This is an automated message from the Debian DFSG, Licensing & New Packages Team.
The Debian NEW review of openmpi 6.0.0~rc2-3 has been completed. Decision: ACCEPTED Reviewer: Andrew McMillan Review comment: Hi, Some interesting licensing observations which really should be resolved, but the package is accepted as-is since it is already in Debian... A bunch of other minor notes you could do - the debian/watch thing might just be because this is an experimental packaging of a pre-release, etc. 1. [important] [licensing] Vendored 3rd-party/treematch library is CeCILL-B but debian/copyright covers it under the Open MPI licence (Files: *) - Files: `debian/copyright`, `3rd-party/treematch/LICENSE`, `3rd-party/treematch/fibo.c`, `3rd-party/treematch/uthash.h`, `3rd-party/treematch/tm_mt.c`, `docs/license/treematch.txt` - Evidence: `fibo.c`: "This software is governed by the CeCILL-B license under French law..." and `LICENSE` begins "CeCILL-B FREE SOFTWARE LICENSE AGREEMENT"; `docs/license/treematch.txt` is the full CeCILL-B text (index.rst lists Treematch among "Redistributed code"). debian/copyright has no stanza for `3rd-party/treematch/*`, so every file falls under `Files: *` / `License: other`. - Problem: Treematch is a third-party codebase (Inria's TreeMatch) built into the shipped binaries (ompi/mca/topo/treematch links the 3rd-party library). Labeling it with the Open MPI per-file licence and OMPI copyright holders misstates its licence and removes CeCILL-B's attribution terms; `uthash.h` (BSD-2-Clause, Troy D. Hanson) and `tm_mt.c` (BSD-3-Clause, Matsumoto et al.) carry separate notices. CeCILL-B is DFSG-free, so this is a d/copyright accuracy defect, not a non-free upload. - Fix: Add a `Files: 3rd-party/treematch/*` stanza with the Inria copyright and `License: CeCILL-B` (full text supplied in the file), plus separate BSD-2-Clause/BSD-3-Clause notes for uthash.h and tm_mt.c. 2. [important] [licensing] ptmalloc stanza claims FSF-2001/LGPL-2; actual files are public-domain dlmalloc and BSD-3-Clause-Open-MPI - Files: `debian/copyright`, `oshmem/mca/memheap/ptmalloc/malloc.c`, `oshmem/mca/memheap/ptmalloc/memheap_ptmalloc.c` - Evidence: debian/copyright: `Files: oshmem/mca/memheap/ptmalloc/*` with `Copyright: (C) 2001 Free Software Foundation, Inc.` `License: LGPL-2`. malloc.c: "This is a version (aka dlmalloc) of malloc/free/realloc written by Doug Lea and released to the public domain" (adapted for ptmalloc3 by Wolfram Gloger); memheap_ptmalloc.c: `SPDX-License-Identifier: BSD-3-Clause-Open-MPI`. - Problem: No file in that directory is LGPL or FSF-2001: the vendored allocator is Doug Lea's public-domain dlmalloc, and the memheap glue files are Open MPI's BSD licence. The stanza overrides the catch-all with a wrong holder and licence for these files. - Fix: Split the stanza: `malloc.c` → `License: public-domain` (with the required explanation), `memheap_ptmalloc*` → `License: BSD-3-Clause-Open-MPI` under the Files:* licence, dropping the stale FSF/LGPL claim. 3. [minor] [licensing] Bundled hwloc/libevent tarballs claimed under the Open MPI licence by Files: * and left in the source - Files: `debian/copyright`, `3rd-party/hwloc-2.15.0.tar.gz`, `3rd-party/libevent-2.1.12-stable-ompi.tar.gz` - Evidence: Both tarballs are present in the source and in the orig tarball; `debian/copyright` has no stanza and no `Files-Excluded` for them, so `Files: *` / `License: other` (the Open MPI licence) covers them. The content is hwloc (BSD-3-Clause) and libevent (BSD), documented in `docs/license/hwloc.txt` and `docs/license/libevent.txt`. - Problem: The catch-all asserts the Open MPI licence for third-party BSD code, which is inaccurate; the tarballs are dead weight because the build uses `--with-hwloc=external --with-libevent=external`. All free, so not a DFSG violation. - Fix: Add a `Files: 3rd-party/*.tar.gz` stanza with the hwloc/libevent licence (and holders) or list them under `Files-Excluded` in debian/copyright (with a matching `debian/source/options` source-exclusion if repacking). 4. [minor] [licensing] Files: * Copyright list omits copyright holders present in the sources - Files: `debian/copyright`, `ompi/communicator/comm.c`, `configure.ac`, `config/opal_check_ze.m4`, `ompi/communicator/Makefile.am` - Evidence: comm.c: `Copyright (c) 2023-2025 Advanced Micro Devices, Inc.`, `Copyright (c) 2026 Jeffrey M. Squyres.`, `Copyright (c) 2026 Musawer Ahmad Saqif.`; configure.ac:31 and opal_check_ze.m4 carry AMD/JS copyright. None of AMd, Squyres or Saqif appear in the `Files: *` Copyright field (NVIDIA listed only to 2024, BULL S.A.S. only 2009-2015). - Problem: Copyright holders named in file notices are not represented in debian/copyright. - Fix: Add the missing holders (and refresh years, e.g. NVIDIA 2026, BULL S.A.S. 2025) to the `Files: *` Copyright field. 5. [minor] [packaging] Two patches ship malformed DEP-3 headers - Files: `debian/patches/oac-patches.patch`, `debian/patches/version.patch` - Evidence: oac-patches.patch begins `Description: <short summary of the patch>` followed by the whole `TODO:` template and a stray `pmix (5.0.2-1) UNRELEASED` changelog block; version.patch has two `Description:` lines (`Description: Fix version of ` and `Description: update VERSION file...`). - Problem: Poor patch metadata for a sponsored upload; oac-patches documentation does not describe its real purpose (vendoring the config/oac autoconf submodule). - Fix: Clean the header of oac-patches.patch (real Description, Origin/Forwarded, Last-Update) and merge the duplicated Description in version.patch. 6. [minor] [packaging] debian/watch is in the old version 4 format - Files: `debian/watch` - Evidence: `version=4` - Problem: Version 5 is the current format of `debian/watch`. - Fix: Convert it to version 5; a mechanical conversion is included below. ================================================================================ Version: 5 Source: https://www.open-mpi.org/software/ompi/ Matching-Pattern: .*/.*/openmpi-([\d+\.]+)@ARCHIVE_EXT@ ================================================================================ 7. [minor] [packaging] uscan finds only upstream versions older than the packaged one - Files: `debian/watch` - Evidence: upstream `5.0.11`, packaged `6.0.0~rc2` - Problem: The newest version uscan finds with `debian/watch` is older than the version in `debian/changelog`, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare. - Fix: Check where `debian/watch` looks and how it mangles versions. Thanks! Full review details: https://dfsg-new-queue.debian.org/reviews/openmpi
