DFSG NEW Queue - Review: python-rbloom 1.5.4-1

Review: python-rbloom 1.5.4-1

Package Information

Description	Bloom filter library implemented in Rust (Python3 version) A fast, simple and lightweight Bloom filter library for Python, implemented in Rust. It's designed to be as pythonic as possible, mimicking the built-in set type where it can, and works with any hashable object. This package contains the Python 3 version of the library.
Maintainer	Debian Python Team <team+python@tracker.debian.org>
Changed By	Michael Fladischer <fladi@debian.org>
Sponsor	fladi@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/python-team/packages/python-rbloom.git (browse)
Closes	#1149885
Tracker	https://tracker.debian.org/pkg/python-rbloom
Uploaded	1 month, 4 days ago

New Package Report

.changes◂

Distribution	unstable
Date	Fri, 02 Oct 2026 09:45:04 +0000
Source	python-rbloom
Version	1.5.4-1
Changed-By	Michael Fladischer <fladi@debian.org>
Architecture	source riscv64

Changelog◂

python-rbloom (1.5.4-1) unstable; urgency=low
 .
   * Initial release (Closes: #1149885).

.dsc◂

Priority	optional
Component	main
Package-List	python3-rbloom deb python optional arch=any
Section	python

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: python-rbloom
Upstream-Contact: Kenan Hanke
Source: https://github.com/KenanHanke/rbloom

Files: *
Copyright: 2023-2025, Kenan Hanke
           2023-2025 Zachary Dremann
           2024 Dan Lenski
           2023 Rory McNamara
License: Expat

Files: debian/*
Copyright: 2026, Michael Fladischer <fladi@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

Review Information

accepted — allocated to awm 26 days ago, started 26 days ago, completed 26 days ago.

Final Comment

Hi,

A couple of minor issues you should think about fixing on your next upload...

[important] [packaging] Build-Depends missing python3-dev: cdylib links libpython but nothing in Build-Depends provides the dev symlink

Files: debian/control (Build-Depends); debian/patches/0002-Patch-out-extension-module-pyo3-feature.patch
Evidence: Patch 0002 deletes "extension-module", from the pyo3 features in Cargo.toml, so pyo3 links against libpython. python3-all Depends only on python3, python3.14, python3.15; dh-python/dh-sequence-python3 and pybuild-plugin-pyproject Depends only python3:any; python3-maturin Depends python3:any, libc6, libgcc-s1, libzstd1 (verified via apt-cache). None installs the libpython3.X.so dev symlink/python3-config that linking -lpython3.X (or pyo3-build-config's libpython lookup) needs; only python3-dev/libpython3-dev provide it.
Problem: With extension-module removed, the final .so must be linked against libpython, which requires the development library. On a clean buildd (or sbuild/pbuilder chroot) where only the declared Build-Depends are installed, the link step could fail or pyo3's build could error "Could not find Python dynamic library". The local build likely worked only because the maintainer's environment happens to have python3-dev installed. This is a genuine missing build dependency.
Fix: Add python3-all-dev (or at least python3-dev; if pybuild builds against all of python3-all's interpreters, the per-version -dev of each is needed) to Build-Depends, then verify with a clean build.

[minor] [packaging] Generated cargo build state committed in debian/cargo_home

Files: debian/cargo_home/config.toml, debian/cargo_home/.package-cache, debian/cargo_home/.package-cache-mutate, debian/cargo_home/registry/CACHEDIR.TAG; debian/clean
Evidence: debian/cargo_home/config.toml contains machine/build-specific content, e.g. [build] rustflags = [... '-C', 'linker=riscv64-linux-gnu-gcc', ... '--remap-path-prefix', '/build/python-rbloom-1.5.4=/usr/share/cargo/registry/python-rbloom-1.5.4', ...], with source.crates-io replace-with = "dh-cargo-registry" pointing at /build/python-rbloom-1.5.4/debian/cargo_registry. .package-cache / .package-cache-mutate are empty. All four are present in python-rbloom_1.5.4-1.debian.tar.xz. debian/clean lists only debian/cargo_home/.global-cache, which is why the others leaked into the source package.
Problem: Build-time artifacts with absolute build paths and a cross-arch linker got committed to the Debian source package. They are regenerated by cargo prepare-debian each build, so they do not break the build, but shipping them is sloppy, non-reproducible-looking, and they are not cleaned by dh_clean.
Fix: Remove debian/cargo_home/ (generated at build time) from the source package / git, and either extend debian/clean or gitignore debian/cargo_home/ so the files do not reappear.

Back to Dashboard | View all reviews for this package