Upstream MEtadata GAthered with YAml (UMEGAYA)

/!\ This proposal is for all packages, not just science packages. Please ignore the fields that do not apply to your package.


This is an effort to collect meta-information about upstream projects in a file called debian/upstream/metadata in the source packages maintained in a publicly accessible version control system (VCSug), currently Subversion or Git. Since this information is directly accessed from the VCS, it can be updated without uploading the source packages to the Debian archive.

Proof of principle

To make the DebianMed web sentinels use the UDD to display bibliographic information about which academic article to cite when using our packages. This is currently done by collecting the information in the central file used to create the med-* metapackages. This work was announced in October 2012 in the Bits from Debian Pure Blends.

A UDD importer consisting of a gatherer and a UDD module is in development.

The date about bibliographic information is loaded in the bibref table of the UltimateDebianDatabase. The following UDD query outputs all source packages featuring bibliographic information. (The join is needed to exclude those references of packages that are not yet uploaded to Debian package pool but used in so called blends prospective packages.)

SELECT distinct s.source from bibref b join sources s on s.source = b.source;


This syntax is being formalised as DEP 12.

The debian/upstream/metadata file is in YAML format. BenFinney asks (2019-01-21): Which version of the YAML specification? Please link to the exact YAML specification that rules this format.

In its simplest form, the metadata file looks much like the stanza format used in Debian control files. Nevertheless, there may be sometimes unexpected behaviours, for instance field contents that have a colon inside have to be quoted in some cases. If in doubt, there are validators available, either on-line Online YAML Parser, or in command line (yamllint).


In alphabetic order. Let's try to use the same vocabulary as in DOAP as much as possible.

Fields that are the same as in DOAP are followed by an asterisk (“*”) after the field name.

The name of the large archive that the upstream work is part of, like CPAN.

Identification code in the Astrophysics Source Code Library

A URL to the list of known bugs for the project.
A URL that is the place where new bug reports should be sent.

The way the authors want their software be cited in publications. The value is a string which might contain a link in valid HTML syntax. (see discussion on Debian Science list)

URL to the upstream changelog.

One or more space separated Common Platform Enumerator values useful to look up relevant CVEs in the National Vulnerability database and other CVE sources. See CPEtagPackagesDep for information on how this information can be used. Example: "cpe:/a:ethereal_group:ethereal"

A URL to online documentation
A URL to a donation form (or instructions).
A URL to the online FAQ.
One or more sources of funding which have supported this project (e.g. NSF OCI-12345).
A URL to a gallery of pictures made with the program (not screenshots).
A URL to a upstream page containing more references.
One or more bibliographic references, represented as a mapping or sequence of mappings containing the one or more of the following keys. The values for the keys are always scalars, and the keys that correspond to standard BibTeX entries must provide the same content.

Author list in BibTeX friendly syntax (separating multiple authors by the keyword "and" and using as few as possible abbreviations in the names, as proposed in

Title of the book the article is published in
This is the digital object identifier of the academic publication describing the packaged work.
Editor of the book the article is published in
Hyperlink to the PDF file of the article.
International Standard Book Number of the book if the article is part of the book or the reference is a book
International Standard Serial Number of the periodical publication if the article is part of a series
Abbreviated journal name [To be discussed: which standard to recommend ?].
Issue number.
Article page number(s). [To be discussed] Page number separator must be a single ASCII hyphen. What do we do with condensed notations like 401-10 ?

ID number in the PubMed database.

Publisher of the book containing the article
Article title.

A BibTeX entry type indicating what is cited. Typical values are article, book, or inproceedings. [To be discussed]. In case this field is not present, article is assumed.

Hyperlink to the abstract of the article. This should not point to the full version because this is specified by Eprint. Please also do not drop links to pubmed here because this would be redundant to PMID.
Journal volume.
Year of publication
Optional: citation information can be restricted to some specific binary package of a multi-binary package if the reference is only concerning this package; Note: This is just a proposal and might change in the future
A URL to a registration form (or instructions). This could be registration of bug reporting accounts, registration for counting/contacting users etc.
This field shall point to external catalogs/registries of software. The field features an array of "Name (of registry) - Entry (ID of software in that catalog)" pairs. The names and entries shall only be names, not complete URIs, to avoid any bias on mirrors etc. Example:

    - Name:
      Entry: clustalw
    - Name: OMICtools
      Entry: OMICS_02562
    - Name: SciCrunch
      Entry: SCR_002909
URL to a repository containing the upstream sources.
A URL to browse the repository containing the upstream sources.

One or more URLs to upstream pages containing screenshots (not, represented by a scalar or a sequence of scalars.

Which person, mailing list, forum,… to send security-related messages in the first place.
URL to an web page where the packaged program can also be used.


Let's discuss here, on a mailing list (debian-med or debian-qa), or a discussion page, if available.

The data is not really Debian-specific, lets put it outside Debian and use mechanisms for Mapping package names across distributions.

To do: formalise the above using Config::Model::Backend::Yaml, and generate docs as explained in .

* In addition to ?DOAP, other Semantic Web ontologies/namespaces/schemas should be reused in order to not reinvent the wheel, and enable such metadata to participate to the ?Semantic Web (see also Open Linked Data matters). As such, SPDX would be an interesting standard to link to, as well as ADMS.F/OSS, for packages description, IMHO. Syntactically, any form of RDF would be interesting to explicitely convey the prefixes in the field names... and I'm not sure it can be done in ?YAML -- OlivierBerger


BibTeX: Currently there is no way to let {} that might be used to force capitalisation in BibTeX entries slip through from debian/upstream/metadata into BibTeX

It seems that the python library which is used to parse debian/upstream/metadata files for inclusion into UDD has a bug when values are of the form <d:d> (decimal_number colon decimal_number). You should include strings like this into single quotes. (see Discussion on Debian Med mailing list)


Here is a template for a debian/upstream/metadata file which can be used to specify citations:

  Author: <please use full names and separate multiple author by the keyword "and">


You can find lots of examples using


The most common error is that you are not allowed to use the string ": " inside a yaml value since this is separating key-value pairs. So please quote such values or use a separate line.

Lintian check

Simon Kainz has written some preliminary lintian check to verify the syntax of debian/upstream/metadata files (see also 731340). Any testing is welcome. A simple lintian check for YAML syntax was implemented by Petter Reinholdtsen (see 813904). Andrius Merkys is working on validator for values in debian/upstream/metadata files.

Deprecated features

Deprecated fields

According to DEP5 these fields belong to debian/copyright and should not be duplicated in debian/upstream/metadata:

Name *
Upstream name of the packaged work.
Which person, mailing list, forum,… to send messages in the first place.


These fields must still be allowed, as not all packagers wish to use DEP 5.

Hyphen shortcut for mappings

Only a subset of YAML is used: sequences are only expected to contain scalars and mappings are only expected to contain a scalar or a mapping, but with only one level of imbrication.

In addition, two conventions that are not part of the YAML format are used:

  Bar: baz

Foo-Bar: baz

Other Upstream metadata

Edam files

The EDAM ontology provides some means to classify software used in bioinformatics. The Debian Med team intends to link all bioinformatic tools with the EDAM ontology. To approach this the YAML file debian/upstream/edam can provide extra information.


EDAM (1.13) (currently version 1.13 is the latest EDAM version)
EDAM topic
EDAM scopes


AppStream was initially conceived to provide a user-visible app store for the desktop, as such there is overlap in the project metadata, but not all the fields listed above are supported.