rust-secp256k1 0.33.1-1

Package Information

Description	Rust wrapper library for Pieter Wuille's `libsecp256k1` - Rust source code Implements ECDSA and BIP 340 signatures for the SECG elliptic curve group secp256k1 and related utilities. Source code for Debianized Rust crate "secp256k1"
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Sponsor	paulliu@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/secp256k1] (browse)
Tracker	https://tracker.debian.org/pkg/rust-secp256k1
Uploaded	3 hours ago

New Package Report

.changes◂

Architecture	amd64 source
Distribution	unstable
Source	rust-secp256k1
Version	0.33.1-1
Changed-By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>

Changelog◂

rust-secp256k1 (0.33.1-1) unstable; urgency=medium
 .
   * Package secp256k1 0.33.1 from crates.io using debcargo 2.8.3

.dsc◂

Section	rust
Priority	optional
Component	main
Package-List	librust-secp256k1-dev deb rust optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: secp256k1
Upstream-Contact:
 Dawid Ciężarkiewicz <dpc@ucore.info>
 Andrew Poelstra <apoelstra@wpsoftware.net>
Source: https://git.rust-bitcoin.org/rust-bitcoin/rust-secp256k1

Files: *
Copyright:
 2014-2026 Dawid Ciężarkiewicz <dpc@ucore.info>
 2014-2026 Andrew Poelstra <apoelstra@wpsoftware.net>
License: CC0-1.0
Comment:
 Year range taken from the upstream Git repository
 (https://github.com/rust-bitcoin/rust-secp256k1), see the git history.

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
License: CC0-1.0

License: CC0-1.0
 Debian systems provide the CC0 1.0 Universal License in
 /usr/share/common-licenses/CC0-1.0

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for rust-secp256k1 version 0.33.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

Licensing is DFSG-free and debian/copyright describes it correctly. Every Rust source file carries // SPDX-License-Identifier: CC0-1.0, the tree's LICENSE is the full CC0 1.0 text, and Cargo.toml also declares license = "CC0-1.0"; CC0-1.0 is a free licence and its text is in /usr/share/common-licenses. debian/copyright is valid DEP-5 with a Files: * catch-all naming both upstream authors (the two authors in Cargo.toml) and a later debian/* stanza for the packaging. The prescan's author check reported no holder in the tree missing from debian/copyright. The tree contains no vendored third-party code, no images, fonts or generated binaries, and no non-free wording.

Packaging

Standard debcargo 2.8.3 packaging for the Debian Rust team, of good quality. debhelper compat 13 with dh-sequence-cargo and a minimal rules delegating to dh-cargo; the single binary package is Architecture: any, Multi-Arch: same, with the full set of feature Provides. All Build-Depends, Depends and autopkgtest dependencies name packages that exist in unstable at satisfying versions (rand 0.10.3, secp256k1-sys 0.14.1, arbitrary 1.5.0, serde 1.0.229, dh-cargo 34, etc.). The three patches carry DEP-3 headers and match what unstable ships. Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1, the changelog is sane (0.33.1-1, unstable, uploader matches Uploaders), and there are twelve autopkgtest stanzas using autopkgtest's @ expansion for the package's own binaries.

Issues

None.

