DFSG NEW review for rust-fips204-ffi version 0.5.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 1 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The code is dual-licensed MIT/Apache-2.0 (license = "MIT OR Apache-2.0" in Cargo.toml, with both full licence texts shipped), which is DFSG-free and compatible, and no non-free terms or built/vendored files were found. debian/copyright is DEP-5 with the correct Format URL and the full MIT text, but it does not reproduce the Copyright (c) 2020-2022 RustCrypto Developers notice in LICENSE-MIT, so it is incomplete.

Packaging

The layout is sound (compat 13, dh, 3.0 (quilt) with no patches, a symbols file matching the 19 exported functions, a Multi-Arch runtime package, autopkgtests), but Build-Depends-Arch omits the pastey crate that src/lib.rs imports, which will stop the build, and the clean target leaves the C test binaries the build writes into tests/.

Issues

1. [blocker] [licensing] debian/copyright does not name RustCrypto Developers, the copyright holder in LICENSE-MIT

• Files: LICENSE-MIT:1, debian/copyright:6-9
• Basis: checked, in the package or with a reference tool
• Evidence: LICENSE-MIT:1: Copyright (c) 2020-2022 RustCrypto Developers. debian/copyright Files: * lists only 2026 Daniel Kahn Gillmor and 2026 Eric Schorn; the generated debian/copyright.debcargo.hint still has a Files: LICENSE-MIT stanza with Copyright: 2020-2022 RustCrypto Developers.
• Problem: Every copyright notice found in the tree must be represented in debian/copyright (Policy 12.5; copyright-format 1.0 section 5). As shipped, the Files: * stanza asserts a holder list that contradicts the notice in LICENSE-MIT; the RustCrypto holder was removed when the overlay replaced the debcargo-generated stanza.
• Fix: Add 2020-2022 RustCrypto Developers to the Files: * Copyright list, or restore a Files: LICENSE-MIT stanza with Copyright: 2020-2022 RustCrypto Developers and License: MIT.

2. [important] [packaging] Build-Depends-Arch omits librust-pastey-dev, which src/lib.rs imports, so the build will fail

• Files: debian/control:6-11, Cargo.toml:50-51, src/lib.rs:1
• Basis: checked, in the package or with a reference tool
• Evidence: src/lib.rs:1: use pastey::paste;; Cargo.toml:50-51: [dependencies.pastey] / version = ">=0.1, <0.3"; debian/control Build-Depends-Arch lists no librust-pastey*, while debian/control.debcargo.hint has librust-pastey+default-dev (<< 0.3) and (>= 0.1).
• Problem: debian/rules builds with /usr/share/cargo/bin/cargo build, whose prepare-debian config replaces crates.io with the local directory registry /usr/share/cargo/registry. That registry contains only crates installed via Build-Depends, so the non-optional pastey dependency (used unconditionally in the library) cannot be resolved and cargo aborts with no matching package named pastey found.
• Fix: Add librust-pastey+default-dev (>= 0.1), librust-pastey+default-dev (<< 0.3) to Build-Depends-Arch; the archive has librust-pastey-dev 0.2.3-1, which satisfies both bounds.

3. [minor] [packaging] clean does not remove the C test binaries that the build writes into tests/

• Files: debian/rules:27-28, debian/clean:1-5, tests/Makefile:83, tests/Makefile:91-106
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules:27-28: execute_after_dh_auto_test: / cd tests && make; make compiles baseline-44, baseline-65, baseline-87, link-two and cplusplus in tests/ (tests/Makefile:91,102,106), while debian/clean lists only target/, .cargo-checksum.json, debian/cargo_registry/, debian/cargo_home/, registry/.
• Problem: Policy 4.9 requires the clean target to undo any effects of build and binary. After a build, debian/rules clean leaves those test executables in the source tree, so the tree is no longer pristine and dpkg-source -b (or a rebuild from the cleaned tree) reports unrepresentable changes to files that no patch accounts for.
• Fix: Add tests/baseline-*, tests/link-two, tests/cplusplus (and tests/nist-tests.c, tests/nist-tests in case the NIST vectors are supplied) to debian/clean, or add an override_dh_clean that runs $(MAKE) -C tests clean.

Verified

• debian/copyright was read in full: DEP-5, exact Format URL, MIT text included, Apache-2.0 referenced from /usr/share/common-licenses/Apache-2.0; no non-free wording (non-commercial, no-modification, field-of-use, NC/ND) exists anywhere in the tree.
• The whole upstream tree (21 files, excluding .pc) was inventoried and grepped for Copyright/(C)/©/SPDX/licence wording; the only licence texts are LICENSE-MIT (MIT) and LICENSE-APACHE (Apache-2.0), Cargo.toml declares MIT OR Apache-2.0, and there are no binaries, minified files, PDFs, firmware or vendored third-party sources (Cargo.lock references registry crates only).
• The prescan's single item, the RustCrypto Developers notice in LICENSE-MIT, is reported as issue 1; the other files (src/lib.rs, fips204.h, build.rs, python/fips204.py, python/test/nist.py, python/README.md, pyproject.toml, tests/*.c, *.cc, *.py, Makefile) carry no separate copyright notice and are covered by the Files: * MIT-or-Apache-2.0 stanza.
• All debian/ files were read in full except the ignored cargo-checksum.json: control, rules, changelog (0.5.0-1, unstable), clean, install/link/symbols files, debcargo.toml, tests/control, upstream/metadata and source/format (3.0 (quilt), empty patches directory). Standards-Version 4.7.4 matches Policy 4.7.4.1; Vcs-Git/Vcs-Browser/Homepage are present; there are no maintainer scripts to review.
• The .symbols file names exactly the 19 functions exported by src/lib.rs (three parameter sets x six functions plus ml_dsa_populate_seed). The runtime library is installed as libfips204.so.0 in libfips204-0 (Multi-Arch: same) and libfips204-dev holds only fips204.h plus the libfips204.so -> libfips204.so.0 symlink; dh_install(1) and dh_link(1) both support ${DEB_HOST_MULTIARCH} substitution at compat 13.
• debhelper behaviour was checked in its sources: no build system is auto-selected for this tree (no top-level Makefile, setup.py or CMakeLists.txt, and cargo is not in dh's autoselect lists), so dh_auto_install does not run cargo install, and dh skips the execute_after_dh_auto_test hook under nocheck at compat 13.
• apt-cache confirms librust-pastey-dev 0.2.3-1, librust-rand-core-0.6-dev 0.6.4-5, rustc 1.97.1 (satisfying >= 1.85), dh-sequence-cargo (dh-cargo 34) and dh-sequence-python3 (dh-python 7.20261019) exist in the archive.
• uscan found the packaged version as the newest upstream release (upstream 0.5.0, packaged 0.5.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• librust-fips204-0.5+default-dev is not in the archive lists: unstable has librust-fips204-dev 0.4.6-1, which provides only 0.4 versioned names, and apt-cache sees no NEW upload providing 0.5. The build and the second autopkgtest (Depends: librust-fips204-dev, vectors read from /usr/share/cargo/registry/fips204-0.5.0/tests/nist_vectors) need rust-fips204 0.5.0 to be accepted with this package; a build would show whether it accompanies the upload.
• Whether the C tests run by cd tests && make and the autopkgtest commands pass (including the -Werror compiles and the keyGen vectors being present in librust-fips204-dev) cannot be checked without building and running them.
• File modes are not visible to this review, so the executable bits of debian/scripts/post-build, which debian/rules runs directly, and of python/test/nist.py, which the autopkgtest runs as ./test/nist.py, could not be confirmed.

Proposed changes

None.