DFSG NEW review for rust-tokio-serial version 5.5.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

The Rust crate itself is Expat-licensed, the LICENSE text is the Expat text, and the DEP-5 debian/copyright matches it for the code and packaging. It is not accurate for everything shipped, however: .github/NOTES.md is copied prose from another project (Apollon77/SupportingFiles), and .github/com0com.cer comes from the same third-party repository, yet Files: * attributes both to Zac Berkowitz under Expat and no licence or copyright holder for them is recorded anywhere in the package.

Packaging

Textbook debcargo-generated packaging: compat 13 with dh-sequence-cargo, a minimal rules, one DEP-3 patch applied in series, complete versioned Build-Depends, a source package header Testsuite: autopkgtest and autopkgtest stanzas whose dependencies are all satisfiable in the archive. Standards-Version: 4.7.4 matches the current Policy 4.7.4.1 in its first two components. I found no packaging fault worth reporting.

Issues

1. [blocker] [licensing] Third-party .github material is claimed as the project's Expat code and its holder/licence are missing from debian/copyright

• Files: .github/NOTES.md:1-11, .github/com0com.cer, debian/copyright:6-8
• Basis: checked, in the package or with a reference tool
• Evidence: .github/NOTES.md: From [Apollon77/SupportingFiles/README_SERIAL_TESTING.md](https://github.com/Apollon77/SupportingFiles/blob/master/README_SERIAL_TESTING.md), preserved locally for use. Original text below:; debian/copyright has Files: * / Copyright: 2017 Zac Berkowitz and other tokio-serial contributors / License: Expat.
• Problem: The bulk of .github/NOTES.md is prose copied from another project's repository, and .github/com0com.cer is the com0com driver certificate downloaded from that same repository (documented by NOTES.md and used in .github/workflows/github-ci.yml). Neither file carries a licence notice, and nothing in the package records a grant from its authors, so the sole Files: * stanza both names the wrong copyright holder and asserts an Expat licence for third-party material that Zac Berkowitz cannot license. Distributing files whose terms are unknown does not meet DFSG 1, and DEP-5 (copyright-format 1.0 §5.2, §6.5) requires the actual copyright holders and licences to be stated.
• Fix: Because both files serve only upstream's Windows CI, the simplest fix is to drop them from the Debian source (exclude .github/NOTES.md and .github/com0com.cer from the orig tarball/repack and remove them from the tree) and say so in debian/copyright. If they are kept, establish their actual licence and add a Files: .github/* stanza naming their authors and that licence, and narrow Files: * so it no longer covers them.

Verified

• Read all of debian/: control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, source/format, patches/series and the patch, tests/control, upstream/metadata.
• Read every upstream text/source file: src/lib.rs, src/frame.rs, examples/*.rs, tests/test_serialstream.rs, Cargo.toml, Cargo.toml.orig, Cargo.lock, README.md, CHANGELOG.md, LICENSE, .github/NOTES.md, .github/workflows/github-ci.yml, .gitignore, .cargo_vcs_info.json. The only licence text in the tree is the Expat text in LICENSE; there are no SPDX headers or other licence notices. examples/filter_play_sound.rs carries a dave horner 10/24 comment, a contributor covered by the same project licence, not a separate holder.
• debian/copyright is DEP-5 (correct Format: URL), with Files: *, Files: debian/* and a stand-alone License: Expat matching LICENSE exactly in substance; the licence is the Expat/MIT text and the short name is correct.
• .github/com0com.cer is a Windows certificate for the com0com driver: documented in .github/NOTES.md and installed with CertMgr.exe by .github/workflows/github-ci.yml. It is certificate data, not compiled code and has no source form, so it is not a built-file problem; its missing provenance is covered by the licensing issue above.
• Packaging check: debian/rules is dh $@ --buildsystem cargo with compat 13 and dh-sequence-cargo (provided by dh-cargo, which Depends on cargo); the build-system test hook in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm runs cargo build, so the test-only dependencies not present in Build-Depends-Arch are not needed at build time.
• debian/tests/control uses the autopkgtest @ binary-package expansion correctly; socat and every versioned librust-* test dependency exist in the archive (librust-env-logger-dev 0.11.10, librust-anyhow-dev 1.0.103, librust-tokio-util-dev 0.7.19, librust-mio-serial-dev 5.0.7, librust-tokio-dev 1.53.1).
• debian/changelog (unstable, 5.5.0-1, Saturday 17 Oct 2026) agrees with the patch (relax-dev-dependencies.patch), which has DEP-3 headers and is listed in series.
• Current Policy is 4.7.4.1 (xd://policy), so Standards-Version: 4.7.4 is fine; the Rust package split, Architecture: any, Multi-Arch: same and the generated Provides aliases follow the Rust team's established scheme.
• uscan found the packaged version as the newest upstream release (upstream 5.5.0, packaged 5.5.0).

Not confirmed

• The licence of the original Apollon77/SupportingFiles/README_SERIAL_TESTING.md (and of the com0com certificate) cannot be read from the package; no grant is recorded for them, which is the basis of the licensing issue.
• I did not attempt a build; nothing in the package names a missing file or an unavailable Build-Depends.

Proposed changes

None.