Verified ◂

Prescan: the dfsg-author-check block lists no file; it reports that every copyright holder found in the 39 scanned files (the two authors of Cargo.toml) is named in debian/copyright, so no unnamed holder is outstanding.
Full file inventory of the upstream tree (34 files outside debian/ and .pc/): Rust sources under src/ (19 files), examples/ (4), .forgejo/ (4), Cargo.toml, Cargo.toml.orig, Cargo.lock, Cargo-minimal.lock, Cargo-recent.lock, .cargo_vcs_info.json, .gitignore, CHANGELOG.md, LICENSE, README.md, justfile, rbmt-version, rustfmt.toml. All are plain text; no images, fonts, sounds, archives, PDFs, minified or generated artefacts.
18 of the 19 files under src/ begin with // SPDX-License-Identifier: CC0-1.0 (the 19th, src/musig.rs, has no notice but is part of the same crate and covered by the project's single CC0 LICENSE); examples/ and the build/CI files carry no separate notice.
LICENSE is the complete CC0 1.0 Universal text, and /usr/share/common-licenses/CC0-1.0 (the file debian/copyright points at) exists on the reviewing system.
Grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public, GNU Lesser, Apache License, Mozilla Public, public domain, All rights reserved, MIT, BSD over the whole tree (gitignore off): only CC0 text in LICENSE, the SPDX tags, and the license = "CC0-1.0" fields in Cargo.toml/Cargo.toml.orig. No third-party notices, and no licence other than CC0-1.0 anywhere in the tree.
README.md's licence badge points at LICENSE and says CC0 1.0 Universal; no other licence claim in README, CHANGELOG, justfile or .forgejo/.
debian/copyright is DEP-5 1.0 (correct Format: URL), 25 lines: Files: * (Copyright 2014-2026 Dawid Ciężarkiewicz, Andrew Poelstra; License CC0-1.0), Files: debian/* (2026 Debian Rust Maintainers, 2026 Ying-Chun Liu), and the standalone License: CC0-1.0 paragraph pointing at /usr/share/common-licenses/CC0-1.0. The later debian/* stanza correctly overrides the catch-all.
No embedded copy of third-party code: the libsecp256k1 C sources are in the separate librust-secp256k1-sys source package (0.14.1+dfsg-4 in unstable), and this tree only binds to it through secp256k1-sys.
Dependency existence checked with apt-cache: librust-secp256k1-sys-0.14-dev (0.14.1+dfsg-4, provides +alloc/+std/+lowmemory/+recovery), librust-rand-dev 0.10.3 (provides +std/+std-rng/+thread-rng), librust-arbitrary-1+default-dev 1.5.0, librust-serde-1-dev 1.0.229, dh-cargo 34 (provides dh-sequence-cargo, satisfies the >= 33~ in debian/tests/control), librust-bincode-dev 2.0.1, librust-serde-cbor-dev 0.11.2, librust-rand-xoshiro-dev 0.8.1, librust-getrandom-dev 0.4.2 (+default/+wasm-js), librust-hex-lit-dev 0.1.1, librust-serde-test-dev 1.0.177, librust-wasm-bindgen-test-dev 0.3.58, libstd-rust-dev 1.98.1.
Patches: debian/patches/0001 (rand 0.9 -> >= 0.9, drop rand?/small_rng from the std feature), 0002 (dev-dependency version relaxations), 0003 (rand 0.10 API changes) each have Description, Author, Forwarded: not-needed and Last-Update; the versions they relax to are exactly what unstable ships (bincode 2.0, rand-xoshiro 0.8, serde-cbor 0.11, getrandom 0.4), so they are purposeful and not obsolete. 0003's rand-0.10-only construct (rand::TryRng) occurs only in #[cfg(test)] code, so the library itself still builds with rand 0.9 and the (>= 0.9) floor in Depends is not understated.
Autopkgtest: twelve stanzas; @ in Depends and in Features: test-name=... is autopkgtest's documented expansion for the binary packages of the space package itself (autopkgtest specification, Control fields/Depends), so the tests do install librust-secp256k1-dev and thus its arbitrary/serde dependencies for --all-features.
Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: same first two components, so not an issue. Vcs-Git/Vcs-Browser point at debcargo-conf with the [src/secp256k1] branch syntax, Homepage matches upstream.
debian/watch not reviewed, per instructions.
uscan found the packaged version as the newest upstream release (upstream 0.33.1, packaged 0.33.1).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC0-1.0).

Not confirmed ◂

The build itself could not be run. In particular I could not check whether cargo needs the optional dependencies librust-arbitrary-1-dev and librust-serde-1-dev present at build time: they are in the -dev package's Depends but not in Build-Depends-Arch. A clean sbuild would settle it.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 1 hour ago.

Back to Dashboard | View all reviews for this package