[Pkg-rust-maintainers] rust-boml_2.0.0-1_amd64.changes REJECTED

Mon Oct 12 12:00:07 BST 2026

Hi,

A few issues with this one.  Possibly something has gone wrong with your automation for #2?

1. [important] [licensing] debian/copyright mis-attributes the whole vendored toml-test subtree to BrightShard
 (MIT-or-Apache-2.0); only toml-test/LICENSE is matched to TOML authors / MIT

 - Files: `debian/copyright:10-12`, `.gitmodules`, `tests/toml_test.rs`
 - Evidence: Stanza is `Files: toml-test/LICENSE` / `Copyright: 2018 TOML authors` / `License: MIT`.  toml-test/LICENSE itself is `The MIT License (MIT) / Copyright (c) 2018 TOML authors`. .gitmodules declares `[submodule "toml-test"] path = toml-test url = https://github.com/toml-lang/toml-test`, and tests/toml_test.rs comments say `git submodule foreach git pull origin main`.
 - Problem: Per the copyright-format spec, a `Files` pattern like `toml-test/LICENSE` matches only that exact file; a tree is selected with `toml-test/*`. Every other file of the vendored toml-test (runner.go, json.go, gen.py, cmd/toml-test/*.go, tests/*.toml and .multitest data, specs/v1.0.0.md and v1.1.0.md, README.md, CHANGELOG.md, go.mod/go.sum, .github/workflows/test.yml) therefore falls through to the `Files: *` catch-all, which claims `Copyright: BrightShard` and `License: MIT or Apache-2.0`. Those files are copied from the toml-lang/toml-test repository, (c) TOML authors, licensed MIT only (repo-level LICENSE) - not BrightShard's, and not Apache-2.0. The binary -dev package ships the whole crate source (dh-cargo's get_sources excludes only .git/.pc/debian/target), so the wrong holder/licence pair is installed.
 - Fix: Cover the tree: change the stanza to `Files: toml-test/*` (optionally adding `toml-test/tests/*` et al.  if preferred, though the doc's `foo/*` covers subdirs), keeping `Copyright: TOML authors` (2018-present, see CHANGELOG dates) and `License: MIT`; keep the Files: * stanza for the rest of the crate. Re-running debcargo's licence-hint comments already name this exact spot (debian/copyright.debcargo.hint: 'UNKNOWN-LICENSE; FIXME (overlay) ... Please review them').

2. [important] [packaging] debian/cargo-checksum.json holds an error placeholder instead of real per-file
 checksums

 - Files: `debian/cargo-checksum.json`
 - Evidence: File content is exactly `{"package":"Could not get crate checksum","files":{}}`.
 - Problem: A debcargo-generated package normally ships the crates.io package checksum plus per-file SHA-256 hashes here. dh-cargo's configure step runs `cp debian/cargo-checksum.json .cargo-checksum.json` (cargo.pm), and the install step places it inside the installed registry crate `/usr/share/cargo/registry/boml-2.0.0/.cargo-checksum.json`; cargo uses that file to verify boml whenever another Debian crate resolves it as a registry dependency, so the empty/error placeholder is at best wrong and can break the binary build or every downstream consumer (including the autopkgtest's own `cargo prepare-debian`). This is abnormal for any debcargo package and a sponsor would require it regenerated.
 - Fix: Regenerate the package from the real crates.io tarball with debcargo so `package` and `files` contain genuine SHA-256 checksums (and confirm the resulting binary package builds).

3. [important] [packaging] autopkgtest runs a network-fetching test (tests/crates.rs `syn`) that cannot pass
 in Debian CI

 - Files: `tests/crates.rs:17-25`, `debian/tests/control`
 - Evidence: `#[test] fn syn() { let source = ureq::get(SYN_URL) ... }` with `SYN_URL = "https://raw.githubusercontent.com/dtolnay/syn/.../Cargo.toml"`. debian/tests/control runs `/usr/share/cargo/bin/cargo-auto-test boml 2.0.0 --all-targets ...` with only `Restrictions: allow-stderr`; cargo-auto-test executes `cargo test --all-targets`.
 - Problem: cargo-auto-test runs every test target, so the `syn` test performs an HTTPS request to raw.githubusercontent.com at test time. autopkgtest's default environment has no network access (no `Restrictions: needs-internet` is declared), so the request fails and `.unwrap()` panics, failing all four autopkgtest entries in the Debian CI. The ureq-platform-verifier patch already updated the other (`boml`) assertions in this file to match Debian's ureq features, but left this inherently network-bound test in place, so the patch intent was evidently to make the local test pass while the suite as a whole remains un-runnable offline.
 - Fix: Patch tests/crates.rs for Debian to drop or `#[ignore]` the `syn` network test (it adds no value in a network-less CI), or declare `Restrictions: needs-internet` so the test is skipped where no network is available; either way the package's autopkgtests must pass without network.

Thanks!

Further information may be found at:
   https://dfsg-new-queue.debian.org/reviews/rust-boml

What to do next:

Unless the review says otherwise, this is a request for changes to this
upload and not a rejection of the package itself. Please fix the points
raised and upload again in the usual way, saying in the changelog what
has changed. The reviewer is told when a package they have reviewed is
uploaded again, and will normally look at it ahead of the rest of their
queue.

If anything in the review is unclear, or you believe it is mistaken,
please reply to this email. Your reply goes to the reviewer, and that is
the normal first step.

Questions about uploading again:
   https://dfsg-new-queue.debian.org/docs/FAQ#resubmit
Common reasons for rejection:
   https://dfsg-new-queue.debian.org/docs/FAQ/REJECT

Regards, Andrew McMillan
Member of the DFSG, Licensing & New Packages Team

===

Please feel free to respond to this email if you don't understand why
your files were rejected, or if you upload new files which address our
concerns.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-rust-maintainers/attachments/20261012/5b525767/attachment.sig>