DFSG NEW review for golang-github-rust-secure-code-go-rustaudit version 0.0~git20250226.e20ec32-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is a small pure-Go library: eight upstream files plus .github/ and test/, no vendored code, no binaries, no minified assets. The only licence notice is LICENSE, an unmodified MIT/Expat text naming Microsoft Corporation; debian/copyright is DEP-5, names that holder for Files: * and the packager for debian/*, uses the correct short name Expat and reproduces the full licence text. Nothing non-free and nothing of unclear provenance was found, and the packaging and upstream licences are identical, so there is no compatibility question.

Packaging

Modern, idiomatic Go packaging: debhelper compat 14, dh-go's golang buildsystem with an explicit builddirectory, dpkg-build-api (= 1), correct Standards-Version 4.7.4 against Policy 4.7.4.1, salsa-ci and gbp configuration, upstream metadata, and a README.source that explains the snapshot version and pristine-tar orig tarball. Dependencies are correct and all satisfiable in the archive (dh-go 1.69, golang-github-stretchr-testify-dev, dpkg-build-api provided by dpkg-dev). The one substantive remark is that no test runs anywhere, which is documented in debian/rules but leaves the declared autopkgtest-pkg-go testsuite vacuous.

Issues

1. [minor] [packaging] override_dh_auto_test disables the test suite, and the autopkgtest-pkg-go testsuite therefore never tests anything

• Files: debian/rules:6-10, debian/control:11
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules: override_dh_auto_test: ... # Neither the fixtures nor a Rust toolchain are available here. / :; debian/control: Testsuite: autopkgtest-pkg-go; /usr/bin/dh_golang_autopkgtest ends with call_rules build, and rustaudit_test.go does os.Open("crate_with_features_bin") with log.Fatal(err) on failure.
• Problem: dh_auto_test is replaced by a no-op, so the build compiles the library but never compiles or runs rustaudit_test.go. The autopkgtest generated from Testsuite: autopkgtest-pkg-go runs debian/rules build and so inherits the same no-op: the declared test suite passes without executing a single test. The stated reason (test fixtures, built by test/Dockerfile from cargo-auditable and a wasm32 Rust target, are not shipped) is real, and cargo-auditable 0.7.7 is in the archive, but the result is a package with no effective test coverage and a testsuite that cannot fail.
• Fix: Keep the skip if the fixtures cannot be produced, but make the coverage explicit rather than vacuous: either generate the fixtures at build time from Debian's cargo-auditable (with rustc and, for wasm_crate.wasm, a wasm32 std), or provide debian/tests/control with a test that exercises what can be run (for example a fuzz-regression or round-trip test over generated audit data) instead of relying on the auto-generated testsuite. If neither is possible, say in debian/README.source that upstream's tests are skipped for lack of fixtures, so a sponsor need not rediscover it.

Verified

• Full tree listed with glob (gitignore: false): upstream is .gitignore, LICENSE, README.md, go.mod, go.sum, rustaudit.go, rustaudit_test.go, .github/workflows/ci.yml and test/Dockerfile; debian/ has README.source, changelog, control, copyright, gbp.conf, rules, salsa-ci.yml, watch plus source/{format,lintian-overrides} and upstream/metadata. .pc/ was ignored throughout.
• debian/copyright read in full: DEP-5, correct Format URL, Files: * (Copyright: Microsoft Corporation, License: Expat) and Files: debian/* (2026 Juan Manuel Méndez Rey, Expat), with the Expat text reproduced after both. The Copyright line has no year because LICENSE's line is Copyright (c) Microsoft Corporation. with none, and the Comment explains the microsoft/go-rustaudit to rust-secure-code transfer.
• LICENSE read in full: unmodified MIT/Expat text, sole holder Microsoft Corporation, matching the Files: * stanza; there is no other LICENSE/COPYING/NOTICE anywhere in the tree (searched with gitignore: false).
• Tree-wide grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public, GNU Lesser, Apache License, Mozilla Public, public domain, All rights reserved matched only LICENSE and debian/copyright; rustaudit.go and rustaudit_test.go carry no headers, so no second holder or licence exists to be listed. No vendored third-party source is present: go.mod/go.sum only name modules (testify, go-spew, go-difflib, yaml.v3, check.v1) that Debian ships separately, and no vendor/ directory exists.
• No built artifacts, archives, .so, .jar, .class, minified JS/CSS, PDFs or fonts in the tree; the only generated-file-looking item is test/Dockerfile, which is an upstream fixture-generation recipe (clones cargo-auditable, builds crate_with_features_bin and wasm_crate.wasm) used by upstream CI and test/README-style instructions, not by the Debian build, and .gitignore lists those two fixture names, which confirms they are generated and not shipped. Nothing in the package asks the reviewer to fetch anything.
• .github/workflows/ci.yml read: upstream GitHub Actions workflow (setup-go 1.18, golangci-lint, docker fixture generation, go test); it is build machinery, carries no licence notice beyond the package-wide MIT and is inert for the Debian build.
• debian/control read in full: Build-Depends debhelper-compat (= 14), dh-go, dpkg-build-api (= 1), golang-any, golang-github-stretchr-testify-dev; single Architecture: all -dev package with Multi-Arch: foreign (Go team practice) and XS-Go-Import-Path matching go.mod's module path. Checked with apt-cache: dh-go 1.69 (provides the golang addon and dh_golang_autopkgtest), golang-github-stretchr-testify-dev 1.11.1-2 and dpkg-build-api provided by dpkg-dev 1.23.11 all exist, so no dependency is unsatisfiable; the testify dev dependency is odd-numbered only in appearance, since testify is a direct (non-indirect) require in go.mod.
• Standards-Version 4.7.4 against policy: the reviewing system's Policy is 4.7.4.1, so the first two components match and nothing is due here.
• debian/changelog: 0.0~git20250226.e20ec32-1, distribution unstable, Closes: #1148629, dated 2026-09-22 (before today), Go-team 0.0~gitDATE.SHORTHASH snapshot scheme matching README.source's account of the pinned commit and pristine-tar orig tarball; version, tarball name and dsc agree.
• debian/rules read in full: dh $@ --builddirectory=debian/_build --buildsystem=golang --with=golang plus the documented no-op test override; no patches (no debian/patches, source format 3.0 (quilt)), so nothing to DEP-3 about; compat 14 means the missing nocheck check in the target is exactly what dh does since compat 13 and is not a fault.
• debian/README.source, gbp.conf, salsa-ci.yml, upstream/metadata, source/format, source/lintian-overrides read; the overrides file documents the dh-go/dh-golang addon-name mismatch and the Go-team filename length, both of which are explainable.
• orig tarball listing compared with the tree: go-rustaudit/ holding .github/, .gitignore, go.mod, go.sum, LICENSE, README.md, rustaudit.go, rustaudit_test.go and test/, i.e. nothing was removed or repacked, and there is no Files-Excluded to contradict. The .dsc's checksums and fields agree with debian/control.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20250226.e20ec32, packaged 0.0~git20250226.e20ec32).

Not confirmed

None.

Proposed changes

None.