Bug#907072: lintian: verify AppStream metainfo metadata_license matches debian/copyright

[Chris Lamb <lamby@debian.org>]

tags 907072 + moreinfo
thanks

Hi dkg,

> The gnupg2 source package version 2.2.9-1 has this mismatch because i
> was sloppy.

So, debian/copyright contains:

   Files: debian/org.gnupg.scdaemon.metainfo.xml
   Copyright: 2017 Daniel Kahn Gillmor <dkg@fifthhorseman.net>
   Comment: This file is licensed permissively for the sake of AppStream
   License: CC0-1.0

... and debian/org.gnupg.scdaemon.metainfo.xml contains:

   <?xml version="1.0" encoding="UTF-8"?>
   <component>
     <id>org.gnupg.scdaemon</id>
     <metadata_license>GPL</metadata_license>
     <name>scdaemon</name>
     <summary>USB SmartCard Readers</summary>
     <description>
       <p>
         GnuPG's scdaemon provides access to USB tokens and smartcard
         readers that provide cryptographic functionality (e.g. use of
         protected secret keys).
       </p>
     </description>
   [...]

... which is installed to /usr/share/metainfo via debian/
scdaemon.install.

Thus, whilst we can rely on such metadata files existing in /usr/share/
metainfo/*.xml (or similar) we don't know which file in the source tree
this originated from (and thus it's license).

Ideas?


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-