Review: rust-actix 0.13.5+ds-1

Package Information

Description	Actor framework for Rust - Rust source code Source code for Debianized Rust crate "actix"
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	Jeremy Bícha <jbicha@ubuntu.com>
Sponsor	jbicha@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/actix] (browse)
Tracker	https://tracker.debian.org/pkg/rust-actix
Uploaded	15 days ago

New Package Report

.changes◂

Distribution	unstable
Date	Fri, 23 Oct 2026 14:35:57 +0200
Source	rust-actix
Version	0.13.5+ds-1
Changed-By	Jeremy Bícha <jbicha@ubuntu.com>
Architecture	source amd64

Changelog◂

rust-actix (0.13.5+ds-1) unstable; urgency=medium
 .
   * Package actix 0.13.5 from crates.io using debcargo 2.8.4

.dsc◂

Section	rust
Priority	optional
Component	main
Package-List	librust-actix-dev deb rust optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: actix
Upstream-Contact: Nikolay Kim <fafhrd91@gmail.com>
Source: https://github.com/actix/actix
Files-Excluded:
 examples/mock.rs
 examples/ring.rs
 examples/weak_addr.rs
 examples/weak_recipient.rs
Comment: These examples don't build

Files: *
Copyright: 2017-2026 Nikolay Kim <fafhrd91@gmail.com>
 2017-2026 Actix Team
License: MIT or Apache-2.0

Files: src/address/queue.rs
Copyright: 2010-2011 Dmitry Vyukov. All rights reserved.
License: BSD-2-clause

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Jeremy Bícha <jbicha@ubuntu.com>
License: MIT or Apache-2.0

License: Apache-2.0
 Debian systems provide the Apache 2.0 license in
 /usr/share/common-licenses/Apache-2.0

License: BSD-2-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
    * Redistributions of source code must retain the above copyright
      notice, this list of conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above
      copyright notice, this list of conditions and the following disclaimer
      in the documentation and/or other materials provided with the
      distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 15 days ago.

Report◂

DFSG NEW review for rust-actix version 0.13.5+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The crate is dual-licensed MIT OR Apache-2.0 (Cargo.toml license, top-level LICENSE-MIT/LICENSE-APACHE), and debian/copyright is machine-readable DEP-5 with a Files: * MIT-or-Apache-2.0 catch-all, a BSD-2-clause stanza for src/address/queue.rs (Dmitry Vyukov's lock-free queue, header matches the BSD-2-clause text given), and a debian/* stanza. The prescan found every copyright holder it detected is named in debian/copyright. Full licence texts are present (Apache-2.0 and BSD-2-clause), MIT is reproduced in full. Files-Excluded (mock.rs, ring.rs, weak_addr.rs, weak_recipient.rs) match the debcargo.toml excludes and are not referenced by the remaining Cargo.toml example table. No non-free terms, no built/minified blobs, no embedded third-party code beyond the attributed Vyukov queue.

Packaging

On the whole packaging is competent (compat 13, current Standards-Version 4.7.4, format 3.0 quilt, single patch, comprehensive autopkgtests, standard debcargo layout), but the dev-dependency doc-comment is missing from Build-Depends-Arch although src/lib.rs uses doc_comment::doctest!("../README.md") under #[cfg(doctest)]. Since the default build runs the doctest pass (which requires the dev-dependency), the archive build will fail to compile the doctests, so the package needs a fix before upload.

Issues

important packaging 1. dev-dependency doc-comment missing from Build-Depends-Arch ◂

Files: debian/control Build-Depends-Arch, src/lib.rs:30, Cargo.toml.orig dev-dependencies
Basis: checked, in the package or with a reference tool
Evidence: src/lib.rs:30 #[cfg(doctest)] doc_comment::doctest!("../README.md");; Cargo.toml.orig [dev-dependencies] doc-comment = "0.3"; debian/control Build-Depends-Arch lists all other deps but not librust-doc-comment, while debian/tests/control lists librust-doc-comment-0.3+default-dev in every Depends.
Problem: doc-comment is a real dev-dependency referenced in the crate source and is needed to build and run the doctests that cargo test runs during the default (non-nocheck) build. It is present for autopkgtests but absent from Build-Depends, so the archive build's test phase will fail (cannot resolve crate doc_comment), breaking the build on the buildds.
Fix: Add librust-doc-comment-0.3+default-dev <!nocheck> to Build-Depends-Arch.

