DFSG NEW review for rust-hegeltest-c version 0.47.1+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 3 blocker, 1 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Everything found in the tree is DFSG-free (MIT, MPL-2.0, PSF-2, Unicode-3.0, BSD), so there is no non-free file, but debian/copyright is badly inaccurate. Its Files: * paragraph claims the whole tree is 2026 Antithesis, LLC under MIT, while large parts of src/ say in their own headers that they are ports of Hypothesis (Port of hypothesis...``, Mirrors Hypothesis's ..., MPL-2.0), of CPython's Lib/re/ and unicodedata (PSF-2), and of Lark 1.3.1 (MIT, Erez Shinan). In addition, four vendored Unicode Character Database files are Unicode-3.0 data, not MIT. The file names none of those holders and includes neither the PSF nor, for the non-SpecialCasing data, the Unicode terms, so it does not describe the copyright and licensing of every file. It has a duplicate empty License: Unicode-3.0 paragraph as well.

Packaging

This is ordinary debcargo 2.8.5 output and is sound: compat 13 with dh-sequence-cargo and a two-line debian/rules, a single Multi-Arch: same librust-hegeltest-c-dev with the full Debianized Provides set, dependencies on packaged crate versions (spot-checked with apt-cache, including the versions relax-deps.patch drops to), an explicit Breaks on older rustc, autopkgtest stanzas with their dev-dependencies, Vcs-* and debian/upstream/metadata, and a sane single-entry changelog. Standards-Version 4.7.4 matches Policy 4.7.4.1. The only defect is the patch that disables upstream tests (one wholesale deletion, one on a rationale the test source contradicts, with no DEP-3 header), which is minor.

Issues

1. [blocker] [licensing] Files: * calls the whole tree MIT/Antithesis although src/native is a port of Hypothesis (MPL-2.0)

• Files: debian/copyright:8-10, src/native/intervalsets.rs:1, src/native/printer.rs:3, src/native/shrinker/mutation.rs:3, src/native/statistics.rs:6, src/native/core/state.rs:1272, src/native/core/float_index.rs:64, src/native/test_runner.rs:1234, src/native/draws/internet.rs:124
• Basis: inferred from what was read, not seen directly
• Evidence: //! Port of hypothesis.internal.intervalsets.IntervalSet (intervalsets.rs:1), `//! Port of Hypothesis's `shrinking/mutation.py (mutation.rs:3), Port of hypothesis.internal.statistics.stdtr (statistics.rs:6); debian/copyright says `Files: *` / `Copyright: 2026 Antithesis, LLC` / `License: MIT`. printer.rs:3: `The line-breaking core is a port of `hypothesis.vendor.pretty` (itself a fork of `IPython.lib.pretty`, based on Ruby's `prettyprint.rb.
• Problem: A translation of another project's source code is a derivative work: the engine driver, shrinker, float/index helpers, statistics, printer and draws strategies that are labelled Port of / Mirrors Hypothesis's carry the Hypothesis copyright (David R. MacIver / Hypothesis Works Pty Ltd) and Hypothesis's MPL-2.0 terms, neither of which debian/copyright mentions anywhere; printer.rs adds an IPython (BSD-3) and Ruby prettyprint.rb layer. Dozens of such headers run through src/native (tlds, floats, draws, core, shrinker, test_runner). MPL-2.0 and BSD-3 are DFSG-free and compatible with the crate's MIT, so this is not a non-free file, but the blanket MIT/Antithesis paragraph is wrong for a large share of the code and the MPL-2.0 and BSD notices are not given.
• Fix: Add Files stanza(s) for the ported files naming the Hypothesis holders with License: MPL-2.0 (text at /usr/share/common-licenses/MPL-2.0), and state the IPython/Ruby ancestry of src/native/printer.rs; restrict Files: * to the code that really is Antithesis's MIT work.

2. [blocker] [licensing] debian/copyright has no stanza for src/native/re/, a port of CPython's Lib/re (PSF-2)

• Files: debian/copyright:8-10, src/native/re/mod.rs:1, src/native/re/parser.rs:1, src/native/re/constants.rs:1, src/native/re/width.rs:1, src/unicodedata/mod.rs:1, src/native/lark/grammars/python.lark:5
• Basis: checked, in the package or with a reference tool
• Evidence: //! Port of CPython's Lib/re/_parser.py and `//! Port of CPython's `Lib/re/_constants.py; parser.rs:1-5 also says Matches _parser.State field-for-field and keeps CPython's error strings (nothing to repeat, multiple repeat, missing ), unterminated subpattern, bad character in group name). CPython's licence, verified at /usr/share/doc/python3/copyright:105, is PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2.
• Problem: These files translate PSF-licensed CPython source, so their licence is PSF-2 and the holder is the Python Software Foundation, not Antithesis under MIT as Files: * claims. PSF-2 is not in /usr/share/common-licenses, so copyright-format 1.0 and Policy 12.5 require its text in debian/copyright, and it is absent. The same origin applies to src/unicodedata/mod.rs (Port of Python's unicodedata module) and to src/native/lark/grammars/python.lark:5 (Adapted from: https://docs.python.org/3/reference/grammar.html).
• Fix: Add a Files stanza for src/native/re/*, src/unicodedata/mod.rs and the Python-documentation-derived grammar with Copyright: Python Software Foundation and a stand-alone License: PSF-2 paragraph carrying the PSF licence text.

