DFSG NEW review for rust-hex-lit version 0.1.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the correct Format line. Two stanzas cover the whole tree: Files: * (upstream, 2022 Martin Habovstiak, MITNFA) and Files: debian/* (2026 Debian Rust Maintainers and Ying-Chun Liu). That matches the evidence: Cargo.toml.orig has authors = ["Martin Habovstiak ..."] and license = "MITNFA", README ends with ## License / MITNFA, and no other holder or licence notice exists anywhere in the tree. MITNFA is DFSG-free (an Expat grant plus a no-false-attribution paragraph requiring only that distributions of substantially functionally altered versions replace or remove the original author's bug-reporting contacts), and it is not in /usr/share/common-licenses, so its full text is correctly reproduced in the file. No non-free terms, no vendored third-party code, no generated or binary files whose source is missing.

Packaging

Textbook debcargo 2.8.3 output for a source-only crate: debhelper compat 13 plus dh-sequence-cargo, Build-Depends-Arch on cargo:native/rustc:native/libstd-rust-dev marked <!nocheck> (consistent, because dh-cargo's build step only copies sources and dh skips the dh_auto_test override under nocheck at compat 13), autopkgtests for four feature combinations, a sane single-entry changelog, version matching Cargo.toml and the tarball, Standards-Version 4.7.4 against Policy 4.7.4.1, 3.0 (quilt) with no patches, and Vcs-* pointing at debcargo-conf. The only oddity is an unexplained Architecture: !riscv64 on two autopkgtest entries, which cannot be judged without running the tests.

Issues

None.

Verified

• Prescan author check: the only upstream holder it found, Martin Habovstiak martin.habovstiak@gmail.com, is named in the Files: * stanza; the Debian holders are in Files: debian/*. The scan listed no other files (no built/minified/PDF files, no non-free wording) to account for.
• All seven upstream files were read: .cargo_vcs_info.json, .gitignore, Cargo.toml, Cargo.toml.orig, README.md, build.rs, src/lib.rs. They are original source or cargo-generated metadata (Cargo.toml is cargo's normalised file, Cargo.toml.orig its input, .cargo_vcs_info.json a git record); none is third-party code.
• Copyright evidence: Cargo.toml.orig has authors = ["Martin Habovstiak <martin.habovstiak@gmail.com>"] and license = "MITNFA"; README.md ends with ## License followed by MITNFA; src/lib.rs and build.rs carry no separate notices. There is no LICENSE/COPYING/NOTICE/AUTHORS file in the tree; the full MITNFA text is in debian/copyright's stand-alone License: MITNFA paragraph and matches SPDX MITNFA (Expat plus the no-false-attribution paragraph).
• MITNFA is DFSG-free: it grants use, copy, modify, merge, publish, distribute, sublicense and sell; the extra paragraph only requires that distributions of versions whose functionality was substantially altered replace or remove the original author's bug-reporting contacts, which restricts neither modification nor distribution and can always be complied with.
• DEP-5 pattern semantics check: Files: * reaches dotfiles and every subdirectory, so all upstream paths (including .gitignore and .cargo_vcs_info.json) are covered; the later Files: debian/* stanza overrides it for the packaging files.
• The unpacked tree equals the shipped source: the orig tarball's hex_lit-0.1.1/ holds the same upstream files and build.rs / src/lib.rs content; debian.tar.xz contains exactly the debian/ files present (cargo-checksum.json, changelog, control, copyright, copyright.debcargo.hint, debcargo.toml, rules, source/format, tests/control, watch) and no debian/patches.
• debian/copyright.debcargo.hint is debcargo's overlay template (FIXME (overlay) UNKNOWN-YEARS, with a comment saying to review it); it is installed in no binary package, and debian/copyright has the resolved holder and year, so it states nothing contradictory about the shipped files.
• Build dependencies are correct: dh-cargo 34 (unstable) provides dh-sequence-cargo and Depends on cargo; rustc Depends on libstd-rust-dev, gcc and libc-dev, so the cargo helper and the autopkgtest environment have a linker. Build-Depends-Arch is the right field for an arch:any package.
• The <!nocheck> markers are sound at compat 13: reading /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm, build only copies the crate sources (no cargo call) and only test runs cargo; the debhelper tool confirms that from v13 dh skips dh_auto_test overrides under nocheck. prepare-debian only writes a cargo config, so a nocheck build needs no rustc.
• debian/rules is the standard three-line cargo rule; dh_auto_test -- test --all reaches cargo test --all through cargo.pm's test sub, and X-Cargo-Crate / X-Cargo-Crate-Version in debian/control are the fields cargo.pm reads.
• Autopkgtest: debian/tests/control runs cargo-auto-test for all-features, default, rust_v_1_46 and no-features through dh-cargo (>= 33~, archive has 34) with rustc, @ expanding to librust-hex-lit-dev; this is the Rust team's standard generated set.
• Changelog and metadata: 0.1.1-1 to unstable, urgency medium, signer is the Uploader, date Wed 28 Oct 2026 is correct; version matches Cargo.toml and the tarball. Standards-Version 4.7.4 has the same first two components as Policy 4.7.4.1. Source format 3.0 (quilt) with no patches to check; Vcs-Git/Vcs-Browser point at debcargo-conf; ${misc:Depends} is present in Depends as required below compat 14.
• .pc/ and debian/cargo-checksum.json were passed over as instructed; debian/watch was not reviewed.
• uscan found the packaged version as the newest upstream release (upstream 0.1.1, packaged 0.1.1).

Not confirmed

• debian/tests/control marks the last two test commands (--no-default-features and --no-default-features --features rust_v_1_46) Architecture: !riscv64. The crate's tests are architecture-independent pure computation, so a real riscv64 failure that would justify this is not visible from the package; running the tests on riscv64 would show whether the restriction is needed.
• The upstream copyright year 2022 in Files: * comes from the debcargo hint's git-derived years and cannot be checked against the upstream repository without network access.

Proposed changes

None.