The Debian NEW review of fmtlib 12.1.0+ds1-1 has been completed.
Decision: ACCEPTED
Reviewer: Andrew McMillan
Review comment:
Hi,
Minor issues - please fix on your next upload.
1 (real, accuracy): include/fmt/chrono.h is wrongly attributed in
debian/copyright. The stanza beginning at Files: include/fmt/chrono.h …
test/fuzzing/… declares Copyright: 2019 Paul Dreik and, being later than Files:
*, overrides it for chrono.h. But include/fmt/chrono.h:2-4 reads // Copyright
(c) 2012 - present, Victor Zverovich / All rights reserved. — Zverovich is the
file's holder, with a safe_duration_cast sub-section at chrono.h:38 attributed
Copyright Paul Dreik 2019. As written, Debian's records list only Paul Dreik
for a Zverovich header. Fix: drop include/fmt/chrono.h from the Dreik stanza
(it then falls under the Zverovich catch-all) and optionally note the Dreik
source of the safe_duration_cast block there. (Year drift on
chrono-timepoint.cc says 2021 vs 2019 — noted, not worth changing.)
2 (real, completeness): the shipped documentation carries PSF terms that
debian/copyright neither lists nor provides text for. README.md "#
Documentation License" states the Format String Syntax section derives from
Python's string module docs and "is distributed under the Python Software
Foundation license available in doc/python-license.txt". doc/syntax.md indeed
reproduces the Python "Format Specification Mini-Language" grammar and prose
more or less verbatim (e.g. syntax.md:76-93). Debian ships this doc in
libfmt-doc, but the PSF text (doc/python-license.txt) is listed in
Files-Excluded and removed, and no PSF stanza is in the copyright file. The PSF
licence is DFSG-free and lives in /usr/share/common-licenses/PSF, so this is
not a DFSG violation — but the file is incomplete. Fix: add a Files: doc/* (or
doc/syntax.md) stanza with Copyright: 2012-present Victor Zverovich and {fmt}
contributors and License: Expat... + a PSF reference (common-licenses), or keep
the PSF text instead of excluding it.
Some nits that you may want to also address...
- watch file: version 4 (debian/watch:1). One-sentence note: it should be
converted to version 5. Syntax reviewed otherwise: it targets fmtlib/fmt tags,
dversionmangle=auto + repacksuffix=+ds1 correctly yield 12.1.0+ds1 matching the
changelog, and Files-Excluded is present, so the +ds1 suffix is consistent. No
debian/upstream/ metadata or signing key; acceptable.
- Minor — debian/patches/0003-mkdocstrings.patch lacks DEP-3
Forwarded:/Description: (the other two have Forwarded: not-needed). The patch
is a 267/148-line rewrite of the cxx handler to adapt to mkdocstrings 1.0
(#1135498); it is a genuine compatibility fix that should be forwarded
upstream, currently unlabeled.
- Minor/real — the shipped docs reference an external CDN. support/mkdocs.yml
sets extra_javascript:
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.7.2/highlight.min.js
(and matching extra_css), and use_pygments: false makes the HTML rely on that
JS. The built libfmt-doc pages therefore embed links to cdnjs.cloudflare.com —
a privacy/offline concern for shipped docs. [INFERENCE] standard mkdocs
behaviour; not executed. Fix: patch mkdocs.yml to drop the CDN entries (and
enable Pygments for highlighting).
- Minor — debian/doxygen.conf is dead. Nothing in debian/ or the build
references it; the mkdocstrings cxx handler now generates its own doxygen
config inline (support/python/mkdocstrings_handlers/cxx/__init__.py:261-305),
writing XML to build/doxyxml. Leftover from the Sphinx-era build.
- Minor/cosmetic — libfmt-dev Description says "include the static library" but
rules sets BUILD_SHARED_LIBS=on and only libfmt.so is installed; no static
archive is built. Stale upstream text; harmless.
Thanks!
Full review details: https://dfsg-new-queue.debian.org/reviews/fmtlib
