DFSG NEW review for rust-debian-rust-rdeps version 0.1.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5, with Files: * (Fabian Grünbichler) and Files: debian/* (Debian Rust Maintainers, kpcyrd), both MIT or Apache-2.0. The MIT text is reproduced verbatim and matches LICENSE-MIT; Apache-2.0 points at /usr/share/common-licenses/Apache-2.0, which is allowed. Every upstream file is covered: the tree is 12 files (3 in src/, Cargo.toml, Cargo.toml.orig, Cargo.lock, README.md, the two licence files, .gitignore, .cargo_vcs_info.json), and none carries a copyright notice, an SPDX tag or a different licence, nor is there vendored third-party code. MIT and Apache-2.0 are DFSG-free and compatible, and no file has a non-free or unclear term.

Packaging

Standard debcargo output: X-Cargo-Crate fields, Build-Depends-Arch on the crate-dev packages (each one verified to exist in the archive), compat 13 with dh $@ --buildsystem cargo, and a help2man man page installed through debian-rust-rdeps.manpages. Standards-Version: 4.7.4 matches the current Policy 4.7.4.1; Vcs-*, Homepage, the changelog (0.1.0-1, unstable) and upstream/metadata are all in order, and no patches, maintainer scripts or .install files are needed. Only nits remain: the Description repeats upstream's "figureout" typo, and the crate has no tests at all, so neither the build nor an autopkgtest would run any.

Issues

None.

Verified

• debian/copyright read in full: Format, Upstream-Name/Upstream-Contact/Source, Files: *, Files: debian/*, and stand-alone Apache-2.0 and MIT paragraphs.
• Upstream inventory (excluding debian/ and .pc/) is 12 files; the 3.0 (quilt) orig tarball holds exactly debian-rust-rdeps-0.1.0/ with .cargo_vcs_info.json, .gitignore, Cargo.lock, Cargo.toml, Cargo.toml.orig, LICENSE-APACHE, LICENSE-MIT, README.md and src/ — nothing outside the unpacked tree and no debian/ inside the orig tarball.
• grep over src/ (all three files read in full), README.md, Cargo.toml, Cargo.toml.orig, Cargo.lock, .gitignore, .cargo_vcs_info.json for Copyright, SPDX-License-Identifier, Licensed under, GNU General, Apache License, permission is hereby granted, All rights reserved: no matches — the source files carry no notices, and the only licence statement is license = "MIT or Apache-2.0" in Cargo.toml.orig:6.
• debian/copyright's MIT paragraph is word-for-word the text of LICENSE-MIT (including NONINFRINGEMENT. IN NO EVENT); LICENSE-APACHE is the unmodified Apache-2.0 text with the [yyyy] [name of copyright owner] appendix placeholder.
• No third-party code embedded: src/main.rs, src/helpers.rs, src/package_indices/{mod.rs,packages.rs} are the project's own; all dependencies come from Debian's librust-*-dev packages.
• Prescan: its only section is the author check, which reported every holder it extracted as named in debian/copyright (it extracted none from the source, which carry no notices; the file names Fabian Grünbichler, Debian Rust Maintainers and kpcyrd). It listed no built, minified, archived or PDF files to account for, and the tree has none.
• debian/copyright.debcargo.hint is debcargo's generated draft (its Files: * still says FIXME (overlay) UNKNOWN-YEARS, with a Comment explaining the years came from git); the shipped debian/copyright is the maintainer's corrected version, so the hint is not a licence statement about the tree.
• debian/rules.debcargo.hint is likewise the generated draft; the shipped debian/rules drops its override_dh_auto_test — harmless, because the crate has no test code (autotests = false in Cargo.toml, no #[test]/#[cfg(test)] anywhere in src/), and dh-cargo's test step still compiles the crate (sub test in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm runs cargo build).
• Build-Depends-Arch resolved with apt-cache: librust-deb822-fast-0.2+default-dev (0.2.3), librust-debversion-0.5+default-dev (0.5.5), librust-debian-control-0.3-dev (0.3.19), librust-clap-4+cargo-dev (4.6.7), librust-xdg-2+default-dev (2.5.2), librust-tracing-subscriber-0.3+env-filter-dev (0.3.23). librust-debian-control-0.3-dev without +default-dev matches default-features = false in Cargo.toml.orig.
• Standards-Version: 4.7.4 against Policy 4.7.4.1 (policy tool): same first two components, current.
• Man page hook: execute_before_dh_installman runs after dh_install, so debian/debian-rust-rdeps/usr/bin/debian-rust-rdeps exists when help2man reads it, and debian-rust-rdeps.manpages lists the generated debian/debian-rust-rdeps.1. The empty override_dh_dwz is deliberate (rust-lang/rust#66118).
• No debian/patches, no maintainer scripts, no debian/*.install/links/dirs; debian/changelog is an initial 0.1.0-1 upload to unstable, dated Sat, 31 Oct 2026.
• The tool runs apt update (with a private APT root) and dpkg --print-architecture; apt is Priority: required (apt-cache) and dpkg is Essential, so no runtime dependency is missing.
• uscan found the packaged version as the newest upstream release (upstream 0.1.0, packaged 0.1.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Whether the years in Files: * (2025-2026) reproduce upstream's git history exactly: no source file carries a copyright line, and the only holder information in the tarball is authors = ["Fabian Grünbichler <fabiang@debian.org>"] in Cargo.toml/Cargo.toml.orig.
• The package was not built or run (read-only review), so the generated man page's contents and the tool's behaviour (including its todo!() in src/main.rs for a crate with matching binary packages but no matching source package) were not exercised.

Proposed changes

None.