Debian NEW: automated review of harfbuzz 14.2.1+ds-1

[dfsg-team at debian.org]

Hi,

Your upload of harfbuzz 14.2.1+ds-1 to the NEW queue has had an automated review: an LLM-based check of its licensing and packaging, run by the DFSG team using the Debian Inference service. It is not a decision on the package, and - like other LLM-based work - it can be wrong.

It found 4 blocker, 1 important, 3 minor issues:

  - [blocker] [licensing] debian/copyright does not name Eric Lengyel for src/hb-gpu-fragment.glsl and the generated header built into libharfbuzz-gpu0
  - [blocker] [licensing] util/gpu/matrix4x4.hh is BSD-3-Clause (Mozilla Corp, Google Inc), declared MIT by `Files: *`, and no BSD-3-Clause text is shipped
  - [blocker] [licensing] util/gpu/trackball.hh carries the SGI copyright and permission notice but is declared MIT and Silicon Graphics, Inc. is not named
  - [blocker] [licensing] test/api/fonts/chromacheck-*.ttf and RanaKufi-Regular.subset.otf are MIT per the shipped README but debian/copyright declares OFL-1.1, and Roel Nieskens is not named
  - [important] [packaging] libharfbuzz-dev does not depend on the new libharfbuzz-gpu0 although it ships libharfbuzz-gpu.so and hb-gpu.h
  - [minor] [packaging] The three new symbols files give upstream release numbers as the minimum Debian version of each symbol
  - [minor] [packaging] hb-gpu is installed into libharfbuzz-bin without a manual page
  - [minor] [packaging] debian/watch is in the old version 4 format

You can read the full review here:

    https://dfsg-new-queue.debian.org/reviews/harfbuzz#assistant-report

Please look at it, and respond by visiting the link below (you'll be asked to authenticate with Salsa first):

    https://dfsg-new-queue.debian.org/llm-review/y561Fg7OzWCJbtCoIp5lmAHP0MxveSCQ

There you may choose to reject the upload yourself, while you fix issues and re-upload, or add comments to clarify or dispute the review.

Your comments are for the DFSG team member who reviews the package, not for the LLM: it will not read them or reply. Tell the reviewer where you think the automated review is right or wrong, and why. Comments are public and shown with the review; you may use markdown, e.g. to link to clarifying information.

If you have any questions, please reply to this e-mail and someone from the
team will respond.

If you would rather not be e-mailed about these reviews, log in at https://dfsg-new-queue.debian.org
and say so on your profile page.

Thanks!