DFSG NEW review for rust-mail-parser version 0.11.9-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 2 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

debian/copyright is DEP-5 and the Rust sources are correctly Apache-2.0 OR MIT, but it declares Files-Excluded: resources/eml/* while the whole test corpus is still present in the orig tarball and in the tree. That directory carries third-party material the file does not describe: Dovecot's MIT samples, sample messages from Hunny Software with no licence grant at all, and RFC-derived examples with no notice. The Hunny files are not distributable as they stand, and the catch-all Files: * stanza mislicenses all of resources/eml as Apache-2.0/Expat.

Packaging

The packaging is the standard debcargo output and is sound: debhelper-compat 13 with dh-sequence-cargo, a single well-formed forward-ported hashify-0.3 patch matching Build-Depends, an autopkgtest suite, sane changelog and current Standards-Version. Its only real defect is the stale Files-Excluded/copyright inconsistency, which is a licensing matter; the tests that read resources/eml will need attention when it is resolved.

Issues

1. [blocker] [licensing] resources/eml/legacy contains Hunny Software sample messages with no licence grant

• Files: resources/eml/legacy/COPYING:1, resources/eml/legacy/*.eml, debian/copyright:5-7
• Basis: checked, in the package or with a reference tool
• Evidence: These test files are Copyright © 2010 Hunny Software, Inc. followed only by a copy of the samples' readme.txt (Samples obtained from http://www.hunnysoft.com/mime/samples/samples.zip); no permission to copy, modify or distribute is given. debian/copyright itself says Files-Excluded: resources/eml/* / Excluded files are samples with unclear license.
• Problem: The 152 files in resources/eml/legacy are the m0*–m3* samples from hunnysoft.com, redistributed in the source package with only an assertion of copyright and no licence. Copyright plus no grant means no permission to redistribute or modify, so shipping them violates DFSG 1 and 3; the -dev package's tests read this directory (src/parsers/message.rs reads resources/eml/legacy), so the data cannot simply stay there undocumented.
• Fix: Remove resources/eml/legacy from the source (repack the orig tarball, as the watch's Files-Excluded is meant to do) and adjust or drop the test that consumes it, or obtain an explicit free licence from Hunny Software and document it in debian/copyright.

2. [blocker] [licensing] Files-Excluded names resources/eml/* but the files are present, and debian/copyright has no stanza for them

• Files: debian/copyright:5-7, debian/copyright:8-10, resources/eml/malformed/COPYING:1, resources/eml/thirdparty/COPYING:1, resources/eml/rfc/*.eml
• Basis: checked, in the package or with a reference tool
• Evidence: Files-Excluded: resources/eml/* in the header; yet rust-mail-parser_0.11.9.orig.tar.gz contains mail-parser-0.11.9/resources/eml/ with 300+ .eml/.json files, and the COPYING files say These test files are Copyright (c) 2003-2018 Dovecot authors, licensed under MIT. The only stanza matching them is Files: * / License: Apache-2.0 or Expat.
• Problem: The copyright file is inaccurate on two counts: it claims an exclusion that was not performed (the orig tarball is the unrepacked crates.io tarball), and it applies upstream's Apache-2.0/Expat to files that are Dovecot MIT, unknown Hunny Software material, and RFC examples (resources/eml/rfc, e.g. 000.eml is Nathaniel Borenstein's multipart example from RFC 2046) whose notices are absent. Policy 12.5 and the copyright-format require every file's copyright and licence to be recorded.
• Fix: Either repack the orig tarball so resources/eml is really absent (and patch the test in src/parsers/message.rs accordingly), or remove Files-Excluded and add stanzas for resources/eml/malformed and resources/eml/thirdparty (Copyright 2003-2018 Dovecot authors, License: Expat) and for resources/eml/rfc (the applicable IETF/RFC terms), plus a fixed licence for the Hunny samples.

3. [minor] [packaging] Files-Excluded is set but the version carries no repack suffix

• Files: debian/copyright, debian/changelog, debian/watch
• Basis: found by the review tooling's own checks
• Evidence: 0.11.9-1
• Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
• Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified

• Read all of debian/ in full (control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, source/format, patches/series and the patch, tests/control, upstream/metadata, watch); debian/cargo-checksum.json was left out as instructed, and .pc/ was not read.
• Every file under src/, tests/ and examples/ carries SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art> and SPDX-License-Identifier: Apache-2.0 OR MIT; the Files: * stanza matches them (Expat is Debian's short name for MIT).
• LICENSES/Apache-2.0.txt and LICENSES/MIT.txt are complete licence texts; the Apache-2.0 pointer to /usr/share/common-licenses is valid, and the Expat and BSD-2-clause texts are reproduced inline in debian/copyright.
• src/decoders/base64.rs:331-337 names Copyright 2005, 2006, 2007 Nick Galbreath and Released under bsd license; the BSD-2-clause stanza names the same holder (the prescan's 'possibly similar name' match is correct).
• Prescan binary-data hit resources/eml/thirdparty/005.eml: it is a MIME test message with a UTF-16LE text part, i.e. test data read by src/parsers/message.rs, not a build artifact.
• resources/address.json, content_type.json, date.json, id.json, list.json, received.json, unstructured.json and resources/maildir contain no separate copyright notice and are upstream-authored test data, covered by Files: *.
• Grepped the whole tree (gitignore off) for copyright, (C), ©, SPDX, 'Licensed under', 'Permission is hereby granted', GPL/LGPL/Apache/MPL, 'public domain' and 'All rights reserved'; no other third-party notices or non-free wording turned up.
• Packaging: debhelper-compat 13 with dh-sequence-cargo and debcargo's dh $@ --buildsystem cargo; the single quilt patch bumps hashify 0.2->0.3 and Build-Depends-Arch carries librust-hashify-0.3+default-dev; changelog 0.11.9-1/unstable is sane; Standards-Version 4.7.4 matches current Policy 4.7.4.x; Vcs-* point at rust-team/debcargo-conf; autopkgtest is present with Tests-/Features/Restrictions.
• librust-hashify-0.3+default-dev is a virtual package provided by librust-hashify-dev 0.3.1-1, so the patched dependency is satisfiable.
• uscan found the packaged version as the newest upstream release (upstream 0.11.9, packaged 0.11.9).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• src/decoders/quoted_printable.rs:268-271 says the hex table is Adapted from Daniel Lemire's source with no licence statement; whether that snippet is licensed, and whether the trivial lookup table is copyrightable, cannot be determined from the package, and debian/copyright does not mention it.
• src/decoders/base64.rs says only Released under bsd license; debian/copyright chooses BSD-2-clause, but the exact BSD variant of Nick Galbreath's stringencoders could not be checked from the package.
• Whether dh-cargo installs resources/eml into librust-mail-parser-dev could not be verified (dh-cargo is not installed on the reviewing system); the crate's tests locate the data through CARGO_MANIFEST_DIR, so the -dev package's autopkgtest appears to depend on it.

Proposed changes

None.