Review: rust-gstreamer-check 0.25.0-1

Package Information

Description	Rust bindings for GStreamer Check library - Rust source code Source code for Debianized Rust crate "gstreamer-check"
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	Jeremy Bícha <jbicha@ubuntu.com>
Sponsor	jbicha@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/gstreamer-check] (browse)
Tracker	https://tracker.debian.org/pkg/rust-gstreamer-check
Uploaded	22 days ago

New Package Report

.changes◂

Changed-By	Jeremy Bícha <jbicha@ubuntu.com>
Architecture	source amd64
Distribution	unstable
Date	Thu, 15 Oct 2026 12:28:17 +0200
Source	rust-gstreamer-check
Version	0.25.0-1

Changelog◂

rust-gstreamer-check (0.25.0-1) unstable; urgency=medium
 .
   * Package gstreamer-check 0.25.0 from crates.io using debcargo 2.8.4

.dsc◂

Section	rust
Priority	optional
Component	main
Package-List	librust-gstreamer-check-dev deb rust optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: gstreamer-check
Upstream-Contact: Sebastian Dröge <sebastian@centricular.com>
Source: https://gitlab.freedesktop.org/gstreamer/gstreamer-rs

Files: *
Copyright: 2017-2026Sebastian Dröge <sebastian@centricular.com>
License: MIT or Apache-2.0

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Jeremy Bícha <jbicha@ubuntu.com>
License: MIT or Apache-2.0

License: Apache-2.0
 Debian systems provide the Apache 2.0 license in
 /usr/share/common-licenses/Apache-2.0

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 22 days ago.

Report◂

DFSG NEW review for rust-gstreamer-check version 0.25.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The crate is dual-licensed MIT OR Apache-2.0 (Cargo.toml, README.md, COPYRIGHT), both DFSG-free, and debian/copyright is DEP-5 with the exact Format URL: Files: * covers the whole upstream tree, the MIT text is reproduced in full (MIT is not in /usr/share/common-licenses) and Apache-2.0 is referred to /usr/share/common-licenses/Apache-2.0. The only defect is cosmetic: the years and the holder run together in the Copyright field of the Files: * stanza (2017-2026Sebastian Dröge). No non-free terms, unlicensed files, binaries or embedded third-party code are present.

Packaging

The package is a clean debcargo-generated source-only crate: one librust-*-dev binary, dh-cargo with debhelper compat 13, a single debcargo autogenerated quilt patch whose effect matches control, autopkgtest with per-feature runs, correct Provides/Breaks and current Standards-Version. It has one dependency fault: nothing in the dependency chain provides the C development files (gstreamer-check-1.0.pc) that the -sys crate probes at build time, so consumers and the package's own autopkgtest cannot compile it without installing libgstreamer-plugins-base1.0-dev by hand. debian/cargo-checksum.json also ships a placeholder instead of the crate checksum.

Issues

important packaging 1. No dependency on the C development package that ships gstreamer-check-1.0.pc ◂

