DFSG NEW review for rust-secp256k1-sys version 0.14.1+dfsg-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The entire tree is CC0-1.0. debian/copyright is machine-readable DEP-5, matches the whole (small) source tree with Files: * CC0-1.0 plus Files: debian/* CC0-1.0, and its Files-Excluded (depend/, wasm/, vendor-libsecp.sh) corresponds to files actually absent from the unpacked tree. All source files carry the SPDX header SPDX-License-Identifier: CC0-1.0 and upstream's LICENSE is the CC0 1.0 text; every copyright holder named in the scan is listed in debian/copyright. Excluding the bundled libsecp256k1 C sources (double-licensed MIT/Apache) removes the only non-CC0 code and any embedded/DFSG concern.

Packaging

Standard, clean debcargo output. Compat 13 with debhelper-compat (= 13), dh --buildsystem cargo, correct Build-Depends(-Arch) with <!nocheck> marks, valid dep on libsecp256k1-dev (present in the archive, Multi-Arch: same), Provides for all features, Multi-Arch: same, autopkgtests for each feature, and one well-documented DEP-3 patch that links against the system library. Standards-Version 4.7.4 is current; changelog is sane. No issues worth reporting.

Issues

None.

Verified

• Read debian/copyright in full: DEP-5 Format, Files: * CC0-1.0 (holders Dawid Ciężarkiewicz, Andrew Poelstra, Steven Roose; years 2019-2026), Files: debian/* CC0-1.0 (Debian Rust Maintainers + Ying-Chun Liu), standalone CC0-1.0 License stanza pointing to /usr/share/common-licenses/CC0-1.0.
• debian/copyright Files-Excluded: depend/**, wasm/**, vendor-libsecp.sh matches the tree: none of those paths is present; the bundled libsecp256k1 C sources (MIT/Apache-2.0 upstream) are not shipped.
• Inventory of the whole source tree (only files: Cargo.toml, Cargo.toml.orig, Cargo.lock, build.rs, .cargo_vcs_info.json, CHANGELOG.md, LICENSE, README.md, src/{lib,macros,types,recovery}.rs). No binaries, archives, minified files, fonts, images or generated code remain.
• grep across all of src/, build.rs, Cargo.toml.orig, CHANGELOG.md, Cargo.lock found only CC0-1.0/SPDX-License-Identifier: CC0-1.0; no other licence wording anywhere.
• Every source file carries the CC0-1.0 SPDX header; upstream LICENSE is the full CC0 1.0 text.
• Prescan author check reports every copyright holder found is named in debian/copyright (12 files scanned, 5 authors declared, none missing).
• debian/patches/build-system-lib.patch has DEP-3 headers (Description, Author, Forwarded: not-needed, Last-Update) and correctly rewrites build.rs to cargo:rustc-link-lib=secp256k1 with rust_secp_no_symbol_renaming, and drops the cc build-dependency.
• debian/control: debhelper-compat (= 13) with %: dh $@ --buildsystem cargo rules (no nocheck/nostrip override needed above compat 13); ${misc:Depends} present in Depends (required at compat 13, since the v14 auto-substvar behaviour does not apply), and no shlibs:Depends needed as a librust-*-dev source-only package installs no ELF binaries.
• libsecp256k1-dev exists in the archive (0.8.0-1, Multi-Arch: same), satisfying both Build-Depends-Arch and the binary package Depends; no embedded third-party code is shipped since it is built against the system library.
• Changelog: distribution unstable, version 0.14.1+dfsg-1, single sensible entry; Standards-Version 4.7.4 matches current Policy 4.7.x.
• debian/tests/control exercises --all-targets/--all-features plus each feature combination; compat 13 skips the test target under nocheck.
• uscan found the packaged version as the newest upstream release (upstream 0.14.1, packaged 0.14.1+dfsg).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC0-1.0).

Not confirmed

• Could not build the package (read-only review). Whether every libsecp256k1 symbol the crate references (ECDH, schnorrsig, extrakeys, ellswift, musig modules) is available at runtime from the system libsecp256k1 build is a build/test matter for the archive to confirm; the dependency and version skew (vendored v0.8.0 vs system 0.8.0-1) look consistent.

Proposed changes

None.