Verified ◂

debian/copyright is machine-readable DEP-5 with a valid Format line; Files: * MIT-or-Apache-2.0 catch-all, queue.rs BSD-2-clause stanza matching Vyukov header, debian/* stanza, and complete standalone License texts for MIT/BSD-2-clause plus common-licenses pointer for Apache-2.0.
The prescan's holder check reported every found holder is named in debian/copyright.
Files-Excluded names (examples/mock.rs, ring.rs, weak_addr.rs, weak_recipient.rs) are absent from the tree and are not referenced in Cargo.toml's example table; disable-examples.patch disables the weak_* examples in Cargo.toml.
Cargo.toml declares license = "MIT OR Apache-2.0" matching debian/copyright; no non-free terms present.
Standards-Version 4.7.4 matches current Policy 4.7.4.1; debhelper-compat 13; format 3.0 (quilt); single local patch with From/Date/Subject headers.
debian/copyright has no Format-line defect (exact 1.0 URL) and valid /usr/share/common-licenses pointer.
Licensing reviewed via Cargo.toml, LICENSE-APACHE, LICENSE-MIT, queue.rs header and licence-headers grep across src/examples/tests; no built, minified or binary files found in the tree.
uscan found the packaged version as the newest upstream release (upstream 0.13.5, packaged 0.13.5+ds).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Whether dismembering the example table to [[disabled.example]] triggers a cargo warning is unverified; it cannot fail the build.
Package build failure from the missing doc-comment dep is inferred from the doctest phase needing the dev-dependency rather than observed (package cannot be built here).

Proposed changes ◂

None.

Uploader's response to the LLM review

The bot declares that the build will fail, but this package builds fine with sbuild targeting unstable.

— Jeremy Bícha (jbicha), 15 days ago

Please teach the tooling here to not flag this class of issues for debcargo generated packages, debcargo does the right thing w.r.t. dev dependencies.

I've already given this feedback for a similar automated review before those got integrated into the DFSG dashboard:

https://alioth-lists.debian.net/pipermail/pkg-rust-maintainers/2026-October/087452.html

A tool that frequently shouts "wolf" will get ignored fast...

— Fabian Grünbichler (fg), 15 days ago

Review Information

accepted — allocated to awm 14 days ago, started 14 days ago, completed 14 days ago.

Final Comment

Hi,

I've added a couple of observations to the "Common False Positives" section of the review prompt:

A Rust crate's dev-dependencies missing from Build-Depends, with dh $@ --buildsystem cargo. dh-cargo's test step runs cargo build, not cargo test, unless rules passes test to it (dh_a uto_test -- test), so at build time it only checks that the crate compiles, and needs no dev-depende ncy. The Rust team's packages (generated by debcargo: debian/debcargo.toml, an X-Cargo-Crate fiel d) run the test suite in autopkgtest instead, with the dev-dependencies in debian/tests/control; as build dependencies they would make cycles. Do not predict a build failure from this. You can read th e test step yourself: sub test in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm.
A patch that changes a crate dependency's version requirement to the version Debian has, even d own across a semver-incompatible version (hashbrown 0.17 to 0.14). Upstream crates often move to a new incompatible version without using anything new, and relaxing these requirements is most of what the Rust team's patches do, so that the archive does not need a package for every version of a crate. The archive's build compiles the crate against the version patched in, which is the check. Report on e only if the package itself shows it cannot work (it uses an item that the version patched in lacks) , not on the change of version alone.

Hopefully that'll reduce the likelihood going forward...

Thanks!

Back to Dashboard | View all reviews for this package