Files: debian/control:5-11, debian/control:24, debian/tests/control:3
Evidence: debian/control Build-Depends-Arch: librust-gstreamer-check-sys-0.25+default-dev <!nocheck> and binary Depends: ${misc:Depends}, librust-glib-0.22+default-dev, librust-gstreamer-0.25+default-dev, ... librust-gstreamer-check-sys-0.25+default-dev, ... name no C package; the only C development package the whole chain pulls in is libgstreamer1.0-dev, through librust-gstreamer-sys-dev. The .pc file that this crate's FFI dependency probes is present on the reviewing system at /usr/lib/x86_64-linux-gnu/pkgconfig/gstreamer-check-1.0.pc, whose Name: gstreamer-check-1.0 / Libs: -L${libdir} -lgstcheck-1.0 are the gstcheck library, and the headers are at /usr/include/gstreamer-1.0/gst/check/.
Problem: Building the crate compiles gstreamer-check-sys, whose build script (it build-depends on system-deps) probes gstreamer-check-1.0 with pkg-config; gstcheck is a library of gst-plugins-base, whose development files are in libgstreamer-plugins-base1.0-dev. The provider of the depended-on crate name, librust-gstreamer-check-sys-dev 0.25.4-1, declares no C dependency at all (Depends: librust-glib-sys-0.22+default-dev, librust-gobject-sys-0.22+default-dev, librust-gstreamer-sys-0.25+default-dev, librust-libc-0.2+default-dev, librust-system-deps-7+default-dev), whereas librust-gstreamer-app-sys-dev, binding libgstapp-1.0 from that same gst-plugins-base source package, does depend on libgstreamer-plugins-base1.0-dev. Since nothing in librust-gstreamer-check-dev's Depends, the Build-Depends-Arch or debian/tests/control brings those files in, a consumer of the dev package cannot build anything depending on this crate, and the package's own autopkgtest (cargo-auto-test ... --all-targets compiles the crate) has no dependency on them either; Policy 3.5 requires a package to declare the packages it uses.
Fix: Depend on libgstreamer-plugins-base1.0-dev at the place where the probe happens, as done for the other gst-plugins-base bindings: add it to librust-gstreamer-check-sys-dev's Depends in rust-gstreamer-check-sys. If that package is not fixed, add it here to librust-gstreamer-check-dev's Depends, to Build-Depends-Arch and to the Depends of every entry in debian/tests/control.

minor licensing 2. Missing space between the years and the copyright holder in debian/copyright ◂

Files: debian/copyright:7
Evidence: Copyright: 2017-2026Sebastian Dröge <sebastian@centricular.com>
Problem: debcargo's FIXME (overlay) UNKNOWN-YEARS placeholder was replaced by 2017-2026 without a separating space, so the field does not cleanly name the copyright holder and a machine parser reads it as 2017-2026Sebastian Dröge.
Fix: Write Copyright: 2017-2026 Sebastian Dröge <sebastian@centricular.com> and, if desired, repeat the setting in debian/copyright.debcargo.hint so it is not lost on regeneration.

minor packaging 3. debian/cargo-checksum.json carries a placeholder instead of the crate checksum ◂

Files: debian/cargo-checksum.json
Evidence: {"package":"Could not get crate checksum","files":{}}
Problem: dh-cargo copies this file to the crate's .cargo-checksum.json for the build and ships it as /usr/share/cargo/registry/gstreamer-check-0.25.0/.cargo-checksum.json. Its package field is what cargo compares with the checksum recorded in a Cargo.lock, and should be the sha256 of gstreamer-check-0.25.0.crate; here it holds an error message, so nothing ties the shipped crate to the crates.io release. Debian builds are unaffected today because dh-cargo deletes Cargo.lock before building.
Fix: Regenerate debian/cargo-checksum.json with a debcargo run that can reach crates.io, so it records the real sha256 of the crate next to the empty files map.

