Review: rust-tokio-serial 5.5.0+ds-1

Package Information

Description	Serial port implementation for tokio - Rust source code Source code for Debianized Rust crate "tokio-serial"
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	Michele Cane <michele.cane@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/tokio-serial] (browse)
Tracker	https://tracker.debian.org/pkg/rust-tokio-serial
Uploaded	14 days ago

New Package Report

.changes◂

Date	Sat, 24 Oct 2026 13:53:56 -0500
Source	rust-tokio-serial
Version	5.5.0+ds-1
Changed-By	Michele Cane <michele.cane@proton.me>
Architecture	source amd64
Distribution	unstable

Changelog◂

rust-tokio-serial (5.5.0+ds-1) unstable; urgency=medium
 .
   * Package tokio-serial 5.5.0 from crates.io using debcargo 2.8.4
   * Initial Debian packaging.
   * Relax the env_logger test dependency to Debian's version.
   * Disable the filter_play_sound example, which requires the cpal 0.15 API.
   * Add socat and writable pseudo-terminal paths for autopkgtests.
   * Repack the upstream crate to exclude unlicensed third-party Windows CI
     files.

.dsc◂

Priority	optional
Component	main
Package-List	librust-tokio-serial-dev deb rust optional arch=any
Section	rust

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: tokio-serial
Upstream-Contact: Zac Berkowitz <zac.berkowitz@gmail.com>
Source: https://github.com/berkowski/tokio-serial
Files-Excluded:
 .github/NOTES.md
 .github/com0com.cer
Comment:
 These third-party Windows CI files have no clear redistribution licence and
 are not needed to build or test the Debian package.

Files: *
Copyright: 2017 Zac Berkowitz and other tokio-serial contributors
License: Expat

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Michele Cane <michele.cane@proton.me>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 14 days ago.

Report◂

DFSG NEW review for rust-tokio-serial version 5.5.0+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The crate is licensed under the Expat (MIT) licence throughout: the LICENSE file, every Rust source file, and the Cargo.toml license = "MIT" field agree. debian/copyright is in machine-readable DEP-5 format, has correct Files: * and Files: debian/* stanzas with the right holders, uses the correct Expat short name, and reproduces the full licence text (not in /usr/share/common-licenses). The two Files-Excluded entries are genuinely absent from the shipped source. No non-free terms, no files lacking a licence, and no non-preferred-form artifacts were found.

Packaging

Standard, clean debcargo-generated packaging. debhelper-compat 13 with dh $@ --buildsystem cargo is correct; the cargo buildsystem's build step only copies sources, and dh_auto_test runs cargo build (not cargo test), so the nocheck-annotated Build-Depends-Arch and the absence of dev-dependencies as build-dependencies are correct. The binary package split, Provides for all feature combinations, Multi-Arch: same, autopkgtests, upstream/metadata, and changelog are all sound. Standards-Version 4.7.4 is current.

Issues

minor licensing 1. Files-Excluded omits .github/setup_com0com_W7_x64_signed.exe, a third-party Windows CI binary referenced by the shipped workflow ◂

Files: debian/copyright, debian/debcargo.toml, .github/workflows/github-ci.yml:61-64
Basis: inferred from what was read, not seen directly
Evidence: .github/workflows/github-ci.yml runs 'CertMgr.exe /add com0com.cer ...' and then 'setup_com0com_W7_x64_signed.exe /S' with working-directory: .github, yet debian/copyright Files-Excluded (and debian/debcargo.toml excludes) list only .github/NOTES.md and .github/com0com.cer.
Problem: The workflow invokes setup_com0com_W7_x64_signed.exe from .github/, so that unsigned binary (a com0com installer, no source, no clear redistribution licence) was almost certainly in the upstream crates.io tarball alongside the two files already excluded. If it was repacked out without being listed, a fresh uscan repack would re-include the binary, and Files-Excluded no longer accurately describes the repacking.
Fix: Confirm whether the .exe is in the upstream crates.io tarball; if so, add .github/setup_com0com_W7_x64_signed.exe to both Files-Excluded in debian/copyright and excludes in debian/debcargo.toml.

Verified ◂

Read all 13 non-debian source files (src/lib.rs, src/frame.rs, examples/*.rs, tests/test_serialstream.rs, README.md, CHANGELOG.md, Cargo.toml, Cargo.toml.orig, LICENSE, .cargo_vcs_info.json, .gitignore, .github/workflows/github-ci.yml): all MIT/Expat, matching the Files: * stanza.
LICENSE header 'Copyright (c) 2017 Zac Berkowitz and other tokio-serial contributors.' matches the Files: * Copyright field; the debian/* stanza correctly covers packaging files and the full Expat text is reproduced.
The two Files-Excluded files (.github/NOTES.md, .github/com0com.cer) are absent from both the tree and the +ds orig tarball, as intended.
examples/filter_play_sound.rs carries a 'dave horner 10/24' attribution, covered by the generic 'other tokio-serial contributors' holder (the project-level MIT notice); no separate copyright assertion is made.
The example's cpal 0.15 dev-dependency is dropped and its [[example]] stanza removed by relax-dev-dependencies.patch, so the unbuilt example file remaining in the tree is harmless source.
Confirmed in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm that build only copies sources and test runs 'cargo build' (not 'cargo test'), so the nocheck Build-Depends-Arch and omitted dev-dependencies are correct.
No binaries, minified code, jars, .so/.pyc or other non-preferred-form artifacts; Cargo.lock and .cargo_vcs_info.json are generated metadata.
uscan found the packaged version as the newest upstream release (upstream 5.5.0, packaged 5.5.0+ds).

Not confirmed ◂

Whether .github/setup_com0com_W7_x64_signed.exe was actually present in the upstream crates.io tarball (and thus removed during repacking without being listed) could not be checked without the un-repacked upstream tarball.

Proposed changes ◂

None.

Uploader's response to the LLM review

The minor finding appears to be based on an inference from .github/workflows/github-ci.yml, but .github/setup_com0com_W7_x64_signed.exe is not present in the upstream crates.io 5.5.0 archive.

I inspected the original crate archive directly. Its .github directory contains only:

.github/NOTES.md
.github/com0com.cer
.github/workflows/github-ci.yml

The Debian +ds repack excludes the first two files, leaving only the workflow. Since the executable is not part of the upstream source archive, it cannot and should not be listed in Files-Excluded.

No package change is required.

— Michele Cane (heiserhorn), 14 days ago

Review Information

accepted — allocated to awm 14 days ago, started 14 days ago, completed 14 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
5.5.0-1	c7be078b…	2026-10-19 09:17	2026-10-19 09:17	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package