DFSG NEW review for rust-serde-pickle version 1.2.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 17 found

Licensing

The code is free: every Rust and Python source file carries the same MIT/Apache-2.0 notice (2015-2024 Georg Brandl), LICENSE-APACHE is the full Apache 2.0 text, and debian/copyright is DEP-5 with both licence texts. It is not accurate for every file, however: LICENSE-MIT's own notice names The Rust Project Developers, and the catch-all Files: * stanza attributes that file to Georg Brandl alone and never records that holder.

Packaging

Standard debcargo packaging, done well: Build-Depends-Arch follows Cargo.toml after the patches and all its names exist in the archive; the <!nocheck> markers match the fact that dh-cargo's only compile step is dh_auto_test's cargo build; the five patches are DEP-3 with clear purposes and consistent hunks in both Cargo.toml and Cargo.toml.orig; autopkgtests exercise the default, no-feature and feature combinations with the dev-dependencies declared there; changelog, compat level 13, source format and Vcs fields are all sane.

Issues

1. [blocker] [licensing] debian/copyright attributes LICENSE-MIT to Georg Brandl and does not name The Rust Project Developers

• Files: LICENSE-MIT:1, debian/copyright:6-9
• Basis: checked, in the package or with a reference tool
• Evidence: LICENSE-MIT:1: Copyright (c) 2014 The Rust Project Developers; debian/copyright, Files: *: Copyright: 2015-2024 Georg Brandl <georg@python.org>
• Problem: LICENSE-MIT is matched by the catch-all Files: * stanza, so the only copyright notice it carries is recorded as Georg Brandl's, and The Rust Project Developers are not named anywhere in the file. The MIT permission text is reproduced, but copyright-format 6.8 requires the Copyright field to collect all relevant copyright notices of the files in the stanza; this one is missing, and debcargo's own debian/copyright.debcargo.hint did have a separate Files: LICENSE-MIT stanza with that holder, so this was dropped, not overlooked for lack of evidence. I also confirmed the same notice in the .orig tarball's LICENSE-MIT.
• Fix: Add a stanza after the catch-all, e.g. Files: LICENSE-MIT / Copyright: 2014 The Rust Project Developers / License: MIT, so the holder is recorded; a Files: LICENSE-APACHE stanza for the licence text is optional.

Verified

• Read every file of debian/ (control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, README.source, source/format, all five patches and series, tests/control, upstream/metadata) and the .dsc and .orig tarball.
• Inventoried all 45 upstream files: src/ (consts.rs, de.rs, error.rs, lib.rs, ser.rs, value.rs, value_impls.rs), examples/pickle.rs, benches/benchmark.rs, benches/data/ (biglist.pickle, genperfdata.py, manyrefs.pickle, manystrings.pickle), test/{arby.rs,mod.rs}, test/data/, .github/workflows/main.yml, Cargo.toml, Cargo.toml.orig, Cargo.lock, CHANGELOG.md, LICENSE-APACHE, LICENSE-MIT, README.md, rust-toolchain, .rustfmt.toml, .gitignore, .cargo_vcs_info.json.
• Every .rs and .py source file begins with the identical header Copyright (c) 2015-2024 Georg Brandl ... Licensed under the Apache License, Version 2.0 ... or the MIT license; test/data/generate.py has the same header (its http:#... in the header is an upstream typo, not a licence term); benches/data/genperfdata.py has no header but is covered by the crate-wide MIT/Apache-2.0 terms.
• LICENSE-APACHE is the complete, unmodified Apache License 2.0 (201 lines including the appendix); LICENSE-MIT is the standard MIT text. debian/copyright is DEP-5 and has stand-alone MIT (full text) and Apache-2.0 (pointer to /usr/share/common-licenses/Apache-2.0) paragraphs; Cargo.toml's license = "MIT/Apache-2.0" agrees.
• grep over the whole tree (gitignore false, excluding .pc) for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Apache License/Mozilla/public domain/All rights reserved found no holder or licence terms other than the above two files; no non-free clauses, field-of-use or no-modification text anywhere.
• The 17 binary files from the scan are all pickle fixtures, not built artefacts, and their generators are shipped: benches/data/biglist.pickle, benches/data/manyrefs.pickle, benches/data/manystrings.pickle are produced by benches/data/genperfdata.py and read by bench_picklefile in benches/benchmark.rs:180-182; test/data/test_recursive_proto1.pickle, test_recursive_proto2.pickle, test_recursive_proto3.pickle, test_recursive_proto4.pickle, test_recursive_proto5.pickle (and proto0) are produced by test/data/generate.py and read by the recursive test in test/mod.rs:340-353; test/data/test_unresolvable_global.pickle is produced by the same script and read by test/mod.rs:435; test/data/tests_py2_proto0.pickle, tests_py2_proto1.pickle, tests_py2_proto2.pickle, tests_py3_proto1.pickle, tests_py3_proto2.pickle, tests_py3_proto3.pickle, tests_py3_proto4.pickle, tests_py3_proto5.pickle (and py3 proto0) are produced by generate.py and read by the unpickle_all test in test/mod.rs:322-330. generate.py reproduces exactly this set of names, so their preferred form for modification is present.
• Packaging dependencies: every Build-Depends-Arch and binary-Depends name exists in the archive - librust-num-bigint-dev 0.5.1-1 provides librust-num-bigint-0.5+default-dev, librust-criterion-dev 0.5.1-11 provides criterion-0.5, librust-iter-read-dev 1.1.0-1, librust-rand-dev 0.10.3+ds-1, librust-quickcheck-dev 1.1.0-1, and dh-cargo 34 provides dh-sequence-cargo (and cargo-auto-test, so tests/control's dh-cargo (>= 33~) is satisfiable). Dependencies correspond one-for-one to Cargo.toml's dependencies after the patches.
• Dev-dependencies (quickcheck, rand, regex, serde_derive, serde_json) are absent from Build-Depends and present in debian/tests/control: correct, because /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm's test step runs cargo build unless test is passed, and debian/rules passes nothing.
• Build-Depends-Arch marks every Rust build dependency <!nocheck>: consistent with cargo.pm, whose only compile is the dh_auto_test step that dh skips under nocheck; compat 13 does not run overrides there and none is defined.
• Patches: all five have DEP-3 headers (Description, Author, Forwarded, Last-Update), each states its purpose, and the working tree confirms they applied; num-bigint/criterion/test-dependency changes are mirrored in both Cargo.toml and Cargo.toml.orig, and the num-bigint 0.5 change matches the archive's librust-num-bigint-dev 0.5.1.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components 4.7) is current enough; debhelper-compat (= 13) with dh $@ --buildsystem cargo, source format 3.0 (quilt), changelog 1.2.0-1 in unstable dated Fri, 30 Oct 2026 closing #1152598, Homepage and Vcs-* fields consistent with the upstream repository and debcargo-conf layout.
• No maintainer scripts, no .maintscript, no files needing Files-Excluded (LICENSE-MIT in the unpacked tree is identical to the .orig tarball's), no images, fonts or PDFs, and no documentation built from missing sources.
• uscan found the packaged version as the newest upstream release (upstream 1.2.0, packaged 1.2.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• I did not build the package or run the autopkgtests (read-only review); the QuickCheck/rand port, the criterion bench gating and the fixtures' restore-state change were checked by reading the patches and the patched tree, not by executing them.

Proposed changes

None.