#1109762 ITP: leancrypto -- library for quantum-safe cryptographic algorithms

Package:
wnpp
Source:
wnpp
Submitter:
Simon Josefsson
Date:
2025-11-29 16:58:18 UTC
Severity:
normal
#1109762#5
Date:
2025-07-23 11:18:04 UTC
From:
To:
* Package name    : leancrypto
  Version         : 1.5.1
  Upstream Contact: https://github.com/smuellerDD/leancrypto
* URL             : https://www.leancrypto.org/
* License         : Apache-2.0, BSD-3-Clause, CC0, Expat, GPL-3, public-domain
  Programming Lang: C
  Description     : library for quantum-safe cryptographic algorithms

This is an ITP to get the ball started on packaging leancrypto for
Debian, I intend to put it on salsa shortly.

/Simon
#1109762#10
Date:
2025-07-23 21:23:05 UTC
From:
To:
Packaging is materializing here:

https://salsa.debian.org/debian/leancrypto/

Automating debian/copyright generation somehow would help.

/Simon
#1109762#15
Date:
2025-07-25 08:03:28 UTC
From:
To:
Working on 'leancrypto' packaging (which now build! see salsa pipeline
below) made me consider life choices wrt debian/copyright.

For several of my packages, I use 'lrc' to audit that debian/copyright
file matches what 'licensecheck' thinks the license of files are.

But what is the best tool to GENERATE a debian/copyright in a package
with 1500+ files with different copyright and license information?

I have heard about 'clscan' but using it does not seem straightforward
to use, or at least I didn't understand how to use it.  Are there any
gentle introductions to it?

I expect a tool to be able to either CREATE a template debian/copyright
or UPDATE an existing debian/copyright (made from an earlier template)
by searching through the content of a directory.

A tool like that doesn't feel like rocket science these days.

Could someone summarize the alternatives and share their experience with
some of them?

/Simon

Simon Josefsson <simon@josefsson.org> writes:

/Simon
#1109762#20
Date:
2025-07-25 08:17:01 UTC
From:
To:
Le ven. 25 juil. 2025 à 10:08, Simon Josefsson <simon@josefsson.org> a
écrit :

Did you have a look at
https://wiki.debian.org/CopyrightReviewTools
?
#1109762#30
Date:
2025-07-25 15:20:40 UTC
From:
To:
Best tool at parsing individual text files is definitely licensecheck.

It doesn't reconcile against the existing d/copyright and doesn't group
years very well. And doesn't ignore known files (.git, COPYING, etc...)
with certain args. And doesn't handle binary files gracefully.
Still, excellent recognition of license/copyright on text files.

decopy reconciles against existing d/copyright, but recognises a limited
set of licenses and they have to be cleanly written.
Handles mimetypes and checks images/fonts/pdfs/etc through exiftool though.
- `licensecheck --deb-machine --recursive .`
- `decopy`

Compare and see which one looks more accurate. You'll probably have to
do a lot of cleanup, globbing and grouping.

Neither will be usable as-is since upstream attached their copyright and
disclaimer only to every file. And I think upstream is dual licensed to
begin with, so tools won't recognise that.

Alternatively, since upstream tracks 3rd party licenses in their LICENSE
file, I would consider the manual route if that information is accurate
enough.