3. [blocker] [licensing] Files: * calls the vendored Unicode data MIT, but src/unicodedata/*.txt is Unicode-3.0 data

• Files: debian/copyright:8-10, debian/copyright:16-18, src/unicodedata/UnicodeData.txt, src/unicodedata/categories.txt, src/unicodedata/case.txt, src/unicodedata/nfd_bases.txt, src/unicodedata/mod.rs:4-8
• Basis: checked, in the package or with a reference tool
• Evidence: mod.rs: Backed by three text data files generated from src/unicodedata/UnicodeData.txtandSpecialCasing.txt (vendored Unicode 17.0.0 UCD). Only Files: src/unicodedata/SpecialCasing.txt (copyright line 16) carries License: Unicode-3.0; UnicodeData.txt, categories.txt, case.txt and nfd_bases.txt match only Files: * / Copyright: 2026 Antithesis, LLC / License: MIT.
• Problem: UnicodeData.txt is the Unicode Character Database and is covered by the Unicode License V3 with copyright Unicode, Inc. (the very text already quoted for SpecialCasing.txt), and the three generated tables are derived from it; UnicodeData.txt itself carries no notice, so nothing in the data corrects the MIT claim. debian/copyright therefore gives the wrong licence and the wrong holder for four files, and the licence's condition that its notice accompany the data (or appear in associated documentation, which is exactly debian/copyright's job) is met only for SpecialCasing.txt.
• Fix: Replace the SpecialCasing stanza with Files: src/unicodedata/* and Copyright: 2025 Unicode®, Inc. (or the range the data carries), License: Unicode-3.0.

4. [important] [licensing] Lark stanza covers only its LICENSE file, not the src/native/lark/ port or the .lark grammars

• Files: debian/copyright:12-14, src/native/lark/mod.rs:1, src/native/lark/parse.rs:6, src/native/lark/grammars/lark.lark, src/native/lark/grammars/common.lark, src/native/lark/grammars/unicode.lark, src/native/lark/grammars/python.lark, tests/fixtures/lark/
• Basis: checked, in the package or with a reference tool
• Evidence: //! Port of Lark's grammar language (lark/load_grammar.pyin Lark 1.3.1, MIT licensed: seegrammars/LICENSE) and The parser is a port of Lark's xearley.py``; debian/copyright has Files: src/native/lark/grammars/LICENSE / Copyright: 2017 Erez Shinan, which as a copyright-format pattern names exactly that one path.
• Problem: The twelve .rs files in src/native/lark/ translate Lark's load_grammar.py and xearley.py, and the .lark files shipped beside Erez Shinan's LICENSE are Lark's grammars (python.lark is even adapted from the Python reference grammar); all of them fall through to Files: * and are attributed to Antithesis, LLC. The licence is the same MIT, so this is an attribution gap rather than a licence conflict, but the holder the tree itself identifies is missing from the file. tests/fixtures/lark/ holds further .lark grammars taken from Lark's test suite with no mention at all.
• Fix: Widen the stanza to cover the whole port and its data, e.g. Files: src/native/lark/* with Copyright: 2017 Erez Shinan, and add tests/fixtures/lark/ if those grammars come from Lark.

5. [minor] [licensing] debian/copyright has an empty duplicate License: Unicode-3.0 stanza

• Files: debian/copyright:44-46
• Basis: checked, in the package or with a reference tool
• Evidence: a stand-alone paragraph containing only License: Unicode-3.0 (line 44), followed by the real one (line 46: UNICODE LICENSE V3 ...).
• Problem: A stand-alone License stanza must give the licence text or a pointer to it (copyright-format 6.7); this one gives neither, so a reader or machine taking the first stanza of that name finds no Unicode licence at all.
• Fix: Delete the empty paragraph at line 44.

6. [minor] [packaging] disable-broken-tests.patch deletes the C-ABI smoke test and disables header_drift for a reason its code contradicts, without a DEP-3 header

• Files: debian/patches/disable-broken-tests.patch, tests/header_drift.rs:9
• Basis: checked, in the package or with a reference tool
• Evidence: The patch turns #[test] into //#[test] disabled since it tries to write to read only directory and removes all 1665 lines of tests/smoke.rs from both Cargo.toml and the tree. tests/header_drift.rs writes only inside if env::var_os("HEGEL_C_HEADER_WRITE").is_some() (line 31), so it never writes during a plain test run. The patch carries no Description:, Origin: or Forwarded: field.
• Problem: The only test that dlopens the built cdylib and exercises the exported C API, which is the crate's whole purpose, is deleted outright, and the reason given for disabling the header-drift test is not true of the code; the result is that the autopkgtest run no longer checks the shipped include/hegel.h against what cbindgen generates. A test patch that silently removes coverage and does not say why it exists or where it was forwarded is what a sponsor would question.
• Fix: Restore the tests if they pass; if header_drift cannot run, say why in a DEP-3 Description and use #[ignore]/an environment guard rather than deleting tests/smoke.rs.

