DFSG NEW review for rust-assertables version 10.1.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable

Licensing

Upstream is multi-licensed: LICENSE.md ("License is any of these") and Cargo.toml (license = "MIT OR Apache-2.0 OR BSD-3-Clause OR GPL-2.0-only OR GPL-3.0-only") offer MIT, Apache-2.0, BSD-3-Clause, GPL-2.0-only and GPL-3.0-only; the permissive option (MIT) makes the crate DFSG-free and the combination is compatible. debian/copyright is DEP-5 with the correct Format URL, a Files: * stanza plus a debian/* override, every file in the tree is matched, all five short names used are defined, MIT and BSD-3-Clause carry full text and Apache-2.0/GPL-2.0-only/GPL-3.0-only refer to /usr/share/common-licenses. No per-file notices, no other LICENSE/COPYING/NOTICE files, no non-free terms, no embedded third-party code, no blobs or generated code needing absent sources. Only nit: the upstream copyright year is a single unverified year.

Packaging

Conventional debcargo packaging, clean and up to date: debhelper compat 13 with dh-sequence-cargo, Build-Depends/Build-Depends-Arch split correctly and versioned, a single Architecture: any + Multi-Arch: same source-only dev package with the usual versioned Provides, Standards-Version 4.7.4 (equals the current Policy 4.7.4.1), Vcs-* and Homepage set, sane changelog (unstable, 10.1.0-1). debian/rules creates the bin/printf-* and bin/exit-with-arg helper scripts the assert_command tests spawn and removes them on clean; the one quilt patch is DEP-3-headered and adds exactly the two fixtures the assert_fs_read_to_string tests read (CARGO_MANIFEST_DIR/tests/src/std/fs/{alfa,bravo}.txt), which the crates.io tarball omits. Autopkgtest is present and includes the crate's dev-dependency. No policy violation, upgrade or user-visible problem found.

Issues

1. [minor] [licensing] Upstream copyright year is a single unverified year while the crate dates from 2021

• Files: debian/copyright:7, debian/copyright.debcargo.hint:7
• Evidence: debian/copyright: Copyright: 2026 Joel Parker Henderson <joel@joelparkerhenderson.com>; the generated hint asked for review: Copyright: FIXME (overlay) UNKNOWN-YEARS Joel Parker Henderson ... with Since upstream copyright years are not available in Cargo.toml, they were extracted from the upstream Git repository... you should review and fix this before uploading; upstream's own files say Created: 2021-03-30T15:47:49Z and Updated: 2026-06-01T07:30:16Z (README.md:274-275, llms.txt:272-273).
• Problem: The debcargo placeholder was replaced with the release year only, but the crate has existed since 2021, so the year recorded for the copyright holder is incomplete and was never verified. The holder and licence are correct and this is not a DFSG problem; it is only that guessed years are stated as fact.
• Fix: Record the years that actually cover upstream contributions, e.g. Copyright: 2021-2026 Joel Parker Henderson <joel@joelparkerhenderson.com>, after checking the upstream git history.

Verified

• Read all of debian/ (control, rules, changelog, copyright, copyright.debcargo.hint, rules.debcargo.hint, debcargo.toml, cargo-checksum.json, source/format, patches/{series,add-missing-test-files.patch}, tests/control) plus the .dsc and both tarballs beside the tree.
• Inventoried the whole upstream tree with glob (hidden and gitignore off): only .rs, .md, .txt, .json, .toml, .lock files — no images, fonts, .so/.jar/.class/.pyc, firmware, PDFs, minified assets or vendored code.
• Grepped the tree for Copyright/(C)/©/All rights reserved, SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU General Public/GNU Lesser/Apache License/Mozilla Public/public domain, and for non-free terms (non-commercial, no derivative, Creative Commons, proprietary, field of use, "not evil"): the only hits are LICENSE.md and the debian/ files; there are no per-file licence or copyright notices anywhere.
• Read LICENSE.md in full; it is the only upstream licence statement and lists MIT, Apache-2.0, GPL-2.0-only, GPL-3.0-only and BSD-3-Clause, matching license in Cargo.toml/Cargo.toml.orig and the License: fields in debian/copyright. No other LICENSE/COPYING/NOTICE/AUTHORS file exists in the tree.
• Sampled and read the help/ documentation tree (comparisons/*, developing, faq, releasing, upgrades): original prose by the upstream author about other crates, no copied third-party text or licence.
• Checked that debian/copyright's two stanzas cover every path (Files: * catch-all, Files: debian/* override, later stanza wins) and that all five short names used have a stand-alone License paragraph; MIT and BSD-3-Clause are given in full, Apache-2.0/GPL-2.0-only/GPL-3.0-only point at /usr/share/common-licenses (Policy 12.5). No Files-Excluded field is claimed.
• Confirmed the patch's fixtures are at the path the tests use: the tests build the directory from env!("CARGO_MANIFEST_DIR") + tests/src/std/fs (e.g. src/assert_fs_read_to_string/assert_fs_read_to_string_contains.rs:104-108) and the patch adds exactly tests/src/std/fs/{alfa.txt,bravo.txt}; both files are absent from the .orig tarball, so the patch is necessary and correct.
• Confirmed with apt-cache that every dependency exists: dh-cargo 34 provides dh-sequence-cargo; librust-regex-1+default-dev (>= 1.12) is provided by librust-regex-dev 1.13.1-1; librust-walkdir-2+default-dev (>= 2.5) by librust-walkdir-dev 2.5.0-2.
• Checked debian/tests/control's syntax against the autopkgtest document (the trailing @ is the binary-package substitution, not a line continuation) and that it follows the debcargo template with librust-regex-1+default-dev present as the crate's dev-dependency.
• Verified Standards-Version 4.7.4 against the installed Policy (4.7.4.1); changelog, control, Vcs-* and Homepage are mutually consistent, and the version 10.1.0-1 matches the crate version.
• Confirmed the crate's unit tests live inside src/*.rs with autotests = false, so the upstream tarball's omission of tests/ costs no coverage beyond the two fixtures the patch restores.
• uscan found the packaged version as the newest upstream release (upstream 10.1.0, packaged 10.1.0).

Not confirmed

• debian/cargo-checksum.json holds a placeholder, {"package":"Could not get crate checksum","files":{}}, so no per-file or package checksums are recorded. Could not confirm from the package alone whether dh-cargo accepts this or whether the tarball is byte-identical to the crates.io release; a build would show it.
• The .orig tarball contains help/ although Cargo.toml's include list ("src/**/*", LICENSE.md, README.md, llms.txt, llms.json) omits it, while it does exclude tests/ — could not determine how the tarball was produced. No licensing or packaging effect found.
• debian/tests/control's Depends omit librust-walkdir-2+default-dev although Cargo.toml declares [build-dependencies.walkdir] (and Cargo.lock lists walkdir among assertables 10.1.0's dependencies). Could not run cargo-auto-test to see whether cargo needs that source for dependency resolution; if it does, the autopkgtest would fail on a missing walkdir.
• Read llms.json and llms.txt only by grep (2.3 MB and 1.5 MB rustdoc dumps of the crate's own documentation, stale at version 9.8.0); they are text, patchable, and carry no separate licence.
• Could not build the package or run its tests or autopkgtest.

Proposed changes

None.