This is an automated message from the Debian DFSG, Licensing & New
Packages Team.
The Debian NEW review of yarf 3.24.22+ds-1 has been completed.
Decision: ACCEPTED
Reviewer: Andrew McMillan
Review comment:
Hi,
A couple of issues you should perhaps look at...
1. [important] [packaging] Cursor-detection keyword is broken: the ONNX model
it loads was excluded from the source and is not documented
- Files: `yarf/rf_libraries/libraries/image/cursor_detector.py`,
`debian/copyright`, `debian/README.Debian`
- Evidence: `_MODEL_PATH = Path(__file__).parent /
"yolo26_mouse_detector.onnx"` followed by `self._session =
ort.InferenceSession(str(_MODEL_PATH))`; `Files-Excluded:
*/yarf/rf_libraries/libraries/image/yolo26_mouse_detector.onnx`; README.Debian
documents only the RapidOCR→Tesseract swap.
- Problem: The repack excludes the YOLO ONNX weights (presumably for
license/provenance reasons), but no file in the tree is left at
`yolo26_mouse_detector.onnx`, and `CursorDetector.__init__` unconditionally
asks onnxruntime to open it. Using the shipped 'Find Cursor Position' keyword
therefore raises FileNotFoundError at runtime instead of degrading gracefully,
and nothing in README.Debian or the manpage tells the user this feature is
absent.
- Fix: Either ship the model if its license permits (and add a stanza for it),
or make CursorDetector handle the missing file (return None / raise a clear
error) and explicitly document the absent model and the broken keyword in
README.Debian.
2. [minor] [packaging] Installed module version (3.24.21) does not match the
package version (3.24.22+ds)
- Files: `debian/patches/0001-Set-project-version.patch`
- Evidence: The patch sets `version = "3.24.21"` in pyproject.toml while
debian/changelog and the .dsc are `3.24.22+ds-1`.
- Problem: The wheel's metadata is built from that version, and main.py
computes `YARF_VERSION = version.parse(metadata.version("yarf"))`, so `yarf`
will report 3.24.21 and the `yarf:version:` tags in suites compare against the
wrong number. A user (or tooling) checking versions gets a value inconsistent
with the installed package version.
- Fix: Set the version in patch 0001 to `3.24.22` to match the source package
version (or state plainly that 3.24.21 is deliberate and why).
Thanks!
Full review details: https://dfsg-new-queue.debian.org/reviews/yarf
