DFSG NEW review for rust-apache-avro-test-helper version 0.22.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The crate is Apache-2.0 throughout and debian/copyright is DEP-5 and accurate. Every upstream file is covered by Files: * with The Apache Software Foundation (2010-2025, exactly as in NOTICE) as holder, src/lib.rs has its own stanza recording the additional Sylvain Wallez attribution that the file itself acknowledges ("Borrowed from <bluxte.net/...>"), and debian/* is under Apache-2.0 by the Debian maintainers. LICENSE (the untouched Apache-2.0 text) and NOTICE are copied into /usr/share/cargo/registry with the crate, so Apache-2.0 §4(a) and §4(d) are satisfied. Nothing non-free, unlicensed, built-only or of unclear provenance was found.

Packaging

Textbook debcargo packaging: debhelper compat 13 with dh-sequence-cargo, Build-Depends/-Arch that all resolve in the archive (ctor 1.0.13, dtor 1.0.6, better-panic 0.3.0, env-logger 0.11.10, log 0.4.34, rustc 1.9x, dh-cargo 34), one DEP-3 patch replacing the unpackaged linktime crate with its ctor/dtor components and documented in README.source, three autopkgtests in the usual rust-team form, Standards-Version 4.7.4 against Policy 4.7.4.1, correct Vcs-*, Homepage, X-Cargo-Crate(-Version) and changelog for a first upload. No packaging fault worth reporting was found.

Issues

None.

Verified

• The whole tree was inventoried: Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, LICENSE, NOTICE, README.md, src/lib.rs, src/data.rs, src/logger.rs, plus debian/ (the .pc/ directory and debian/cargo-checksum.json were skipped as instructed). The prescan's author check found every holder it detected named in debian/copyright and listed no other files to account for.
• Licence evidence: src/lib.rs, src/data.rs, src/logger.rs, README.md and Cargo.toml.orig carry the standard ASF header ("Licensed to the Apache Software Foundation (ASF) under ... the Apache License, Version 2.0"); LICENSE is the verbatim Apache-2.0 text including the appendix; NOTICE says Copyright 2010-2025 The Apache Software Foundation and credits Flavien Raynaud's 2020 donation, which Files: * and its Comment record.
• No other licence text exists anywhere in the tree (searched Copyright/(C)/SPDX-License-Identifier/Licensed under/GNU/LGPL/MPL/BSD/MIT/public domain/All rights reserved): no vendored third-party code, no COPYING in subdirectories, no embedded library for which Debian already has a package.
• src/data.rs is only Avro schema examples as Rust string literals with the ASF header; no generated code without its generator, no PDFs, images, fonts, bytecode, archives or minified files anywhere in the tree.
• Apache-2.0 obligations are met by the installed crate: dh-cargo's get_sources (Buildsystem/cargo.pm) copies every top-level file except debian/, .pc/, target/ and .git into /usr/share/cargo/registry/apache-avro-test-helper-0.22.0/, so LICENSE and NOTICE ship with the source the -dev package distributes.
• The additional 2023 Sylvain Wallez line in the src/lib.rs stanza is documented in that stanza's Comment as credit for the pattern the file itself cites, with Apache-2.0 declared for the file; it neither hides a holder of the file's notices nor claims a separate licence grant, so it is not an inaccuracy.
• Dependency names all resolve (apt-cache): librust-ctor-1+std-dev, librust-ctor-1+proc-macro-dev, librust-dtor-1+std-dev, librust-dtor-1+proc-macro-dev are provided by librust-ctor-dev 1.0.13-1 and librust-dtor-dev 1.0.6-1; librust-better-panic-0.3-dev 0.3.0, librust-env-logger-0.11-dev 0.11.10 and librust-log-0.4-dev 0.4.34 satisfy env-logger (>= 0.11.10) and log (>= 0.4.32); rustc is 1.97.1/1.98.1 (MSRV 1.88.0, edition 2024), dh-cargo is 34 (autopkgtest asks for >= 33~). librust-linktime-dev does not exist in the archive or in NEW, which is what the patch works around.
• debian/Cargo.lock still lists linktime 0.18.0, i.e. it is stale after the patch, but dh-cargo's configure runs rm_files("Cargo.lock") before any cargo invocation (/usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm), so the stale lock cannot affect the build.
• debian/tests/control: Depends: ..., @ is autopkgtest's own syntax for all binaries of the source (autopkgtest spec, Depends field), which installs librust-apache-avro-test-helper-dev and hence the crate dependencies that /usr/share/cargo/bin/cargo-auto-test needs; dev-dependencies are not required because the crate declares none.
• debian/patches/use-ctor-dtor.patch has DEP-3 headers (Description, Author, Forwarded: not-needed, Last-Update), is mirrored in Cargo.toml.orig for consistency, and is explained in debian/README.source, including the ctor 1.0.13 / dtor 1.0.6 versions and the doctests used to check it.
• debian/copyright.debcargo.hint is debcargo's seed file and still contains FIXME/UNKNOWN-LICENSE placeholders, but no build step reads it; the shipped debian/copyright is the complete and correct one, and copyright-format 1.0's Format line is exact.
• debian/changelog is a valid first upload to unstable (0.22.0-1, urgency medium, ITP closed), matching X-Cargo-Crate-Version 0.22.0 and the version cargo-auto-test names; the .dsc is signed and lists exactly the one -dev binary.
• uscan found the packaged version as the newest upstream release (upstream 0.22.0, packaged 0.22.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Only the third tests/control entry (the --no-default-features run, which is equivalent to the default one because debcargo collapsed the crate's features) carries Architecture: !riscv64; nothing in debian/debcargo.toml or the crate explains it, but it neither breaks a build nor a test and the other two tests are unrestricted, so I did not treat it as an issue.
• I could not inspect Debian's ctor/dtor sources on the reviewing system (the crates are not installed there), so #[ctor(unsafe)]/#[dtor(unsafe)] being accepted by ctor 1.0.13 and dtor 1.0.6 is taken from debian/README.source, which states the tests were run against those versions; no build was attempted.

Proposed changes

None.