DFSG NEW review for rust-clubcard-crlite version 0.6.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

MPL-2.0 throughout. Every source file (src/{lib,builder,codec,query}.rs, examples/{inspect,query}.rs) carries the MPL v2.0 header or is covered by the package-level MPL-2.0 declaration in Cargo.toml and the shipped LICENSE (full MPL 2.0 text). LICENSE is the sole licence text in the tree; deny.toml restricts dependencies to OSI-approved permissive licences (MPL-2.0). debian/copyright is DEP-5 machine-readable with Format 1.0, a Files: * stanza (Mozilla Foundation, MPL-2.0) and a Files: debian/* stanza; the License paragraph correctly points MPL-2.0 to /usr/share/common-licenses/MPL-2.0. The prescan author check found every holder named in debian/copyright; no missing holders. The tree contains no built, minified, or vendor-copied files: no .jar/.pyc/.so, no fonts/images/PDFs, no third-party source (dependencies are external Rust crates supplied as Debian librust-*-dev packages). MPL-2.0 is DFSG-free, so the licensing is compliant and the file accurately describes it.

Packaging

Clean, standard debcargo-generated packaging. debian/rules is a one-line dh $@ --buildsystem cargo; compat 13 via debhelper-compat; source format 3.0 (quint); single librust-clubcard-crlite-dev binary (Architecture any, Multi-Arch same) with correct Depends/Provides/Breaks and collapsed features. Build-Depends-Arch correctly marks the Rust toolchain and dev crates <!nocheck>. The relax-deps.patch (the only patch, in series, applies cleanly with a DEP-3-ish diff) relaxes base64 0.23->0.22 and x509-parser 0.16->0.18 to Debian's shipped versions and is necessary for a Debian build; it is unambiguous. debian/tests/control provides a full set of cargo-auto-test autopkgtests across feature combinations, excluding riscv64 where noted. Standards-Version 4.7.4 matches current Policy 4.7.4.1; Vcs-* fields point at the rust-team salsa repo; changelog is sane (0.6.2-1, unstable, correct Maintainer/Uploaders). No maintainer scripts, so nothing to check for idempotence. No issues of any severity.

Issues

None.

Verified

• Read debian/copyright (DEP-5, Format 1.0), control, rules, changelog, source/format, patches/series + relax-deps.patch, tests/control, upstream/metadata, debcargo.toml, copyright.debcargo.hint in full.
• Read LICENSE (full MPL-2.0 text) and Cargo.toml.orig (license = "MPL-2.0", author John M. Schanck).
• Grep across tree for Copyright/(C)/©/SPDX/GNU/MPL/etc: only MPL v2.0 terms; every src and examples file carries the MPL v2.0 header (codec.rs has no header but falls under the package-wide MPL-2.0 license in Cargo.toml + LICENSE).
• Prescan author-check: all 13 scanned files' holders are named in debian/copyright; no missing holders. The only prescan-named item was this author comparison, which passed; no built/non-free files were flagged.
• Tree contains no binary, minified, or vendored files; grep/glob with gitignore:false over the full tree confirms.
• Standards-Version 4.7.4 vs current Policy 4.7.4.1 (checked via policy tool): first two components match, not an issue.
• uscan found the packaged version as the newest upstream release (upstream 0.6.2, packaged 0.6.2).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (MPL-2.0).

Not confirmed

None.

Proposed changes

None.