DFSG NEW review for rust-glifo version 0.4.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The source is licensed Apache-2.0 OR MIT and the licence texts in debian/copyright are correct (MIT quoted in full, Apache-2.0 pointed at /usr/share/common-licenses/Apache-2.0). debian/copyright is DEP-5, but its Files: * Copyright field omits the Parley Authors, who are named as co-copyright holders in four source files, so it is not fully accurate. Otherwise there are no DFSG problems: no non-free terms, no built/preferred-form-missing files, and no vendored third-party code.

Packaging

Conventional debcargo-generated packaging: debhelper 13 with dh-sequence-cargo and the cargo buildsystem, complete dependency lists whose names all resolve in the archive (or in NEW for rust-vello-common 0.3.0), autopkgtests for the default and each collapsed feature set, Multi-Arch: same, a current Standards-Version (4.7.4 against Policy 4.7.4.1) and a sane changelog. The only defect is patch hygiene: debian/patches/relax-deps.patch has no DEP-3 header and, despite its name, also rewrites test font inputs and disables two upstream tests without documenting that anywhere.

Issues

1. [blocker] [licensing] debian/copyright omits the Parley Authors as co-copyright holders

• Files: debian/copyright:7, src/colr.rs:1, src/glyph.rs:1, src/renderer.rs:1, src/util.rs:1
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright has Copyright: 2025-2026 the Vello Authors, but the source files begin // Copyright 2025 the Vello Authors and the Parley Authors (src/renderer.rs: // Copyright 2026 the Vello Authors and the Parley Authors). The generated debian/copyright.debcargo.hint lists these same per-file holders correctly.
• Problem: A named copyright holder is not represented in the package's copyright file, so debian/copyright does not accurately describe the copyright of every file as DEP-5 requires. The scan's holder check matched loosely and treated the Vello Authors entry as covering these files.
• Fix: Add the Parley Authors (with the matching years, e.g. 2025-2026) to the Copyright field of the Files: * stanza, or add per-file Files stanzas for src/colr.rs, src/glyph.rs, src/renderer.rs and src/util.rs.

2. [minor] [packaging] Debian patch lacks DEP-3 metadata and silently disables tests

• Files: debian/patches/relax-deps.patch:1, debian/patches/relax-deps.patch:24-46
• Basis: checked, in the package or with a reference tool
• Evidence: The patch begins directly with diff --git a/Cargo.toml b/Cargo.toml (no Description:, Origin: or Forwarded:), is named relax-deps.patch, and also replaces the test fonts with absolute paths (include_bytes!("/usr/share/fonts-roboto-fontface/fonts/roboto/Roboto-Regular.ttf")) and comments out two tests: //#[test] disabled due to replacing font file.
• Problem: Policy 4.3 expects changes not specific to Debian to be sent upstream, and a DEP-3 header is what lets a reviewer see whether that was done; nothing here records the forwarding status or the purpose of the test changes. The name describes only the hashbrown relaxation, while the patch also changes test inputs and removes two tests from the suite without mentioning it in the changelog, reducing coverage silently.
• Fix: Add a DEP-3 header (at least Description, Origin and Forwarded, or Forwarded: not-needed with a reason), rename or split the patch so its name matches its content, and explain the font substitution and the disabled COLR tests in the header (and changelog if you keep them disabled).

Verified

• Read all of debian/ (control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, patches/series and the patch, tests/control, upstream/metadata, source/format).
• All 19 upstream files read or grepped: every .rs file carries // SPDX-License-Identifier: Apache-2.0 OR MIT with a Vello/Parley copyright line; LICENSE-APACHE is the full Apache 2.0 text and LICENSE-MIT the Expat text with Copyright 2025 the Vello Authors; README/Cargo.toml/Cargo.toml.orig/CHANGELOG/Cargo.lock/.cargo_vcs_info.json are covered by the same licence.
• No binaries, minified files, generated code or vendored third-party code in the tree; nothing non-free (no NC/ND/field-of-use wording).
• The prescan's author check reported every holder as named, but its loose matching did not catch the omitted the Parley Authors holder; that is the issue reported above.
• debian/copyright is DEP-5 with the exact Format URL; the Apache-2.0 pointer names an existing file under /usr/share/common-licenses, and the MIT licence is reproduced in full.
• Standards-Version 4.7.4 is current enough against Policy 4.7.4.1; changelog distribution unstable, version 0.4.0-1.
• All dependency names in control resolve: librust-bytemuck 1.25.2, librust-log 0.4.34, librust-smallvec 1.16.2, librust-hashbrown 0.16.1, librust-skrifa 0.44.0, librust-peniko 0.6.1, librust-foldhash 0.2.0, librust-png 0.18.1 and librust-core-maths 0.1.1 are in the archive; librust-vello-common-0.3-dev is built by rust-vello-common 0.3.0-1 in NEW.
• The font paths used by the patched tests exist in the corresponding Debian font packages (/usr/share/fonts-roboto-fontface/fonts/roboto/Roboto-Regular.ttf and /usr/share/fonts/truetype/noto/NotoColorEmoji.ttf).
• debian/copyright.debcargo.hint is a debcargo overlay artifact that is not installed in the binary package.
• uscan found the packaged version as the newest upstream release (upstream 0.4.0, packaged 0.4.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Cargo.lock still pins hashbrown 0.17.1 while patched Cargo.toml requires 0.16; cargo is invoked without --locked by dh-cargo, so re-resolution is expected to fix it, but a build would be needed to show that the stale lock is harmless.
• Whether the feature-combination autopkgtests (including the flaky no-feature run and the two commented-out COLR tests) behave as recorded could not be tested without building and running them.

Proposed changes

None.