Verified

• Prescan item accounted for: src/unicodedata/SpecialCasing.txt:3 (# © 2025 Unicode®, Inc.) is the holder the scan could not find; debian/copyright:16-18 names it with License Unicode-3.0, and that one stanza is right. The licensing problem is its four unmentioned siblings, reported above.
• Read all of debian/ except debian/watch and debian/cargo-checksum.json (both out of scope): control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, tests/control, upstream/metadata, source/format, patches/series and all three patches.
• include/hegel.h is cbindgen output, not a mystery binary: its header says it is generated from src/lib.rs, and both src/lib.rs and cbindgen.toml are shipped.
• src/unicodedata/{categories,case,nfd_bases}.txt and tests/embedded/native/unicodedata_python_reference_data.rs are generated data; their UCD inputs (UnicodeData.txt, SpecialCasing.txt) are shipped and mod.rs documents the transformation, though the generating scripts (upstream scripts/*.py) are not in the crate tarball. tests/embedded/native/statistics_oracle_data.rs is generated numeric test data.
• src/native/draws/tlds-alpha-by-domain.txt is IANA's TLD list (header Version 2026051600, Last Updated ...), vendored as documented at src/native/draws/internet.rs:14: a factual list of domain names with no licence statement and no separable creative content.
• src/native/lark/grammars/LICENSE is the full MIT text with Copyright © 2017 Erez Shinan, matching the license named for it in debian/copyright.
• Searched the whole upstream tree (minus .pc/ and debian/) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU/MPL/Apache, public domain, All rights reserved and for Port of/derived from: no non-free wording, no GPL/LGPL/AGPL/CC-NC/ND/JSON-style clause. No binaries, images, fonts, PDFs, archives or minified code; every file is text (Rust, TOML, .lark, .txt, .md, .h, .expected). Upstream ships no top-level LICENSE file; the copyright file supplies MIT's text, satisfying Policy 12.5.
• Dependency names spot-checked with apt-cache and all exist: librust-toml-1+parse-dev (1.1.6), librust-hashbrown-0.16+inline-more-dev (0.16.1), librust-ctor-1+default-dev (1.0.13), librust-rand-0.10-dev (0.10.3), librust-miniz-oxide-0.9+with-alloc-dev (0.9.1), librust-rustix-1+rand-dev (1.1.5), librust-once-cell-1+alloc-dev (1.21.4), librust-rustc-hash-2-dev (2.1.3).
• Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool): first two components equal, not an issue. Compat 13 with dh-sequence-cargo; ${misc:Depends} present; Multi-Arch: same -dev package; Vcs-Git/Vcs-Browser and debian/upstream/metadata present; changelog 0.47.1+ds-1 to unstable, one entry, version scheme consistent with the crate.
• relax-deps.patch lowers hashbrown 0.17 to 0.16, miniz_oxide 0.8 to 0.9 and ctor 0.2 to 1 to the versions Debian packages, and auto/auto-remove-targets.patch drops the cfg(windows) windows-sys dependency; both agree with Build-Depends and neither is reported (Debian does not build the Windows target, and version-relaxing patches are the Rust team's normal practice).
• Skipped .pc/ and debian/cargo-checksum.json throughout, per instructions.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.48.0, packaged 0.47.1+ds), which is not a fault of the package.

Not confirmed

• Whether cbindgen 0.29.2 as packaged reproduces the checked-in include/hegel.h byte-for-byte: the header_drift test that would show it is disabled in debian/patches and I cannot build.
• The legal judgement that src/native/re/ and the Port of/Mirrors Hypothesis's modules are derivative works rather than independent reimplementations from observed behaviour; the port statements are the package's own, but only upstream can say how close the translation is.
• Hypothesis's exact licence and holders (I believe MPL-2.0, David R. MacIver / Hypothesis Works Pty Ltd) were not verified on this system: python3-hypothesis is not installed, so I could not read Debian's copy of its copyright.
• Whether Restrictions: flaky, used in debian/tests/control for the runtime and all-features stanzas, is accepted by the autopkgtest run for this suite; it is not among the restrictions in the autopkgtest document shipped with Policy 4.7.4.1, and an unknown restriction makes the test skipped rather than run.
• Whether the +ds repack removed anything besides examples/: the .orig tarball beside the package is the repacked one, so there is no pristine upstream tarball to compare it with. I did not read all ~300 files line by line; licence evidence was collected with the tree-wide greps listed above plus a read of every file whose name or header suggested licence content.

Proposed changes

None.