Verified ◂

The prescan named no file to account for: its only section, the copyright-holder comparison over the 17 scanned source files, reports ALL SOURCE AUTHORS LISTED IN debian/copyright, and it reported no built files, no rare licence wording and no licence-database mismatch.
Inventory, read or listed file by file (.pc/ excluded as instructed): Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, CHANGELOG.md, COPYRIGHT, Gir.toml, LICENSE-APACHE, LICENSE-MIT, README.md, src/lib.rs, src/harness.rs, src/test_clock.rs, src/auto/mod.rs, src/auto/test_clock.rs, src/auto/versions.txt, tests/check_gir.rs. All are plain text; there are no binaries, .so/.jar/.class/.pyc files, no minified JS/CSS, no PDFs, no fonts, images or sound, and no embedded copy of a third-party library.
Licence evidence: Cargo.toml license = "MIT OR Apache-2.0"; README.md and COPYRIGHT state the project is Apache-2.0/MIT dual-licensed, with the MIT-only note applying to the sys crates (this crate is not one); LICENSE-APACHE is the complete Apache-2.0 text and LICENSE-MIT the MIT text that debian/copyright reproduces.
grep with gitignore: false for Copyright|(C)|©|SPDX-License-Identifier|Licensed under|Permission is hereby granted|GNU (General|Lesser) Public|Apache License|Mozilla Public|public domain|All rights reserved over the whole tree: hits only in LICENSE-APACHE, LICENSE-MIT, COPYRIGHT, README.md, the prose of CHANGELOG.md and debian/copyright; no per-file notices exist in src/ (// Take a look at the license at the top of the repository in the LICENSE file. is all), and nothing non-free, non-commercial or no-modification was found anywhere.
debian/copyright is DEP-5 whose Format: line is exactly the current URL, so no replacement is proposed; Files: * matches every upstream file and the holder there is the crate's declared author (authors = ["Sebastian Dröge <sebastian@centricular.com>"]); MIT text included in full since MIT is not in /usr/share/common-licenses, Apache-2.0 referred to /usr/share/common-licenses/Apache-2.0.
Generated code has its generator input in the tree: src/auto/mod.rs and src/auto/test_clock.rs are gir-generated, Gir.toml is the generator configuration, src/auto/versions.txt records the gir and gir-files revisions they came from, and tests/check_gir.rs (with librust-gir-format-check in debian/tests/control) validates Gir.toml.
debian/rules is the standard dh $@ --buildsystem cargo; debhelper compat 13 is provided by debhelper 14.5; debian/source/format is 3.0 (quilt); the single patch debian/patches/auto/auto-remove-features.patch is debcargo-autogenerated (remove_features = ["v1_30"] in debian/debcargo.toml), is listed in series, and its effect (the v1_30 feature dropped from Cargo.toml plus the matching check-cfg lint) is consistent with the patched Cargo.toml, with the unpatched Cargo.toml.orig and with debian/control's Provides/Depends stopping at v1_28. There are no maintainer scripts, debian/*.maintscript, install, links, dirs or docs files, none of which a source-only dev package needs.
Every name in the dependency fields exists in the archive: dh-cargo 34 (Provides dh-sequence-cargo), rustc/libstd-rust-dev 1.97.1 (>= 1.92 satisfied), librust-glib-0.22+default-dev -> librust-glib-dev 0.22.10-1, librust-gstreamer-0.25+default-dev and the v1_16..v1_28 feature names -> librust-gstreamer-dev 0.25.3-2, librust-gstreamer-check-sys-0.25+default-dev -> librust-gstreamer-check-sys-dev 0.25.4-1, librust-gir-format-check-0.1+default-dev -> librust-gir-format-check-dev 0.1.3-2+b2.
The .dsc beside the package carries Testsuite: autopkgtest and matching Testsuite-Triggers for the entries in debian/tests/control; debian/changelog has one entry, version 0.25.0-1 in unstable, Thu, 15 Oct 2026 (a Thursday), and X-Cargo-Crate-Version: 0.25.0 agrees with the tarball and with the paths cargo-auto-test uses (/usr/share/cargo/registry/gstreamer-check-0.25.0).
Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: the first two components match, so it is not an issue of any severity.
uscan found the packaged version as the newest upstream release (upstream 0.25.0, packaged 0.25.0).

Not confirmed ◂

Why debian/tests/control restricts the eight feature/no-feature runs to Architecture: !riscv64 (line 16 and later) but leaves the --all-targets --all-features run (lines 1-4), which enables the same features, unrestricted: nothing in the package explains the difference. An autopkgtest run on riscv64 would show whether the unrestricted entry passes there.
Whether a consumer building with a Cargo.lock that records the crates.io sha256 for gstreamer-check 0.25.0 would fail against the placeholder package value in debian/cargo-checksum.json; dh-cargo deletes Cargo.lock before every build, so Debian's own builds are unaffected by it.

Proposed changes ◂

None.

Review Information

accepted — allocated to siretart 21 days ago, started 21 days ago, completed 21 days ago.

Final Comment

Back to Dashboard | View all reviews for this package