Package: weakforced Version: 3.2.0-1 Severity: serious Hi,
I've been reviewing weakforced 3.2.0-1 in NEW and found several DFSG issues. Most of these are pre-existing (present in 3.0.0-5), but they should be addressed before the package is accepted. 1. Binary blob in source tree `wforce/foo` is a Mach-O 64-bit arm64 executable sitting in the source tree. It's not referenced in any `debian/*.install` file, so it won't be packaged, but its presence in the `orig.tar.gz` is a DFSG problem. Binary blobs without source or licensing information cannot be distributed. This needs to be removed from the upstream tarball or excluded via `Files-Excluded` in `debian/copyright`. 2. Undocumented third-party code in `common/sodcrypto.cc` This file contains Base64Encode code with copyright "Copyright 2001-2002 Randy Charles Morin" (kbcafe.com). This author and the corresponding license terms are missing from `debian/copyright`. The file currently falls under `Files: *` (GPL-3), but the Base64 code may have different licensing that needs to be documented separately. 3. Misleading copyright symbol for `ext/ext/murmur3.*` `debian/copyright` lists "© Austin Appleby" but the source files explicitly state "The author hereby disclaims copyright to this source code." The copyright symbol implies an assertion of copyright, which contradicts the public domain disclaimer. Consider changing to "Austin Appleby" without the © symbol, or rewording to clarify the public domain dedication. Thanks for your work on this package.
