DFSG NEW review for rust-apache-avro version 0.22.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 2 found

Licensing

debian/copyright is in DEP-5 format and is accurate for the whole tree. Files: * names The Apache Software Foundation and Apache-2.0, which matches LICENSE (the full Apache-2.0 text) and NOTICE (ASF, plus the original Apache Avro Rust author, who is also credited in the copyright comment); a later stanza covers exactly the four files the Debian patches modify and adds Steffen Moeller's copyright for them, and debian/* has its own stanza. Every Rust source, README.md and Cargo.toml.orig carry the ASF licence header, the licence is in /usr/share/common-licenses, no other licence or holder appears anywhere in the tree, and there are no non-free terms. No file lacks a licence or a preferred form for modification.

Packaging

Clean debcargo-generated package: debhelper compat 13 with dh-sequence-cargo and a one-line rules, 3.0 (quilt) with three patches that carry DEP-3 headers, match README.source and are limited to test/documentation and benchmark-target changes. The Build-Depends/Build-Depends-Arch split with <!nocheck> matches what dh-cargo actually compiles, every crate in Depends and Build-Depends-Arch is provided by the archive, Provides covers exactly the crate's five features plus default, autopkgtests cover default, each codec, derive and no-feature builds, and Standards-Version 4.7.4 is current against Policy 4.7.4.1.

Issues

None.

Verified

• Prescan binary file tests/bigdec.avro: Avro object-container test data (189 bytes), opened by the unit test in src/bigdecimal.rs:274 (File::open("./tests/bigdec.avro")). Data, not a built file: no generator source is needed to modify it, and it is covered by the Files: * Apache-2.0 stanza.
• Prescan binary file benches/quickstop-null.avro: Avro object-container data (162 KB); benches/serde.rs:442-444 records that it was pulled from https://github.com/linkedin/goavro/blob/master/fixtures/quickstop-null.avro. The benchmarks are not built at all (omit-benchmarks.patch removes both [[bench]] targets and the criterion dev-dependency, autobenches = false is set), and the file is data, so it raises no DFSG or preferred-form question; it is covered by Files: *.
• Licence sweep of the non-debian tree: the ASF header ("Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements ... See the NOTICE file") is at the top of every Rust source, README.md and Cargo.toml.orig (86 files matched); LICENSE is the unabridged Apache-2.0 text and NOTICE names the ASF and the original author, which debian/copyright:9-12 repeats. No MIT/BSD/GPL/MPL/CC or non-commercial wording occurs anywhere in src/, tests/, benches/, examples/, README.md or Cargo.lock.
• debian/copyright's second stanza (tests/avro-rs-226.rs src/serde/derive.rs src/serde/mod.rs src/serde/with.rs) matches exactly the non-manifest files the three patches touch: the patch hunks cover Cargo.toml, Cargo.toml.orig, tests/avro-rs-226.rs and those three src/serde/*.rs files and nothing else, and the manifest changes are deletions plus one required-features line.
• debian/copyright.debcargo.hint is debcargo's unedited template (FIXME (overlay) UNKNOWN-AUTHORS, UNKNOWN-LICENSE; FIXME (overlay)); it is the generator's input, is not installed into the binary package, and debian/copyright itself is complete and correct DEP-5.
• Dependencies resolved against the archive with apt-cache: bigdecimal 0.4, bon 3.10.2, bzip2 0.6.1, digest 0.11.3, liblzma 0.4.9, md-5 0.11.0, miniz-oxide 0.9.1, ouroboros 0.18.5, rand 0.10.3, regex-lite 0.1.9, rstest 0.26.1, serde 1.0.229, serde-bytes 0.11.19, sha2 0.11.1, strum 0.28.0, zstd 0.13.3 — all present and satisfying the versions in debian/control.
• Build model checked against /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm: sub test runs plain cargo build with no feature flags, so Build-Depends-Arch correctly omits the optional crates (bzip2, crc32fast, liblzma, snap, zstd, apache-avro-derive) that Depends lists because a dependent enabling those features needs them; <!nocheck> on those build dependencies matches dh skipping the compile check under nocheck at compat 13.
• Patch soundness: the only in-tree uses of a bare #[derive(AvroSchema)] are the doctests in src/serde/derive.rs, src/serde/mod.rs and src/serde/with.rs (ten in with.rs); all of them now pair use apache_avro::serde::AvroSchema; (the trait, exported unconditionally at src/serde/mod.rs:121) with use apache_avro_derive::AvroSchema; (the macro, a dev-dependency), and examples/specific_single_object.rs is the only target needing the feature, which the patch marks required-features = ["derive"].
• Prescan author check reported no holder missing from debian/copyright; the three holders it declares (ASF, Debian Rust Maintainers, Steffen Moeller) are the ones the tree and the packaging actually show.
• debian/tests/control has eight runs: --all-features and the default build unrestricted, and the six extra single-feature and --no-default-features runs marked Architecture: !riscv64 (read as deliberate run reduction: the all-features run already covers those features on every architecture).
• Standards-Version: 4.7.4 against Policy 4.7.4.1 (tool: first two components match); changelog is unstable, 0.22.0-1, initial release closing #1152659, with a correct date/trailer; Vcs-Git/Vcs-Browser point at debcargo-conf src/apache-avro; Section: rust, Architecture: any, Multi-Arch: same are as the Rust team does it.
• uscan found the packaged version as the newest upstream release (upstream 0.22.0, packaged 0.22.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• librust-apache-avro-derive-0.22-dev (a hard Depends of the -dev package) and librust-apache-avro-test-helper-0.22-dev (in every autopkgtest Depends) exist neither in the package lists nor in the NEW queue snapshot of 2026-11-01T01:12Z; they should come from the companion source packages rust-apache-avro-derive and rust-apache-avro-test-helper. If those are not uploaded alongside, the package is uninstallable and its autopkgtests cannot start. The NEW snapshot predates this changelog (01:28), so this is a question for the uploader rather than a finding.
• The licence of linkedin/goavro, from whose fixtures benches/quickstop-null.avro was taken, could not be checked (no network); the file is serialized data, not code.

Proposed changes

None.