DFSG, Licensing & New Packages Team

Hi,

A few issues with this one. Possibly something has gone wrong with your automation for #2?

1. [important] [licensing] debian/copyright mis-attributes the whole vendored toml-test subtree to BrightShard
   (MIT-or-Apache-2.0); only toml-test/LICENSE is matched to TOML authors / MIT

• Files: debian/copyright:10-12, .gitmodules, tests/toml_test.rs
• Evidence: Stanza is Files: toml-test/LICENSE / Copyright: 2018 TOML authors / License: MIT. toml-test/LICENSE itself is The MIT License (MIT) / Copyright (c) 2018 TOML authors. .gitmodules declares [submodule "toml-test"] path = toml-test url = https://github.com/toml-lang/toml-test, and tests/toml_test.rs comments say git submodule foreach git pull origin main.
• Problem: Per the copyright-format spec, a Files pattern like toml-test/LICENSE matches only that exact file; a tree is selected with toml-test/*. Every other file of the vendored toml-test (runner.go, json.go, gen.py, cmd/toml-test/.go, tests/.toml and .multitest data, specs/v1.0.0.md and v1.1.0.md, README.md, CHANGELOG.md, go.mod/go.sum, .github/workflows/test.yml) therefore falls through to the Files: * catch-all, which claims Copyright: BrightShard and License: MIT or Apache-2.0. Those files are copied from the toml-lang/toml-test repository, (c) TOML authors, licensed MIT only (repo-level LICENSE) - not BrightShard's, and not Apache-2.0. The binary -dev package ships the whole crate source (dh-cargo's get_sources excludes only .git/.pc/debian/target), so the wrong holder/licence pair is installed.
• Fix: Cover the tree: change the stanza to Files: toml-test/* (optionally adding toml-test/tests/* et al. if preferred, though the doc's foo/* covers subdirs), keeping Copyright: TOML authors (2018-present, see CHANGELOG dates) and License: MIT; keep the Files: * stanza for the rest of the crate. Re-running debcargo's licence-hint comments already name this exact spot (debian/copyright.debcargo.hint: 'UNKNOWN-LICENSE; FIXME (overlay) ... Please review them').

2. [important] [packaging] debian/cargo-checksum.json holds an error placeholder instead of real per-file
   checksums

• Files: debian/cargo-checksum.json
• Evidence: File content is exactly {"package":"Could not get crate checksum","files":{}}.
• Problem: A debcargo-generated package normally ships the crates.io package checksum plus per-file SHA-256 hashes here. dh-cargo's configure step runs cp debian/cargo-checksum.json .cargo-checksum.json (cargo.pm), and the install step places it inside the installed registry crate /usr/share/cargo/registry/boml-2.0.0/.cargo-checksum.json; cargo uses that file to verify boml whenever another Debian crate resolves it as a registry dependency, so the empty/error placeholder is at best wrong and can break the binary build or every downstream consumer (including the autopkgtest's own cargo prepare-debian). This is abnormal for any debcargo package and a sponsor would require it regenerated.
• Fix: Regenerate the package from the real crates.io tarball with debcargo so package and files contain genuine SHA-256 checksums (and confirm the resulting binary package builds).

3. [important] [packaging] autopkgtest runs a network-fetching test (tests/crates.rs syn) that cannot pass
   in Debian CI

• Files: tests/crates.rs:17-25, debian/tests/control
• Evidence: #[test] fn syn() { let source = ureq::get(SYN_URL) ... } with SYN_URL = "https://raw.githubusercontent.com/dtolnay/syn/.../Cargo.toml". debian/tests/control runs /usr/share/cargo/bin/cargo-auto-test boml 2.0.0 --all-targets ... with only Restrictions: allow-stderr; cargo-auto-test executes cargo test --all-targets.
• Problem: cargo-auto-test runs every test target, so the syn test performs an HTTPS request to raw.githubusercontent.com at test time. autopkgtest's default environment has no network access (no Restrictions: needs-internet is declared), so the request fails and .unwrap() panics, failing all four autopkgtest entries in the Debian CI. The ureq-platform-verifier patch already updated the other (boml) assertions in this file to match Debian's ureq features, but left this inherently network-bound test in place, so the patch intent was evidently to make the local test pass while the suite as a whole remains un-runnable offline.
• Fix: Patch tests/crates.rs for Debian to drop or #[ignore] the syn network test (it adds no value in a network-less CI), or declare Restrictions: needs-internet so the test is skipped where no network is available; either way the package's autopkgtests must pass without network.

Thanks!