#1140537 licenserecon: mishandles wildcards

Package:
licenserecon
Source:
licenserecon
Description:
Reconcile licenses from debian/copyright against licensecheck
Submitter:
Julian Andres Klode
Date:
2026-08-07 20:19:01 UTC
Severity:
normal
Tags:
#1140537#5
Date:
2026-06-22 10:26:22 UTC
From:
To:
Wildcards like * and ? match / in the specification, yet
the attached test case produces a mismatch:

Expat            | Apache-2.0        a/b/test.c
#1140537#10
Date:
2026-06-22 10:58:00 UTC
From:
To:
Hi Julian,

licenserecon handles wildcards using /usr/bin/ls
 From your example:

ls */*.c
ls: cannot access '*/*.c': No such file or directory

However;
ls */*/*.c
a/b/test.c

ISTM that it's your test copyright that mishandles wildcards ;-)

Cheers,
Peter
#1140537#15
Date:
2026-06-22 20:15:00 UTC
From:
To:
On second thoughts, I realise you are correct here.

DEP-5 spec says; ...

"Both [wildcards] match slashes (/) and leading dots, unlike shell globs.
The pattern *.in therefore matches any file whose name ends in .in anywhere in the source tree,
not just at the top level."

See also https://bugs.debian.org/1086136

With your example file
Files: a/*.c

would work with lrc as it stands.
But if there are multiple asterisks in the Files: field
lrc currently reverts to a shell glob.

Are you having issues with a particular package that I could look at?

Regards,
Peter
#1140537#22
Date:
2026-08-06 23:34:05 UTC
From:
To:
I just hit this bug, so I can give you an example.

Qtpim6 upstream has CMakeLists.txt files licensed under BSD-3,
regardless of where they're located in the source tree. The rest of the
source tree uses various other licenses. So in d/copyright, I have
*/CMakeLists.txt:

https://salsa.debian.org/qt-kde-team/extras/qt6-pim/-/blob/master/debian/copyright?ref_type=heads#L18

(The top-level 'CMakeLists.txt' line is probably unnecessary but I don't
feel like removing it right now.)

The files in the tests/ directory are all licensed QtCommercial or GPL-3:
https://salsa.debian.org/qt-kde-team/extras/qt6-pim/-/blob/master/debian/copyright?ref_type=heads#L35

Obviously the */CMakeLists.txt pattern matching above should override
that tests/* license clause, according to
https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/#files-field

However, when a reviewer ran licenserecon on my first upload of qtpim6,
it triggered incorrect errors for the various CMakeLists.txt files in
tests/auto/:

https://dfsg-new-queue.debian.org/reviews/qt6-pim

You can find the upstream source for qt6-pim here:
https://invent.kde.org/qt/qt/qtpim
#1140537#27
Date:
2026-08-07 20:16:09 UTC
From:
To:
On Thu, 6 Aug 2026 19:34:05 -0400 Andres Salomon <dilinger@queued.net>  wrote:
[...]
 >

This review got overwritten by a newer one, you can see the old one here:

https://dfsg-new-queue.debian.org/reviews/qt6-pim/6.12.0~beta1-1/36d16a08