rust-hmac-sha1-compact 1.1.8-1

Package Information

Description	SHA1 and HMAC-SHA1 implementation - Rust source code Source code for Debianized Rust crate "hmac-sha1-compact"
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	Guido Günther <agx@sigxcpu.org>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/hmac-sha1-compact] (browse)
Closes	#1151622
Tracker	https://tracker.debian.org/pkg/rust-hmac-sha1-compact
Uploaded	2 hours ago

New Package Report

.changes◂

Date	Tue, 03 Nov 2026 13:42:02 -0600
Source	rust-hmac-sha1-compact
Version	1.1.8-1
Changed-By	Guido Günther <agx@sigxcpu.org>
Architecture	source amd64
Distribution	unstable

Changelog◂

rust-hmac-sha1-compact (1.1.8-1) unstable; urgency=medium
 .
   * Initial release.
   * Package hmac-sha1-compact 1.1.8 from crates.io using debcargo 2.8.4
   * Closes: #1151622

.dsc◂

Section	rust
Priority	optional
Component	main
Package-List	librust-hmac-sha1-compact-dev deb rust optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: hmac-sha1-compact
Upstream-Contact: Frank Denis <github@pureftpd.org>
Source: https://github.com/jedisct1/rust-hmac-sha1-compact

Files: *
Copyright: 2021-2026 Frank Denis <github@pureftpd.org>
License: ISC

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Guido Günther <agx@sigxcpu.org>
License: ISC

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for rust-hmac-sha1-compact version 1.1.8-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

Upstream is a single-author crate (Frank Denis) under the ISC licence: LICENSE carries the ISC text with Copyright (c) 2021-2026, Frank Denis., src/lib.rs adds (C) Frank Denis <fdenis [at] fastly [dot] com>, and Cargo.toml declares license = "ISC". debian/copyright is DEP-5, names that holder and those years under Files: *, and reproduces the full ISC text (ISC is not in /usr/share/common-licenses, so that is required); debian/* gets its own stanza for the Debian Rust Maintainers and the uploader. Nothing in the tree carries a different holder, a different licence, or a non-free term, and the prescan found no holder that debian/copyright omits. The one thing I could not check is whether the Source: URL is the crate's real repository.

Packaging

Standard debcargo-generated packaging, consistent with the rest of the Rust team's archive: debhelper compat 13 with dh-sequence-cargo, a single Architecture: any Multi-Arch: same -dev package with the usual versioned Provides, a clean set of DEP-3 patches (one debcargo-generated feature removal, one dropping the unpackaged digest 0.9/0.11 variants that upstream keeps as optional dependencies), and autopkgtest cases covering default, --all-features, digest010, traits010 and no-default-features. Dependencies resolve in the archive (librust-digest-0.10-dev 0.10.7-1 provides both the default and oid variants, dh-cargo 34 provides dh-sequence-cargo), Standards-Version 4.7.4 is current against Policy 4.7.4.1, and the changelog is a sane initial release for unstable. No issue worth reporting.

Issues

None.

Verified ◂

debian/copyright read in full: DEP-5, Files: * (ISC, 2021-2026 Frank Denis), Files: debian/* (Debian Rust Maintainers, Guido Günther, ISC), and a stand-alone License: ISC paragraph whose text matches LICENSE word for word.
All nine upstream files accounted for: LICENSE (ISC, the only licence notice in the tree), src/lib.rs (456 lines, one attribution comment on line 2, test vectors with no further notices), Cargo.toml (patched, license = "ISC"), Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json (commit 1314e920e463cf502a16bcfb2e6e4244231f8984), .gitignore, README.md and .github/dependabot.yml — the last five are build/metadata files with no copyright notice of their own and are covered by Files: *.
Prescan (dfsg-author-check) listed no files and reported that every holder it found is named in debian/copyright; the only holder anywhere in the tree is Frank Denis.
grep for Copyright/(C)/©/SPDX/Licensed under/Permission is hereby/GNU/Apache/MPL/public domain/All rights reserved over the tree (excluding .pc/ and debian/cargo-checksum.json) found nothing beyond LICENSE, src/lib.rs:2, debian/copyright and its debcargo hint.
Unpacked tree matches rust-hmac-sha1-compact_1.1.8.orig.tar.gz exactly (no files removed or added; no Files-Excluded needed and none claimed).
debian/patches read: series lists auto/auto-remove-features.patch then drop-unpackaged-digest-versions.patch; both apply and the resulting Cargo.toml declares only digest010, with traits/traits09/traits011 removed and the removed-dep cfg names listed in [lints.rust.unexpected_cfgs]. The second patch has a proper DEP-3 header (Description, Author, Forwarded: not-needed, Last-Update).
debian/rules is the debcargo template (dh $@ --buildsystem cargo, override_dh_auto_test: dh_auto_test -- test --all); at compat 13 dh itself skips that override under DEB_BUILD_OPTIONS=nocheck, and dh-cargo's configure deletes Cargo.lock before building (/usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm), so the dead digest 0.9/0.11 entries in the shipped Cargo.lock are harmless.
Dependency names checked with apt-cache: librust-digest-0.10+default-dev and librust-digest-0.10+oid-dev are provided by librust-digest-0.10-dev 0.10.7-1 (satisfies the >= 0.10.7 constraints); dh-sequence-cargo is provided by dh-cargo 34 (autopkgtest Depends dh-cargo (>= 33~) is met).
Standards-Version 4.7.4 against Policy 4.7.4.1: first two components match, so current. Changelog version 1.1.8-1, distribution unstable, dated 2026-11-03, ITP closed.
README.md still documents the traits feature that debian/patches/auto/auto-remove-features.patch removes; this is the usual consequence of debcargo remove_features and only affects the copy of the crate installed under /usr/share/cargo/registry, so not reported as an issue.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.1.9, packaged 1.1.8), which is not a fault of the package.

Not confirmed ◂

debian/copyright names Source: https://github.com/jedisct1/rust-hmac-sha1-compact, while Cargo.toml/Cargo.toml.orig (repository, homepage), debian/control Homepage, the .dsc Homepage and debian/copyright.debcargo.hint all give https://github.com/jedisct1/rust-hmac-sha1. I cannot fetch either URL to see which exists; if the -compact URL is wrong, it is a minor inaccuracy in the Source field.
No build or test run was possible; that the two quilt patches apply and the crate compiles against digest 0.10.7 is taken as given, not verified.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 1 hour ago.

Back to Dashboard | View all reviews for this package