DFSG, Licensing & New Packages Team

License check: rust-cargo-fuzz 0.13.2-1

Archive component: main

COMPATIBLE:

• Apache-2.0 (Note: not compatible with GPL-2)
• MIT

Author check: rust-cargo-fuzz 0.13.2-1

Scanned 29 files. 2 author(s) declared in debian/copyright.

All source-file authors appear in debian/copyright.

licensecheck

Command: licensecheck -r --deb-machine .
Exit code: 0

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: FIXME
Upstream-Contact: FIXME
Source: FIXME
Disclaimer: Autogenerated by licensecheck

Files: ./.cargo_vcs_info.json
 ./.github/workflows/deploy.yml
 ./.github/workflows/main.yml
 ./CHANGELOG.md
 ./CONTRIBUTING.md
 ./Cargo.lock
 ./Cargo.toml
 ./Cargo.toml.orig
 ./README.md
 ./debian/cargo-checksum.json
 ./debian/changelog
 ./debian/control
 ./debian/debcargo.toml
 ./debian/rules
 ./debian/source/format
 ./debian/upstream/metadata
 ./debian/watch
 ./src/options.rs
 ./src/options/add.rs
 ./src/options/build.rs
 ./src/options/check.rs
 ./src/options/cmin.rs
 ./src/options/coverage.rs
 ./src/options/fmt.rs
 ./src/options/init.rs
 ./src/options/list.rs
 ./src/options/run.rs
 ./src/options/tmin.rs
 ./src/project.rs
 ./src/rustc_version.rs
 ./src/templates.rs
 ./src/utils.rs
 ./tests/tests/main.rs
 ./tests/tests/project.rs
Copyright: NONE
License: UNKNOWN
 FIXME

Files: ./LICENSE-APACHE
Copyright: NONE
License: Apache-2.0
 FIXME

Files: ./src/main.rs
Copyright: 2016, rust-fuzz developers
License: Apache-2.0
 FIXME

Files: ./debian/copyright
Copyright: 2019-2026, The rust-fuzz Project Developers
  2026, Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
License: Apache-2.0 and/or Expat
 FIXME

Files: ./debian/copyright.debcargo.hint
Copyright: FIXME (overlay) UNKNOWN-YEARS The rust-fuzz Project Developers
License: Apache-2.0 and/or Expat
 FIXME

Files: ./LICENSE-MIT
Copyright: 2010, The Rust Project Developers
License: Expat
 FIXME

debian/copyright check

Command: cme check dpkg-copyright
Exit code: 0

Warning in 'Files:"*" License short_name': value is "MIT or Apache-2.0". There are many versions of the MIT license. Please use Expat instead, when it matches. See L<Debian copyright format|https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/#license-specification> and L<wikipedia|https://en.wikipedia.org/wiki/MIT_License#Various_versions>for details.
Offending value: 'MIT or Apache-2.0'
Warning in 'Files:"debian/*" License short_name': value is "MIT or Apache-2.0". There are many versions of the MIT license. Please use Expat instead, when it matches. See L<Debian copyright format|https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/#license-specification> and L<wikipedia|https://en.wikipedia.org/wiki/MIT_License#Various_versions>for details.
Offending value: 'MIT or Apache-2.0'
you can try 'cme fix dpkg-copyright' to fix the warnings shown above

licenserecon

Command: licenserecon
Exit code: 3

en: Versions: licenserecon '17.0'  licensecheck '3.3.9-1'

Parsing Source Tree  ....
Reading d/copyright  ....
Running licensecheck ....

d/copyright      | licensecheck

MIT or Apache-2.0| Apache-2.0        src/main.rs

Look for SPDX

Command: grep -r -B1 'SPDX-'
Exit code: 1

(no output)

