DFSG NEW review for rust-apache-avro-derive version 0.22.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The code is DFSG-free: everything is Apache-2.0, the full text is in /usr/share/common-licenses, the tree carries the ASF header, and the LICENSE and NOTICE files are the standard Apache ones. debian/copyright is DEP-5 with a correct Format and a debian/* stanza overriding Files: *, but it is not complete: it attributes the whole tree to the ASF alone, while src/case.rs and src/utils.rs contain code copied from serde and credited there to David Tolnay, and the Debian patch appends 2026 Debian-authored tests to src/lib.rs. No non-free terms, no built-only files and no embedded third-party libraries otherwise.

Packaging

Standard debcargo packaging: debhelper compat 13 with dh-sequence-cargo, correct Build-Depends-Arch and runtime Depends against packages that exist with satisfying versions (darling 0.24.1, syn 3.0.9, uuid 1.29.0, rustversion 1.0.23, serde-json 1.0.154, macrotest 1.2.1, trybuild 1.0.121, proptest 1.11.0, pretty-assertions 1.4.1), correct Provides/Multi-Arch/Breaks, 3.0 (quilt), three DEP-3-documented patches explained by README.source, an upstream/metadata file, a sensible description, and three autopkgtests. Standards-Version 4.7.4 matches Policy 4.7.4.1. The only open point is that the autopkgtest dependency on the not-yet-present parent library cannot be verified.

Issues

1. [important] [licensing] Files: * names only the ASF although src/case.rs and src/utils.rs are copied from serde, originally written by David Tolnay

• Files: debian/copyright:5-8, src/case.rs:20, src/utils.rs:26
• Basis: checked, in the package or with a reference tool
• Evidence: src/case.rs:20 //! Code copied from serde <https://github.com/serde-rs/serde/blob/master/serde_derive/src/internals/case.rs>; src/utils.rs:26 /// Copied from serde, originally written by David Tolnay.; debian/copyright has only Files: * / Copyright: / 2010-2025 The Apache Software Foundation.
• Problem: The two files contain code whose copyright belongs to serde's author, not the ASF, even though serde's Apache-2.0 branch allows distributing it here under Apache-2.0. debian/copyright therefore states a holder that does not cover those portions and omits the one that does, so it does not accurately describe every file (Policy 12.5; copyright-format 6.7 requires the real holders).
• Fix: Add a stanza covering src/case.rs and src/utils.rs (placed after Files: *) naming the serde author, e.g. Copyright: 2016-2025 David Tolnay <dtolnay@gmail.com> plus the Serde developers, with License: Apache-2.0 or MIT, and a Comment noting that the code is used here under Apache-2.0.

2. [minor] [licensing] debian/copyright attributes the Debian-added test module in src/lib.rs to the ASF, not to its author Steffen Moeller

• Files: debian/copyright:5-8, src/lib.rs:90-110, debian/patches/darling-0.24-syn-3.patch
• Basis: checked, in the package or with a reference tool
• Evidence: The patch appends +#[cfg(test)] mod debian_syn3_tests { ... } (two test functions, 2026) to src/lib.rs; debian/copyright's Files: * (src/lib.rs included) says Copyright: 2010-2025 The Apache Software Foundation. The Files: debian/* stanza names Steffen Moeller but does not cover code installed from src/.
• Problem: Code written by the Debian contributor and shipped in the crate source is not credited to him in the copyright file; the licensing (Apache-2.0 via both stanzas) is right, but the stated holder for src/lib.rs is incomplete.
• Fix: Either list Steffen Moeller's 2026 copyright for the added portion in a stanza covering src/lib.rs, or add him to the Files: * Copyright field, and keep the Apache-2.0 licence.

Verified

• The prescan's author check reported no unlisted holder; I read every file header in src/ (18 files) and tests/ (including all tests/expanded/.rs and tests/ui/.rs) and each carries the ASF 'Licensed to the Apache Software Foundation ... Apache License, Version 2.0' header; Cargo.toml declares license = "Apache-2.0".
• LICENSE is the unmodified Apache License 2.0 text (202 lines, ends with the standard APPENDIX); NOTICE is the standard ASF notice naming Flavien Raynaud as the donor of the initial implementation, a credit and not a separate copyright holder, so not listing him separately is correct.
• No non-free wording anywhere: no 'non-commercial', 'no modification', field-of-use or CC-NC/ND text; no SPDX identifiers or other licence families (MIT/BSD/GPL/MPL) in the tree, apart from the serde-derived code reported above.
• tests/expanded/.expanded.rs are macrotest output fixtures generated from the adjacent avro_.rs files, which are present, with the generating test in tests/expand.rs; tests/ui/*.stderr are trybuild expected diagnostics for the adjacent .rs files; tests/derive.proptest-regressions is proptest seed data. None is a built binary or missing its source.
• Cargo.lock and Cargo.toml are generated files (Cargo.toml marked 'AUTOMATICALLY GENERATED BY CARGO', Cargo.toml.orig beside it); the lock still names darling 0.23.0/syn 2.0.119, but dh-cargo's buildsystem deletes Cargo.lock in configure (rm_files("Cargo.lock") at /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm:164), so the stale versions cannot affect the build.
• debian/copyright.debcargo.hint is debcargo's generated template with FIXME/UNKNOWN placeholders; it is not the shipped copyright and its content is superseded by debian/copyright, so its placeholders are not a finding.
• Packaging files read in full: control, rules, changelog, source/format, README.source, debcargo.toml, upstream/metadata, tests/control, patches/series and all three patches. All patches have DEP-3 Description/Author/Forwarded/Last-Update headers; the darling/syn patch changes only the two dependency versions and two pop() calls plus added tests; complete-doctest.patch and restore-test-library-dependency.patch are limited to the doc example and the dev-dependency.
• Dependencies checked against the archive with apt-cache: librust-darling-0.24-dev (0.24.1-1), librust-syn-3+full-dev and +fold-dev (3.0.9-1), librust-uuid-1+serde-dev (1.29.0-1), librust-rustversion-1+default-dev (1.0.23-1), librust-serde-json-1+std-dev (1.0.154-1), librust-macrotest-1-dev (1.2.1-2), librust-trybuild-1+default-dev (1.0.121-1), librust-proptest-1+std-dev (1.11.0-2), librust-pretty-assertions-1+std-dev (1.4.1-1), dh-cargo 34 providing dh-sequence-cargo; every version bound in control and tests/control is satisfied.
• Standards-Version 4.7.4 agrees with Policy 4.7.4.1 in its first two components, so it is current; compat 13 with dh $@ --buildsystem cargo and dh-sequence-cargo is correct, and no maintainer scripts exist.
• Changelog: 0.22.0-1, unstable, urgency medium, closes an ITP bug number, date matches the tree; Vcs-Git/Vcs-Browser point to the debcargo-conf tree for src/apache-avro-derive, and Homepage/upstream/metadata agree with Cargo.toml's repository field.
• uscan found the packaged version as the newest upstream release (upstream 0.22.0, packaged 0.22.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• librust-apache-avro-0.22+derive-dev, which all three Test-Commands in debian/tests/control depend on (and even the base librust-apache-avro-dev), is in neither the archive lists nor the NEW queue as of this snapshot; if the parent package is not accepted together with this one, the autopkgtests cannot be installed. The lists may lag the upload.
• Whether the two added syn-3 tests in src/lib.rs compile under the crate's syn feature set (only "full" and "fold" are enabled in Cargo.toml; they use syn::parse_quote! and into_token_stream) was not checked: the features may be unified in from darling, as happens upstream, and a test failure is not decisive here.

Proposed changes

None.