DFSG NEW review for rust-fips205 version 0.5.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

The upstream licences are DFSG-free: the crate is dual MIT OR Apache-2.0, the MIT text is reproduced in debian/copyright and Apache-2.0 points to /usr/share/common-licenses, and no non-free wording appears anywhere in the tree. debian/copyright is nevertheless inaccurate for one file: LICENSE-MIT carries a RustCrypto Developers copyright notice that the dropped debcargo stanza used to record, and the final file attributes that file to Eric Schorn alone. Everything else (NIST ACVP vector data, the SLotH KAT reference) is accounted for and free.

Packaging

This is unmodified debcargo output and it is sound: compat 13 with dh-sequence-cargo, one Multi-Arch: same -dev package whose Depends and Provides match the Cargo features, Build-Depends-Arch marked <!nocheck> down to the toolchain (correct, since dh-cargo compiles only in the skipped dh_auto_test step), autopkgtest stanzas whose Depends cover every dev-dependency, DEP-5 copyright, 3.0 (quilt) with no patches, and a sane changelog. Standards-Version 4.7.4 is current against Policy 4.7.4.1. I found nothing a sponsor would require changed.

Issues

1. [blocker] [licensing] debian/copyright omits the RustCrypto Developers copyright on LICENSE-MIT

• Files: LICENSE-MIT:1, debian/copyright:6-8, debian/copyright.debcargo.hint:15-21

• Basis: checked, in the package or with a reference tool

• Evidence: LICENSE-MIT:1: Copyright (c) 2020-2022 RustCrypto Developers; debian/copyright Files: * gives only Copyright: 2023-2026 Eric Schorn <eschorn@integritychain.com>, and no stanza matches LICENSE-MIT; the shipped debcargo hint still has Files: LICENSE-MIT / Copyright: 2020-2022 RustCrypto Developers, which the final file dropped.

• Problem: A copyright holder named in a distributed file's notice is not represented in debian/copyright, so the file does not accurately describe the copyright of every file in the source. The MIT text itself is reproduced, but the MIT condition that the copyright notice be included with copies is not met by a Copyright field naming a different holder.

• Fix:

  Add a later stanza such as:

  Files: LICENSE-MIT
  Copyright: 2020-2022 RustCrypto Developers
  License: MIT
  

  keeping the existing MIT stand-alone paragraph, and regenerate/delete debian/copyright.debcargo.hint once it agrees.

Verified

• Read all of debian/ (control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, source/format, tests/control, upstream/metadata) in full; read all 30 upstream files' names and the top-level ones (Cargo.toml, Cargo.toml.orig, LICENSE-*, README, CHANGELOG, SECURITY.md, deny.toml, .cargo_vcs_info.json, .gitignore); sampled src/ and tests/.
• Scanned the whole tree for Copyright/(C)/©/SPDX/Licensed under/Permission is hereby granted/GPL/LGPL/Apache/MPL/public domain/All rights reserved/non-commercial/no-modification wording: the only notices are LICENSE-MIT:1 (RustCrypto) and LICENSE-APACHE's Appendix placeholder Copyright [yyyy] [name of copyright owner]; no non-free terms and no other holders.
• Sample of src/ and tests/ shows no per-file licence headers, so all code falls under the crate's MIT OR Apache-2.0 (license = "MIT OR Apache-2.0" in Cargo.toml:41 and README.md:101-103); no vendored third-party code, no generated code without its input (module code is macro-generated from src/types.rs' parameter tables).
• tests/nist_vectors/SLH-DSA-keyGen-FIPS205/internalProjection.json.gz: decompresses to a single JSON object named internalProjection.json (73.5 KB), the NIST ACVP SLH-DSA keyGen vector set (Cargo.toml.orig:15-17, README.md:88-91); it is test data, contains no code, and this crate's own tests do not read it (only the upstream FFI/Python tests do), so it needs no licence of its own; NIST ACVP vectors are US Government work and the Files: * dual licence covers anything copyrightable.
• tests/sloth_kat.rs:1-10 mentions SLotH's KAT files as BSD-3-Clause, but no SLotH data or code is stored: the file reimplements NIST's public-domain AES-256 CTR DRBG from PQCgenKAT rng.c and holds only SHA-256 constants of the regenerated text, so no BSD-3-Clause material is shipped.
• debian/copyright is DEP-5 with the correct Format URL; Files: * and Files: debian/* and the MIT/Apache-2.0 stand-alone paragraphs are well-formed, * covers all depths including .github/ and buried test vectors, and MIT is fully quoted while Apache-2.0 rightly points at /usr/share/common-licenses/Apache-2.0.
• Packaging: debhelper-compat 13 + dh-sequence-cargo with the standard dh $@ --buildsystem cargo; the single librust-fips205-dev package is Architecture: any/Multi-Arch: same with ${misc:Depends} and Provides for each feature package; Depends and Build-Depends-Arch match the Cargo.toml features and dependency versions (rand_core 0.6.4+getrandom, sha2 0.10.8, sha3 0.10.9 with zeroize, zeroize 1.6.0 with zeroize_derive).
• The <!nocheck> on every Build-Depends-Arch entry, including cargo/rustc/libstd-rust-dev, is correct: /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm sub build only copies sources and sub test runs cargo build, and dh (compat >= 13) skips that override when DEB_BUILD_OPTIONS has nocheck.
• debian/tests/control's seven dev-dependencies (aes, criterion, flate2, hex, rand_chacha, serde_json plus dh-cargo/rustc) match Cargo.toml's dev-dependencies exactly for cargo-auto-test fips205 0.5.0; version 0.5.0 matches X-Cargo-Crate-Version, which cargo.pm:94 reads.
• Standard source-package hygiene: 3.0 (quilt) with no debian/patches (so nothing to DEP-3-verify), X-Cargo-Crate fips205, Vcs-Git/Vcs-Browser/Homepage/upstream metadata consistent, changelog 0.5.0-1 to unstable signed by the uploader, Standards-Version 4.7.4 matches current Policy 4.7.4.1.
• uscan found the packaged version as the newest upstream release (upstream 0.5.0, packaged 0.5.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• The full 73.5 KB single-line ACVP JSON was not read beyond confirming it decompresses to a JSON object with the expected name; I did not attempt to validate the vectors' contents.
• The 2023 start year in Copyright: 2023-2026 Eric Schorn cannot be checked against upstream history from the source alone; no file contradicts it, and year drift is not reportable anyway.

Proposed changes

None.