DFSG NEW review for python-wkb-wkt-converter version 0.6.3-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole source tree is MIT (Expat). pyproject.toml declares license = { text = "MIT" }, the Cargo workspace declares license = "MIT", and every file carries no explicit header but is uniformly attributed to upstream author Adrien Berchet. debian/copyright is machine-readable DEP-5 with a Files: * catch-all (Copyright: Adrien Berchet, License: Expat, full text included), a debian/* stanza (Edward Betts, 2026), and a standalone Expat paragraph. The prescan matched every copyright holder found in the tree against debian/copyright. No non-free terms, no built/vendored/minified files, fonts, or images of unclear provenance: the fuzz seeds/ are plain-text test fixtures, and the only Rust crates in Cargo.lock (pyo3, hex, etc.) are supplied from Debian's system crates, not vendored. Both answers: licensing is DFSG-compliant and accurate.

Packaging

Packaging is generally clean and modern: debhelper-compat 14, dh-sequence-python3/pybuild/maturin, single binary package, hardening bindnow, proper test Build-Depends, Standards-Version 4.7.4 (current 4.7.4.1), autopkgtest-pkg-pybuild, salsa Vcs fields, and a correct gbp.conf. It is held back by one substantive problem: the Rust manifest and Cargo.lock pin pyo3 to 0.28, but the archive only ships librust-pyo3-dev 0.29.3, so the offline cargo link (rules runs cargo prepare-debian --link-from-system then cargo generate-lockfile --offline) cannot satisfy the pyo3 = "0.28" constraint.

Issues

1. [important] [packaging] pyo3 crate version (0.28) not available in Debian; offline cargo build cannot satisfy it

• Files: wkb_wkt_converter_py/Cargo.toml:18, Cargo.lock:45-46, debian/control (Build-Depends: librust-pyo3-dev (>= 0.28)), debian/rules
• Basis: inferred from what was read, not seen directly
• Evidence: pyo3 = { version = "0.28", features = ["extension-module"] }; Cargo.lock pins pyo3 0.28.3 (and pyo3-ffi/macros/build-config 0.28.3). apt-cache show librust-pyo3-dev in unstable returns only 0.29.3-1. debian/rules builds via $(CARGO) prepare-debian debian/cargo_registry --link-from-system then cargo generate-lockfile --offline, and dh_auto_configure --buildsystem=pybuild.
• Problem: pyo3 = "0.28" is a caret constraint (^0.28) that excludes 0.29. Since Debian builds are offline and the only system pyo3 is 0.29.3, cargo generate-lockfile --offline (and the pybuild/maturin build against the linked system crates) cannot resolve pyo3 at all. The package is very unlikely to build in unstable. Build-Depends librust-pyo3-dev (>= 0.28) is satisfied by 0.29.3 but does not instruct the Rust build of the right version.
• Fix: Bump the pyo3 dependency (and matching Cargo.lock entries) to 0.29 to match librust-pyo3-dev 0.29.3 in the archive, or wait until a pyo3 0.28 librust-pyo3-dev upload exists. Verify with an offline archive build after the bump.

Verified

• debian/copyright is DEP-5 format with correct Format: URI; Files: */debian/* stanzas and standalone Expat License paragraph cover the whole tree.
• pyproject.toml, root Cargo.toml and both member Cargo.tomls all declare MIT; full Expat text is reproduced in debian/copyright (matches /usr/share/common-licenses Expat).
• prescan (dfsg-author-check over 70 files) found every copyright holder already named in debian/copyright (Adrien Berchet, Edward Betts).
• No built, minified, vendored or binary files: fuzz seeds/ are plain-text fixtures; only workspace crates are present, all Rust dependencies supplied from Debian system crates.
• Test-only Build-Depends python3-hypothesis, python3-pytest, python3-shapely, librust-hex-dev all exist in the archive; python3-maturin 1.15.0-1 and librust-pyo3-dev 0.29.3-1 exist.
• Build/test deps that run tests are correctly marked ; at debhelper compat 14 dh skips dh_auto_test on nocheck so no extra guard is needed.
• debhelper-compat 14, hardening=+bindnow, autopkgtest-pkg-pybuild, Standards-Version 4.7.4 (current 4.7.4.1), salsa Vcs-* fields, gbp.conf, and upstream/metadata all correct.
• uscan found the packaged version as the newest upstream release (upstream 0.6.3, packaged 0.6.3).

Not confirmed

• Whether librust-pyo3-dev 0.28 exists in any other suite (e.g. oldstable) that could supply the pinned version; apt-cache for unstable/experimental shows only 0.29.3, and unstable is what the build daemon uses.

Proposed changes

None.