rust-hmac-sha512 1.1.13-1

Package Information

Description	HMAC-SHA512 implementation - Rust source code Source code for Debianized Rust crate "hmac-sha512"
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	Guido Günther <agx@sigxcpu.org>
Sponsor	guido@xcpu.ch
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/hmac-sha512] (browse)
Closes	#1151623
Tracker	https://tracker.debian.org/pkg/rust-hmac-sha512
Uploaded	10 hours ago

New Package Report

.changes◂

Version	1.1.13-1
Changed-By	Guido Günther <agx@sigxcpu.org>
Architecture	amd64 source
Distribution	unstable
Source	rust-hmac-sha512

Changelog◂

rust-hmac-sha512 (1.1.13-1) unstable; urgency=medium
 .
   * Initial release.
   * Package hmac-sha512 1.1.13 from crates.io using debcargo 2.8.4
     Closes: #1151623

.dsc◂

Section	rust
Priority	optional
Component	main
Package-List	librust-hmac-sha512-dev deb rust optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: hmac-sha512
Upstream-Contact: Frank Denis <github@pureftpd.org>
Source: https://github.com/jedisct1/rust-hmac-sha512

Files: *
Copyright: 2020-2026 Frank Denis <github@pureftpd.org>
License: ISC

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Guido Günther <agx@sigxcpu.org>
License: ISC

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 9 hours ago.

Report◂

DFSG NEW review for rust-hmac-sha512 version 1.1.13-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

Upstream is a single-crate tree (src/lib.rs, LICENSE, README, Cargo metadata) under the ISC licence, whose full text debian/copyright reproduces. Files: * names Frank Denis, the only holder found anywhere in the tree (src/lib.rs:5 credits the same person with a different address), and Files: debian/* covers the debcargo-generated packaging files. The prescan found no holder missing from debian/copyright. No vendored third-party code, no non-free wording, and no file without a licence grant.

Packaging

Standard debcargo-generated packaging in good shape: compat 13 with dh-sequence-cargo, Standards-Version 4.7.4, both digest dependency versions checked to exist in the archive, autopkgtests for all feature combinations, Vcs-* fields and upstream/metadata present, and a clean initial changelog closing the ITP. The only defect found is an inaccurate DEP-3 Description on one patch.

Issues

minor packaging 1. Patch description says digest 0.9 is available in Debian, the opposite of why the patch exists ◂

Files: debian/patches/drop-unpackaged-digest-versions.patch:1-6
Basis: checked, in the package or with a reference tool
Evidence: Description: Drop digest 0.9 optional dependencies ... Digest 0.9 is currently available in Debian.
Problem: The patch removes the optional digest 0.9 dependency (and the traits09 feature) from Cargo.toml, but its Description says digest 0.9 is available in Debian, which would be a reason to keep it. apt-cache shows no librust-digest-0.9-dev and nothing providing librust-digest-0.9+default-dev in unstable or the NEW queues; Debian has only digest 0.10.7 (rust-digest-0.10) and 0.11.3 (rust-digest). The DEP-3 Description therefore misinforms the next maintainer about why the feature was dropped.
Fix: Change the Description line to state that digest 0.9 is not packaged in Debian (or similar), e.g. "Description: Drop the optional digest 0.9 dependency\n\nDigest 0.9 is not packaged in Debian."

Verified ◂

Prescan listed no missing copyright holders; its 8 scanned files all carry only Frank Denis, who is named in debian/copyright.
Tree is complete and tiny: Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, .gitignore, .github/dependabot.yml, LICENSE, README.md, src/lib.rs, plus debian/ (and .pc/, ignored). Every upstream file was read or grepped for licence notices.
LICENSE contains the ISC text with Copyright (c) 2020-2026, Frank Denis.; debian/copyright's Files: * has the same holder and years and reproduces the ISC terms in full.
src/lib.rs:5 (C) Frank Denis <fdenis [at] fastly [dot] com>: same holder as the files stanza, different address only; grep found no other copyright, SPDX, licence or attribution text in the upstream tree.
debhelper compat 13 with dh $@ --buildsystem cargo; cargo.pm's configure step deletes Cargo.lock before building, so the stale Cargo.lock entry for digest 0.9.0 is irrelevant.
Both patch series entries are applied in .pc/applied-patches; the remove_features patch carries its generation note and the feature list matches debian/debcargo.toml (remove_features = ["traits", "traits09"]) and the absence of a traits09 autopkgtest.
librust-digest-0.10-dev 0.10.7-1 and librust-digest-dev 0.11.3-4 exist in unstable and provide the librust-digest-0.10+default/+oid and 0.11+default/+oid virtual packages that debian/control depends on (apt-cache).
debian/tests/control runs cargo-auto-test for all features and each individual feature; debian/rules passes test --all to dh_auto_test.
Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 in its first two components; debian/changelog is an initial unstable release closing #1151623, and Vcs-Git/Vcs-Browser point at debcargo-conf src/hmac-sha512 as for other Rust team packages.
debian/copyright.debcargo.hint still carries its FIXME/UNKNOWN placeholders but is a debcargo tooling file, not the shipped copyright file.
uscan found the packaged version as the newest upstream release (upstream 1.1.13, packaged 1.1.13).

Not confirmed ◂

None.

Proposed changes ◂

None.

Uploader's response to the LLM review

I'll update the patch description in git and with the next upload.

— Guido Günther (agx), 9 hours ago

Back to Dashboard | View all reviews for this package