Lintian

Command: lintian -i -I -v --pedantic
Exit code: 0

N:
W: cargo-fuzz: initial-upload-closes-no-bugs [usr/share/doc/cargo-fuzz/changelog.Debian.gz:1]
N: 
N:   This package appears to be the first packaging of a new upstream software
N:   package (there is only one changelog entry and the Debian revision is 1),
N:   but it does not close any bugs. The initial upload of a new package should
N:   close the corresponding ITP bug for that package.
N:   
N:   This warning can be ignored if the package is not intended for Debian or
N:   if it is a split of an existing Debian package.
N: 
N:   Please refer to New packages (Section 5.1) in the Debian Developer's
N:   Reference for details.
N: 
N:   Visibility: warning
N:   Show-Always: no
N:   Check: debian/changelog
N:   Renamed from: new-package-should-close-itp-bug
N: 
N:
W: cargo-fuzz: no-manual-page [usr/bin/cargo-fuzz]
N: 
N:   Each binary in /usr/bin, /usr/sbin, /bin, /sbin or /usr/games should have
N:   a manual page
N:   
N:   Note that though the man program has the capability to check for several
N:   program names in the NAMES section, each of these programs should have its
N:   own manual page (a symbolic link to the appropriate manual page is
N:   sufficient) because other manual page viewers such as xman or tkman don't
N:   support this.
N:   
N:   If the name of the manual page differs from the binary by case, man may be
N:   able to find it anyway; however, it is still best practice to match the
N:   exact capitalization of the executable in the manual page.
N:   
N:   If the manual pages are provided by another package on which this package
N:   depends, Lintian may not be able to determine that manual pages are
N:   available. In this case, after confirming that all binaries do have manual
N:   pages after this package and its dependencies are installed, please add a
N:   Lintian override.
N: 
N:   Please refer to Manual pages (Section 12.1) in the Debian Policy Manual
N:   for details.
N: 
N:   Visibility: warning
N:   Show-Always: no
N:   Check: documentation/manual
N:   Renamed from: binary-without-manpage
N: 
N:
I: rust-cargo-fuzz source: file-contains-fixme-placeholder FIXME [debian/control:2]
N: 
N:   This file appears to be incomplete or insufficiently modified as it
N:   contains a "FIXME" placeholder text. These can often be generated by
N:   package generation tools such as dh_make or npm2deb.
N:   
N:   Please double-check the file and replace the placeholder with the required
N:   command or information.
N: 
N:   Visibility: info
N:   Show-Always: no
N:   Check: dh-make
N: 
N:
I: rust-cargo-fuzz source: upstream-metadata-missing-bug-tracking [debian/upstream/metadata]
N: 
N:   The DEP 12 metadata file does not specify any upstream bug tracking
N:   information (ie. the Bug-Database or Bug-Submit fields are missing).
N:   
N:   The upstream metadata can be found in the source package in the file
N:   debian/upstream/metadata.
N: 
N:   Please refer to https://dep-team.pages.debian.net/deps/dep12/ for details.
N: 
N:   Visibility: info
N:   Show-Always: no
N:   Check: debian/upstream/metadata
N: 
N:
P: rust-cargo-fuzz source: package-uses-old-debhelper-compat-version 13
N: 
N:   This package uses a debhelper compatibility level that is no longer
N:   recommended. Please consider using the recommended level.
N:   
N:   For most packages, the best way to set the compatibility level is to
N:   specify debhelper-compat (= X) as a Build-Depends in debian/control. You
N:   can also use the debian/compat file or export DH_COMPAT in debian/rules.
N:   
N:   If no level is selected debhelper defaults to level 1, which is
N:   deprecated.
N: 
N:   Please refer to the debhelper(7) manual page for details.
N: 
N:   Visibility: pedantic
N:   Show-Always: no
N:   Check: debhelper
N: 

duck

Command: duck
Exit code: 0

(no output)

look for copyright

Command: egrep -R -i copyright
Exit code: 0

LICENSE-APACHE:   "Licensor" shall mean the copyright owner or entity authorized by
LICENSE-APACHE:   the copyright owner that is granting the License.
LICENSE-APACHE:   copyright notice that is included in or attached to the work
LICENSE-APACHE:   submitted to Licensor for inclusion in the Work by the copyright owner
LICENSE-APACHE:   the copyright owner. For the purposes of this definition, "submitted"
LICENSE-APACHE:   designated in writing by the copyright owner as "Not a Contribution."
LICENSE-APACHE:2. Grant of Copyright License. Subject to the terms and conditions of
LICENSE-APACHE:   copyright license to reproduce, prepare Derivative Works of,
LICENSE-APACHE:       that You distribute, all copyright, patent, trademark, and
LICENSE-APACHE:   You may add Your own copyright statement to Your modifications and
LICENSE-APACHE:   same "printed page" as the copyright notice for easier
LICENSE-APACHE:Copyright [yyyy] [name of copyright owner]
LICENSE-MIT:Copyright (c) 2010 The Rust Project Developers
LICENSE-MIT:The above copyright notice and this permission notice
LICENSE-MIT:SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
debian/copyright.debcargo.hint:Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
debian/copyright.debcargo.hint:Copyright: FIXME (overlay) UNKNOWN-YEARS The rust-fuzz Project Developers
debian/copyright.debcargo.hint: FIXME (overlay): Since upstream copyright years are not available in
debian/copyright.debcargo.hint:Copyright: 2010 The Rust Project Developers
debian/copyright.debcargo.hint:Copyright: 2016 rust-fuzz developers
debian/copyright.debcargo.hint:Copyright:
debian/copyright.debcargo.hint: The above copyright notice and this permission notice shall be included in all
debian/copyright.debcargo.hint: AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
debian/copyright:Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
debian/copyright:Copyright: 2019-2026 The rust-fuzz Project Developers
debian/copyright:Copyright:
debian/copyright: The above copyright notice and this permission notice shall be included in all
debian/copyright: AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
src/main.rs:// Copyright 2016 rust-fuzz developers

