Comment 1 for bug 1248000

I've reviewed lp:~utlemming/+junk/mdata_tools/ for an upload to universe.

In general the packaging is of a high quality. Thank you Ben! A few minor issues that I've patched (attached):

* Fix LP bug reference number in debian/changelog.
* Convert debian/copyright to machine-readable dep5 format (current best practice).
* Rename get-packaged-orig-source debian/rules target to get-orig-source (Debian policy section 4.9).
* Fix get-orig-source target to produce orig tarball with directory prefixed.
* Fix get-orig-source target to clean up after itself.

Some items not fixed; I don't think these are major enough to block upload. I suggest we create bugs for these after the package is accepted into NEW:

* get-orig-source target should work from any directory according to Debian policy; but it's an optional target and the spirit of the policy is to make it possible for anybody to see and reconstruct the orig tarball, which is fulfilled here.

* /lib/smartdc/mdata-get is non-standard, and I think deserves some documentation in the packaging. I understand from Ben that it is a legacy which some people might expect, and that it is used for boot when cloud-init isn't working. Do we need to explain this in a README.Debian, perhaps?

Recommendations to upstream:

Please drop "All rights reserved" from the copyright notice; this is not required any more and contradicts the licence statement. Please also explicitly add the licence to each source file. This would make the licensing situation completely unambiguous.

Ideally each source file should have copyright notices, a licence statement, and no "all rights reserved" statement. Right now, they all have a copyright and "all rights reserved" but no licence statement. reqid.c has nothing.

Debian appear to accept the contradiction in general because the intent to licence MIT is clear, so I think this is OK for Ubuntu too. However, it's common practice to annotate source files with a copyright notice and licence; the upstream source files in this project do state copyright and "All rights reserved" but do not state licences in each file. I think this is still acceptable, but more contradictory than what Debian have accepted previously. See http://lists.debian.org/debian-mentors/2013/07/msg00149.html for discussion.

One issue blocking upload (at least for me):

crc32.c contains a copyright statement from Gary S. Brown but does not include licensing information. Thus it is not clear if this file is re-distributable. I found http://lists.debian.org/debian-legal/2003/02/msg00100.html which suggests that Gary S. Brown has never explicitly licensed this code for redistribution. Do we know if it is permitted for this file to be released under the MIT licence? Given the triviality of the code, I guess it is probably easiest to replace crc32.c with a DFSG-compliant implementation? These appear to be available, but it might need some API adaptation.