[datlechin]

Summary

• debian/copyright describes the source package: a paragraph for every crate cargo vendor ships (all 798 of Cargo.lock, not the 500 linked ones), from each crate's own license and notice files, with Cargo.toml authors and a stand-alone license paragraph for crates that ship no text.
• Code crates carry from other projects gets its own paragraph from build-aux/about/source.json: the gettext and DuckDB archives, SQLite and SQLCipher, ring, lcms2, libm's SunPro files, and the files the hunt found under other licenses (GPL-3 x11rb example, CC-BY-3.0 and Go files, APSL docs, Unicode data). A license file or archive inside a crate that nothing describes fails the update script, and so does an unread license file inside a described archive.
• license-metadata (Meson packaging suite) now fails when a Cargo.lock crate has no vendor/ paragraph or a paragraph names a crate the lock dropped. On main's file it reports the 298 missing crates.
• GNU license texts (GPL 2 and 3, LGPL 2.1) point at common-licenses; DEP-5 names them GPL-2+, AGPL-3+.
• RPM: bundled() Provides for AWS-LC, DuckDB and each library DuckDB compiles in, written from build-aux/about/bundled with the version only where the source states one.
• RPM: LICENSE.dependencies comes from cargo2rpm's own cargo tree call on tablepro and tablepro-ssh for the build architecture. %cargo_license covers every workspace member and target: the 28.5 macros take no -p and cargo2rpm 0.4 drops it. The License tag stays the linked crates' expression.
• The binary notices gain the three pieces DuckDB embeds without a third_party folder: Arrow ADBC and nanoarrow, robin-hood-hashing and the merge sort tree.
• ADR 0040 records the change; ADR 0018's status points to it.

Test plan

• CoverageTests.test_a_build_only_or_platform_only_crate_without_a_paragraph_fails and CommandTests.test_check_fails_when_the_lock_gains_a_crate_the_copyright_file_lacks fail on main's generator; test_source_inventory.py covers the vendor set, nested code and archive members. 118 packaging tests pass.
• test_license_metadata.py tests that pinned the old shape change with it: the copyright is rendered from the source inventory, an LGPL text is cut to its pointer, and GPL-2.0 is written GPL-2.
• python-debian parses the generated file strictly: 510 Files paragraphs, every text-less synopsis backed by a stand-alone License paragraph.
• Linux packages workflow, x86_64 and arm64: lintian on the source and binary packages, the RPM's provides and LICENSE.dependencies.

Needs the maintainer: cargo2rpm's license.py builds "--package={package}" without its f prefix (codeberg.org/rust2rpm/cargo2rpm); once a fixed cargo2rpm and macros newer than 28.5 reach f44/f45, the spec can go back to %cargo_license -p tablepro.