DFSG NEW review for crosvm version 0.1.0~git20261022.c917be82d+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 9 found

Licensing

DFSG-compliant. The tree is BSD-3-Clause throughout (root LICENSE, common/data_model/LICENSE, every per-file header) except for clearly delimited, mutually compatible per-file licences that debian/copyright names in their own stanzas: Apache-2.0 for third_party/vmm_vhost (two files dual Apache-2.0/BSD-3-Clause), Expat for third_party/libslirp-rs and the Wayland protocol XMLs plus gpu_display/src/dwl.rs, Apache-2.0 for infra/recipes.py, GPL-2 for the Linux guest kernel test patch. The only files with no licence grant (Microsoft WinHv*.h, "All rights reserved") are listed in Files-Excluded and are absent from the tarball. Every licence whose text is not in /usr/share/common-licenses is reproduced in full, and no copyright holder found in the tree is missing from the file.

Packaging

Careful, well-documented packaging. 3.0 (quilt); debhelper 14 with dh-cargo and the Debian cargo wrapper used exactly as the wrapper documents (Cargo.lock removed as dh-cargo's own buildsystem does, CFLAGS/DEB_HOST_RUST_TYPE/DEB_CARGO_CRATE exported, Built-Using and Static-Built-Using generated by dh-cargo-built-using); explicit install of the binary, the manpage and the arch seccomp policies; three DEP-3 patches whose purpose and regeneration are explained in debian/README.source and debian/trim-workspace.py. Standards-Version 4.7.4 against Policy 4.7.4.1, Vcs-*/Homepage/upstream metadata/gbp.conf/Salsa CI all consistent. Dependencies exist in the archive where spot-checked. The only quality gap is testing: there is no autopkgtest and the upstream suite is never run, which is reported as a minor issue.

Issues

1. [minor] [packaging] No autopkgtest, and an empty override_dh_auto_test means the package is never tested

• Files: debian/rules:39-41

• Basis: checked, in the package or with a reference tool

• Evidence:

  The upstream test suite starts virtual machines and needs /dev/kvm, which a

  build chroot does not have.

  override_dh_auto_test:

  and no debian/tests/ directory exists

• Problem: Upstream ships unit tests and the binary has command-line paths that need no KVM, but neither the build nor autopkgtest exercises the installed crosvm at all. This is not a Policy violation (Policy 4.9.1 only gives the nocheck flag meaning), but for a new VMM package nothing in the archive proves that the shipped binary even starts.

• Fix: Add debian/tests/control with a smoke test such as crosvm version and crosvm run --help, and consider running the KVM-free unit tests there too.