look for license

Command: egrep -R -i license
Exit code: 0

Cargo.toml.orig:license = "MIT OR Apache-2.0"
Cargo.toml:license = "MIT OR Apache-2.0"
LICENSE-APACHE:                              Apache License
LICENSE-APACHE:                     http://www.apache.org/licenses/
LICENSE-APACHE:   "License" shall mean the terms and conditions for use, reproduction,
LICENSE-APACHE:   the copyright owner that is granting the License.
LICENSE-APACHE:   exercising permissions granted by this License.
LICENSE-APACHE:   Object form, made available under the License, as indicated by a
LICENSE-APACHE:   of this License, Derivative Works shall not include works that remain
LICENSE-APACHE:2. Grant of Copyright License. Subject to the terms and conditions of
LICENSE-APACHE:   this License, each Contributor hereby grants to You a perpetual,
LICENSE-APACHE:   copyright license to reproduce, prepare Derivative Works of,
LICENSE-APACHE:   publicly display, publicly perform, sublicense, and distribute the
LICENSE-APACHE:3. Grant of Patent License. Subject to the terms and conditions of
LICENSE-APACHE:   this License, each Contributor hereby grants to You a perpetual,
LICENSE-APACHE:   (except as stated in this section) patent license to make, have made,
LICENSE-APACHE:   where such license applies only to those patent claims licensable
LICENSE-APACHE:   or contributory patent infringement, then any patent licenses
LICENSE-APACHE:   granted to You under this License for that Work shall terminate
LICENSE-APACHE:       Derivative Works a copy of this License; and
LICENSE-APACHE:       do not modify the License. You may add Your own attribution
LICENSE-APACHE:       as modifying the License.
LICENSE-APACHE:   may provide additional or different license terms and conditions
LICENSE-APACHE:   the conditions stated in this License.
LICENSE-APACHE:   this License, without any additional terms or conditions.
LICENSE-APACHE:   the terms of any separate license agreement you may have executed
LICENSE-APACHE:6. Trademarks. This License does not grant permission to use the trade
LICENSE-APACHE:   risks associated with Your exercise of permissions under this License.
LICENSE-APACHE:   result of this License or out of the use or inability to use the
LICENSE-APACHE:   License. However, in accepting such obligations, You may act only
LICENSE-APACHE:APPENDIX: How to apply the Apache License to your work.
LICENSE-APACHE:   To apply the Apache License to your work, attach the following
LICENSE-APACHE:Licensed under the Apache License, Version 2.0 (the "License");
LICENSE-APACHE:you may not use this file except in compliance with the License.
LICENSE-APACHE:You may obtain a copy of the License at
LICENSE-APACHE:	http://www.apache.org/licenses/LICENSE-2.0
LICENSE-APACHE:distributed under the License is distributed on an "AS IS" BASIS,
LICENSE-APACHE:See the License for the specific language governing permissions and
LICENSE-APACHE:limitations under the License.
LICENSE-MIT:publish, distribute, sublicense, and/or sell copies of
debian/copyright.debcargo.hint:License: MIT or Apache-2.0
debian/copyright.debcargo.hint:Files: LICENSE-MIT
debian/copyright.debcargo.hint:License: UNKNOWN-LICENSE; FIXME (overlay)
debian/copyright.debcargo.hint:License: UNKNOWN-LICENSE; FIXME (overlay)
debian/copyright.debcargo.hint:License: MIT or Apache-2.0
debian/copyright.debcargo.hint:License: Apache-2.0
debian/copyright.debcargo.hint: Debian systems provide the Apache 2.0 license in
debian/copyright.debcargo.hint: /usr/share/common-licenses/Apache-2.0
debian/copyright.debcargo.hint:License: MIT
debian/copyright.debcargo.hint: to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
debian/copyright:License: MIT or Apache-2.0
debian/copyright:License: MIT or Apache-2.0
debian/copyright:License: Apache-2.0
debian/copyright: Debian systems provide the Apache 2.0 license in
debian/copyright: /usr/share/common-licenses/Apache-2.0
debian/copyright:License: MIT
debian/copyright: to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
README.md:## License
README.md:`cargo-fuzz` is distributed under the terms of both the MIT license and the
README.md:Apache License (Version 2.0).
README.md:See [LICENSE-APACHE](./LICENSE-APACHE) and [LICENSE-MIT](./LICENSE-MIT) for
src/main.rs:// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
src/main.rs:// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
src/main.rs:// http://opensource.org/licenses/MIT>, at your option. This file may not be