[Pkg-rust-maintainers] rust-dragonbox-ecma_0.1.12-1_amd64.changes REJECTED

[Reinhard Tartler]

Thanks for your diligence in preparing this package. I've taken a
look at the licensing and found a couple of spots that could use
some refinement in debian/copyright to ensure we're covering all
the bases.

The most important thing I spotted is that src/to_chars_ecma.rs is
explicitly described as a port of V8's DoubleToStringView. The code
itself contains several functions labeled as V8's (like
convert_2_digits, convert_8_digits, etc.). Since porting code
creates a derivative work under copyright law, we're legally
required by V8's BSD-3-Clause license to preserve their copyright
notice and license text.

This looks like a bit of a licensing omission by upstream—while the
comment attribution is great, it doesn't quite satisfy the BSD
requirement to include the actual license boilerplate. It would be
best if this were sorted out upstream eventually, but for now, we
absolutely need to document the V8 project authors' copyright and
the BSD-3-Clause text in debian/copyright to ensure the Debian
package is legally sound.

I also noticed that src/buffer.rs and src/to_chars_ecma.rs are
missing from the specific src/*.rs section that credits Junekey
Jeon. While src/to_chars_ecma.rs is a V8 port, src/buffer.rs seems
to be part of the core logic that Junekey Jeon originally authored
in the dragonbox crate. Similarly, tests/macros/mod.rs is missing
from the section covering the tests authored by Ulf Adams. Adding
these specifically would make the file coverage much clearer.

Everything else looks solid. Once these attributions are tidied up,
the package should be in great shape.

-rt

Further information may be found at:
   https://dfsg-new-queue.debian.org/reviews/rust-dragonbox-ecma

Regards, Reinhard Tartler
Member of the DFSG, Licensing & New Packages Team



===

Please feel free to respond to this email if you don't understand why
your files were rejected, or if you upload new files which address our
concerns.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-rust-maintainers/attachments/20260605/1b718daa/attachment-0001.sig>