Verified

• debian/copyright is DEP-5 (Format 1.0) with stanzas for Files: , vmm_vhost, two dual-licensed vmm_vhost files, libslirp-rs, the five Wayland protocol files plus dwl.rs, infra/recipes.py, the kernel test patch and debian/; the standalone BSD-3-Clause, Apache-2.0, Expat and GPL-2 paragraphs are complete and the common-licenses pointers are correct.
• Files-Excluded names exactly hypervisor/src/whpx/whpx_sys/WinHv{Emulation,Platform,PlatformDefs}.h; that directory in the tarball holds only ChromiumOS-authored types.rs, vcpu.rs, vm.rs, whpx_sys.rs, bindings.rs and hyperv_tlfs.rs, so the excluded files are absent. bindings.rs is bindgen output (automatically generated by rust-bindgen 0.59.2) with no Microsoft notice and is Windows-only.
• third_party/vmm_vhost: per-file SPDX says Apache-2.0, with backend.rs and lib.rs Apache-2.0 or BSD-3-Clause; the specific stanza names Alibaba, Amazon and ChromiumOS. The two LICENSE-BSD-* texts are the notices those files rely on.
• third_party/libslirp-rs/LICENSE is MIT (Copyright (c) 2019-2020 Red Hat, Inc), matching the Expat stanza; the directory is not a crate and is not built (slirp is Windows-only and disabled).
• gpu_display/protocol/{xdg-shell,linux-dmabuf-unstable-v1,viewporter,aura-shell,virtio-gpu-metadata-v1}.xml and gpu_display/src/dwl.rs carry the stated Expat notices, and all holders (Høgsberg, Antognolli, St. Pierre, Intel, Samsung, Red Hat, Collabora, Chromium Authors) appear in the matching stanza.
• infra/recipes.py is Apache-2.0 by the LUCI Authors; all other infra/, tools/, docs/, .agents/ and logo/ files carry the ChromiumOS BSD-3 header or no header, and are covered by Files: *.
• e2e_tests/guest_under_test/kernel/patches/virtio_pvclock.patch adds a GPL-2.0-or-later driver and a (GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause uapi header; the stanza's Comment records both, and the patch is only used to build the end-to-end test guest, not the Debian binary.
• kernel_loader/src/test_elf32.bin is built from the adjacent kernel_loader/src/test_elf.S with kernel_loader/src/test_elf.ld (the exact as/ld commands are in the .S header): test input for the kernel_loader unit tests, not a source-less blob, as debian/source/lintian-overrides states.
• kernel_loader/src/test_elf64.bin is produced by the same kernel_loader/src/test_elf.S and kernel_loader/src/test_elf.ld with the 64-bit assembler command given in the .S header: test input, not a source-less blob.
• cros_fdt/test-files/base.dtb is compiled from cros_fdt/test-files/base.dts in the same directory (cros_fdt/test-files/compile_testfiles.sh runs dtc -@ -I dts -O dtb over every .dts): test input, not built code.
• cros_fdt/test-files/external_refs_base.dtb is compiled from cros_fdt/test-files/external_refs_base.dts by compile_testfiles.sh: test input.
• cros_fdt/test-files/external_refs_overlay.dtb is compiled from cros_fdt/test-files/external_refs_overlay.dts by compile_testfiles.sh: test input.
• cros_fdt/test-files/local_refs.dtb is compiled from cros_fdt/test-files/local_refs.dts by compile_testfiles.sh: test input.
• cros_fdt/test-files/overlay.dtb is compiled from cros_fdt/test-files/overlay.dts by compile_testfiles.sh: test input.
• cros_fdt/test-files/overlay_deps.dtb is compiled from cros_fdt/test-files/overlay_deps.dts by compile_testfiles.sh: test input.
• devices/src/virtio/video/decoder/backend/test-25fps.h264 is the stream the decoder tests include with include_bytes! (backend/mod.rs), with test-25fps.crc as the expected frame CRCs; it is test data, not built code (see unconfirmed for its provenance).
• No non-free wording found: greps for non-commercial, No Derivative, for research only, All rights reserved and the JSON "Good, not Evil" clause hit only README.source/debian/copyright describing the excluded headers and an unrelated code comment.
• rules' CROSVM_FEATURES (qcow,balloon,net,usb,audio) all exist in Cargo.toml's [features]; the policies installed from jail/seccomp/$(DEB_HOST_GNU_CPU)/ (aarch64, riscv64, x86_64) match the absolute @include paths, and jail/build.rs finds compile_seccomp_policy on PATH (python3-minijail) and uses the checked-in constants.json.
• Build-Depends spot-checked with apt-cache: librust-log-0+default-dev, librust-log-0+release-max-level-debug-dev, chrono-0.4+now, env-filter-1, rand-0.10, lz4-flex-0.13, which-8, minijail, p9-0.3, named-lock-0.3, intrusive-collections-0.10, protobuf-codegen-3, serde-bytes-0.11, remain-0.2, enumn-0.1, async-task-4, uuid-1+v8 and zerocopy-0.8+alloc all resolve, and python3-minijail is 2026.05.18+git20261016.8787d1a-2 (arch:all).
• The manpage's commands (version, powerbtn, sleepbtn, gpe, create_qcow2, balloon_ws, make_rt) and --extended-status exist in src/crosvm/cmdline.rs; dh_installman supports debian/package.manpages.
• Read all of debian/ and the three patches in full; checked every copyright/licence-bearing line by grep; did not read the 9,934-line generated whpx bindings.rs or the 100 KB xlib.rs beyond their headers.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.1.0~git20261030.c256c8902, packaged 0.1.0~git20261022.c917be82d+ds), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-2).

Not confirmed

• No build was run (by instruction). The ~60 Build-Depends and the match between Cargo.toml version requirements and the archive's crate versions were only spot-checked, so the review cannot rule out a crate that resolves nowhere.
• The provenance of devices/src/virtio/video/decoder/backend/test-25fps.h264 is not documented in the package; crosvm's docs fetch it from Chromium's media test data, and it is assumed to fall under Files: * (BSD-3-Clause).
• Whether shipping bindgen output generated from the excluded, non-redistributable Microsoft WinHv headers (hypervisor/src/whpx/whpx_sys/bindings.rs, API declarations only, Windows-only, never built on Linux) is acceptable was not decided either way.
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: read: "xd://policy:1-40" is not a file of the package or of the reviewing system.

Proposed changes

None.