Review: rust-dds 0.2.0-1

New Package Report

.changes◂

Source	rust-dds
Version	0.2.0-1
Changed-By	Jeremy Bícha <jbicha@ubuntu.com>
Architecture	source amd64
Distribution	unstable
Date	Sun, 11 Oct 2026 20:49:58 +0200

Changelog◂

rust-dds (0.2.0-1) unstable; urgency=medium
 .
   * Package dds 0.2.0 from crates.io using debcargo 2.8.4

.dsc◂

Priority	optional
Component	main
Package-List	librust-dds-dev deb rust optional arch=any
Section	rust

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: dds
Upstream-Contact: The image-rs Developers
Source: https://github.com/image-rs/image-dds

Files: *
Copyright: 2025-2026 Michael Schmidt
 2025-2026 The image-rs Developers
License: MIT or Apache-2.0

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Jeremy Bícha <jbicha@ubuntu.com>
License: MIT or Apache-2.0

License: Apache-2.0
 Debian systems provide the Apache 2.0 license in
 /usr/share/common-licenses/Apache-2.0

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 24 days ago.

Report◂

DFSG NEW review for rust-dds version 0.2.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable

Licensing

The licensing itself is DFSG-compliant: everything in the tree is under MIT or Apache-2.0 (per Cargo.toml, LICENSE-MIT and LICENSE-APACHE), both licences are free and compatible, the MIT text is reproduced in full in debian/copyright and Apache-2.0 is referred to /usr/share/common-licenses/Apache-2.0; there are no non-free terms, no unlicensed files and no binary/opaque blobs. However debian/copyright does not describe the copyright of every file: one function in src/color/formats.rs is copied verbatim from the half-rs crate and is expressly attributed in the source to Kathryn Long under MIT OR Apache-2.0, but the file names only Michael Schmidt and The image-rs Developers for Files: *.

Packaging

The packaging is good quality and what a debcargo 2.8.4 run should produce. debian/control is coherent (debhelper-compat 13 with dh-sequence-cargo, Build-Depends-Arch marked <!nocheck>, Multi-Arch: same, sensible Breaks), all Build-Depends and Depends resolve against the archive, Standards-Version 4.7.4 is current, the changelog is sane (0.2.0-1, unstable, correct weekday), rules uses the dh-cargo buildsystem, source format is 3.0 (quilt), the single patch is the usual debcargo dependency/bench patch, and the autopkgtest entries are consistent with the declared dev-dependencies. I found nothing a sponsor would require changed.

Issues

blocker licensing 1. debian/copyright omits the copyright holder of code copied from the half-rs crate ◂

Files: src/color/formats.rs:588-591, debian/copyright

Evidence:

src/color/formats.rs, fp16::from_f32:

// Source: https://github.com/starkat99/half-rs/blob/2c4122db4e8f7d8ce030bb4b5ed8913bd6bbf2b1/src/binary16/arch.rs#L482
// Author: Kathryn Long
// License: MIT OR Apache-2.0

while debian/copyright has only:

Files: *
Copyright: 2025-2026 Michael Schmidt
 2025-2026 The image-rs Developers
License: MIT or Apache-2.0

Problem: The function is copied verbatim from half-rs, so part of the source is copyright Kathryn Long (and other half-rs holders), not Michael Schmidt or The image-rs Developers. The MIT text requires the copyright notice to be preserved, and Policy 12.5 (with the DEP-5 format) requires each Files stanza to record the copyright of the files it matches. The licence is identical and free, so there is no DFSG violation, but debian/copyright is inaccurate/incomplete for these files.
Fix: Record the holder: either add the half-rs/Kathryn Long copyright to the Files: * stanza, or (preferred, since it is a distinct work) add a stanza such as Files: src/color/formats.rs with Copyright: 2022-2025 Kathryn Long (and other half-rs contributors) and License: MIT or Apache-2.0, noting its origin in half-rs.

Verified ◂

Read every file under debian/ and every top-level file. The upstream tree is 46 Rust sources under src/ plus benches/{decode,encode}.rs, README.md, CHANGES.md, supported-formats.md, LICENSE-APACHE, LICENSE-MIT, Cargo.toml, Cargo.toml.orig, Cargo.lock and .cargo_vcs_info.json; there are no images, fonts, .so, .jar, minified files or other non-source blobs.
Grepping the tree for copyright/licence markers (Copyright, (C), ©, SPDX-License-Identifier, Licensed under, GNU …, Apache License, public domain, zlib, BSD, ISC, CC0, etc.) found only two third-party provenance comments: half-rs/Kathryn Long (src/color/formats.rs:589-591) and the oklab crate by Kornel (src/color/oklab.rs:121-127). The oklab comment says 'inspired by … in the oklab crate by Kornel' and describes a rewritten numeric approximation, i.e. it is not copied code and needs no separate copyright entry.
All Build-Depends/Depends resolve in the archive: librust-glam+default-dev (0.30.1-3, satisfies >= 0.25.0), librust-sha2-0.11+default-dev (0.11.0-1), librust-png-0.18+default-dev (0.18.1-3), librust-resize-0.8+rayon-dev and +std-dev (0.8.9-1), librust-astc-decode-0.3+default-dev (0.3.1-2), librust-zerocopy-0.8+default-dev (0.8.26-4+b1), librust-glob-0.3+default-dev (0.3.4-1); dh-cargo 34 provides dh-sequence-cargo.
debian/changelog: 0.2.0-1, unstable, urgency medium, date 'Sun, 11 Oct 2026' which is indeed a Sunday; version matches the unpacked 0.2.0. Standards-Version 4.7.4 is current (installed Policy is 4.7.4.1).
debian/rules is the dh-cargo buildsystem; debian/source/format is 3.0 (quilt); the only patch, relax-deps.patch, is the debcargo-generated one that relaxes the astc-decode/glam pins, bumps the png/sha2 dev-dependencies to the versions Debian ships, and disables the criterion/rand benchmarks and their dev-dependencies; it carries no DEP-3 header, which is the norm for debcargo-generated patches.
debian/tests/control is consistent with the declared dev-dependencies and lists only dependencies that exist; Testsuite/Testsuite-Triggers in the .dsc match it.
The .orig.tar.gz contains exactly the files present in the unpacked tree, so nothing is hidden from the copyright inventory.
uscan found the packaged version as the newest upstream release (upstream 0.2.0, packaged 0.2.0).

Not confirmed ◂

The effect of debian/cargo-checksum.json holding the placeholder {"package":"Could not get crate checksum","files":{}}: the dh-cargo buildsystem copies it to .cargo-checksum.json at configure time, but I could not verify whether the empty per-file map has any effect for the crate being built rather than for a dependency.
The patch relaxes glam from 0.25.0 to >= 0.25.0 while Debian ships glam 0.30.1; whether the code still compiles against glam 0.30 is not something I can determine without building.
Why the model asked for what a review has no use for. During this review it asked 2 times for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: grep: " rust-dds-0.2.0/benches" is not a file of the package or of the reviewing system; grep: " /usr/share/cargo" is not a file of the package or of the reviewing system.

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Superseded by review of later version

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.2.0-2	3c6c96dd…	2026-10-16 02:49	2026-10-16 02:50	awm	accepted	VIEW

Back to Dashboard | View all reviews for this package