Evidence: Both tarballs are present in the source and in the orig tarball; `debian/copyright` has no stanza and no `Files-Excluded` for them, so `Files: *` / `License: other` (the Open MPI licence) covers them. The content is hwloc (BSD-3-Clause) and libevent (BSD), documented in `docs/license/hwloc.txt` and `docs/license/libevent.txt`.
 - Problem: The catch-all asserts the Open MPI licence for third-party BSD code, which is inaccurate; the tarballs are dead weight because the build uses `--with-hwloc=external --with-libevent=external`. All free, so not a DFSG violation.
 - Fix: Add a `Files: 3rd-party/*.tar.gz` stanza with the hwloc/libevent licence (and holders) or list them under `Files-Excluded` in debian/copyright (with a matching `debian/source/options` source-exclusion if repacking).

4. [minor] [licensing] Files: * Copyright list omits copyright holders present in the sources

 - Files: `debian/copyright`, `ompi/communicator/comm.c`, `configure.ac`, `config/opal_check_ze.m4`, `ompi/communicator/Makefile.am`
 - Evidence: comm.c: `Copyright (c) 2023-2025 Advanced Micro Devices, Inc.`, `Copyright (c) 2026 Jeffrey M.  Squyres.`, `Copyright (c) 2026 Musawer Ahmad Saqif.`; configure.ac:31 and opal_check_ze.m4 carry AMD/JS copyright.  None of AMd, Squyres or Saqif appear in the `Files: *` Copyright field (NVIDIA listed only to 2024, BULL S.A.S. only 2009-2015).
 - Problem: Copyright holders named in file notices are not represented in debian/copyright.
 - Fix: Add the missing holders (and refresh years, e.g. NVIDIA 2026, BULL S.A.S. 2025) to the `Files: *` Copyright field.

5. [minor] [packaging] Two patches ship malformed DEP-3 headers

 - Files: `debian/patches/oac-patches.patch`, `debian/patches/version.patch`
 - Evidence: oac-patches.patch begins `Description: <short summary of the patch>` followed by the whole `TODO:` template and a stray `pmix (5.0.2-1) UNRELEASED` changelog block; version.patch has two `Description:` lines (`Description: Fix version of ` and `Description: update VERSION file...`).
 - Problem: Poor patch metadata for a sponsored upload; oac-patches documentation does not describe its real purpose (vendoring the config/oac autoconf submodule).
 - Fix: Clean the header of oac-patches.patch (real Description, Origin/Forwarded, Last-Update) and merge the duplicated Description in version.patch.

6. [minor] [packaging] debian/watch is in the old version 4 format

 - Files: `debian/watch`
 - Evidence: `version=4`
 - Problem: Version 5 is the current format of `debian/watch`.
 - Fix: Convert it to version 5; a mechanical conversion is included below.

================================================================================
Version: 5

Source: https://www.open-mpi.org/software/ompi/
Matching-Pattern: .*/.*/openmpi-([\d+\.]+)@ARCHIVE_EXT@
================================================================================

7. [minor] [packaging] uscan finds only upstream versions older than the packaged one

 - Files: `debian/watch`
 - Evidence: upstream `5.0.11`, packaged `6.0.0~rc2`
 - Problem: The newest version uscan finds with `debian/watch` is older than the version in `debian/changelog`, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
 - Fix: Check where `debian/watch` looks and how it mangles versions.


Thanks!

Full review details: https://dfsg-new-queue.debian.org/reviews/openmpi