It is my understanding that when an executable program that depends (directly or indirectly) on libraries licensed under MIT and/or Apache 2.0 is compiled into a statically-linked binary that is then distributed to third parties, the binary must be accompanied by the individual licenses & copyright notices for all of the program's direct & indirect dependencies. (If you can definitively confirm or refute this belief, please consider posting an answer to this question.) However, I've come across some software in the official Debian repositories that does not seem to properly honor these requirements. I'd expect the Debian packagers to get licensing right, so I'm wondering what I'm missing.
Specific example: The program hyperfine, written in Rust. Rust libraries are usually statically-linked, so the compiled binaries that the Debian project distributes contain code from all of hyperfine's dependencies.
The webpage for the hyperfine v1.17.0 package in Debian Trixie can be found here. Clicking on "Copyright File" on the right side of the page leads to a
debian/copyrightfile that declares that the source files and the Debian packaging files are both licensed under "MIT or Apache-2.0", and the copyright line listed for the source files credits only the author of hyperfine. (Note that most if not all of hyperfine's dependencies are written by other authors.) The file contains the text of the MIT license (separate from the copyright) and a reference to where the text of the Apache 2.0 license can be found.
Downloading & inspecting a binary
.debfile for hyperfine (I picked the amd64 deb) shows that it contains the same
copyrightfile and no other copyright information, though the Debian
controlfile does contain an "X-Cargo-Built-Using" field listing the names & versions of the Debian Rust packages used to build the deb. Note that these "built using" packages are only used at build time and are not listed as runtime dependencies (and so they are not installed when installing hyperfine from the Debian repositories). This is supported by the fact that running
lddon the hyperfine binary only lists the glibc libraries as being dynamically linked, and so the other build-time dependencies (i.e., the third-party Rust libraries) are most likely statically linked into the binary.
For a specific dependency of hyperfine's whose license I believe is being violated, consider the direct dependency indicatif. The X-Cargo-Built-Using field for the binary package I inspected states that the hyperfine binary was built with indicatif v1.17.3, the source for which contains this
LICENSEfile, consisting of a copyright line and the text of the MIT license. This copyright line does not appear in the above-mentioned copyright file or anywhere in the deb file.
So, is Debian handling dependency licenses for this package and others incorrectly, or is there something I'm missing?