Review: rust-hussh 0.2.2-1

Package Information

Description	Memory-safe SSH daemon for restricted TCP forwarding A minimal SSH server that only implements TCP forwarding ("direct-tcpip"). It is intended for use as a restricted SSH tunnel, proxy or jump host where interactive login sessions and remote command execution are not required or desired. Only public-key authentication is supported, password logins are never accepted. An optional low-interaction honeypot mode can log or report unsolicited password authentication attempts.
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	kpcyrd <git@rxv.cc>
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/hussh] (browse)
Tracker	https://tracker.debian.org/pkg/rust-hussh
Uploaded	30 days ago

New Package Report

.changes◂

Source	rust-hussh
Version	0.2.2-1
Changed-By	kpcyrd <git@rxv.cc>
Architecture	amd64 source
Distribution	unstable

Changelog◂

rust-hussh (0.2.2-1) unstable; urgency=medium
 .
   * Package hussh 0.2.2 from crates.io using debcargo 2.8.4

.dsc◂

Component	main
Package-List	hussh deb network optional arch=any
Section	network
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: hussh
Upstream-Contact: kpcyrd <git@rxv.cc>
Source: https://github.com/kpcyrd/hussh

Files: *
Copyright: 2026 kpcyrd <git@rxv.cc>
License: GPL-3.0-or-later

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 kpcyrd <git@rxv.cc>
License: GPL-3.0-or-later

License: GPL-3.0-or-later
 Debian systems provide the GPL 3.0 in /usr/share/common-licenses/GPL-3

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 24 days ago.

Report◂

DFSG NEW review for rust-hussh version 0.2.2-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable

Licensing

The whole tree is uniformly GPL-3.0-or-later: Cargo.toml / Cargo.toml.orig say license = "GPL-3.0-or-later", README.md ends with GPL-3.0-or-later, and LICENSE-GPL-3.0-or-later is the verbatim GPLv3 text. No per-file headers, notices, embedded third-party code, binary blobs, textures/fonts or minified files exist anywhere, so no other holder or licence has to be recorded. GPL-3 is DFSG-free and the file defers to /usr/share/common-licenses/GPL-3 as Policy 12.5 asks. debian/copyright is DEP-5, correctly ordered (Files: * before debian/*), and accurate apart from one minor gap: the GPL text file's own FSF notice is not represented.

Packaging

A clean, ordinary debcargo-generated binary-crate package: 3.0 (quilt), debhelper-compat 13 with dh-sequence-cargo, a single arch:any hussh binary, correct ${cargo:}/${shlibs:}/${misc:} substitutions, Vcs- on debcargo-conf, Standards-Version 4.7.4 (current), and a sane unstable/0.2.2-1 changelog. The upstream systemd unit is installed through dh_installsystemd, the man page is built with scdoc and shipped, and /etc/hussh.conf is picked up as a conffile by debhelper automatically. Every Build-Depends-Arch name resolves in the archive. Only minor nits remain: a wrong Section, a quilt patch with no DEP-3 header.

Issues

minor licensing 1. FSF copyright on the shipped GPL-3 text is not represented in debian/copyright ◂

Files: debian/copyright:6-8, LICENSE-GPL-3.0-or-later:4
Evidence: Files: * / Copyright: 2026 kpcyrd <git@rxv.cc> / License: GPL-3.0-or-later, while LICENSE-GPL-3.0-or-later:4 reads Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/> and line 6 says changing it is not allowed
Problem: The catch-all stanza attributes every file, including the license text, to kpcyrd under a license that permits modification, but the GPLv3 text carries its own FSF copyright notice and may only be copied verbatim. The DEP-5 filename glob * matches that file, so the file's holder and terms are misdescribed (copyright-format 1.0 §6.8). The debcargo template (debian/copyright.debcargo.hint:15-20) had a separate stanza for this file which the overlay dropped.
Fix: Add a stanza before or after the catch-all, e.g. Files: LICENSE-GPL-3.0-or-later with Copyright: 2007 Free Software Foundation, Inc. <http://fsf.org/> and License: GPL-3.0-or-later (noting the license text itself must not be modified).

minor packaging 2. Wrong archive section: network is not a valid section ◂

Files: debian/control:2, debian/control:52, debian/debcargo.toml:13
Evidence: Section: network in the source stanza and Section: network in the hussh binary stanza ([source] section = "network" in debcargo.toml)
Problem: Policy 2.4 gives the authoritative section list maintained by the archive; the networking section is net, and network is not a section. The same string is emitted in both the source and the binary package control.
Fix: Set section = "net" for both the source and the binary package in debian/debcargo.toml and regenerate debian/control so it reads Section: net.

minor packaging 3. quilt patch has no DEP-3 description header ◂

Files: debian/patches/strip-aws-lc.patch, debian/patches/series
Evidence: First lines of the patch are --- a/Cargo.toml / +++ b/Cargo.toml; the diff drops "aws-lc-rs" from the russh feature list with no Description/Origin/Forwarded fields
Problem: A functional change to upstream (russh is built without the aws-lc-rs backend) is carried with no explanation of why, whether it was forwarded, or who wrote it; the changelog does not mention it either. Established practice (DEP-3) is that each patch carries at least a Description.
Fix: Add a header to the patch: Description: drop the aws-lc-rs feature from russh (with the reason, e.g. that Debian does not ship aws-lc-sys), plus Forwarded:/Origin: as applicable.

Verified ◂

Read all of debian/: control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, rules.debcargo.hint, hussh.install, hussh.manpages, cargo-checksum.json, source/format, watch (format only), upstream/metadata, patches/series and patches/strip-aws-lc.patch.
Read all 12 upstream sources (src/.rs and src/ssh/.rs) plus Cargo.toml, Cargo.toml.orig, Cargo.lock, README.md, Makefile, Dockerfile, LICENSE-GPL-3.0-or-later, .cargo_vcs_info.json, .gitignore, .dockerignore, .github/workflows/*.yml and all five contrib/ files.
Grepped the whole tree (gitignore:false) for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Apache/MPL/public domain/All rights reserved and similar: the only notices are the FSF block in LICENSE-GPL-3.0-or-later and license = "GPL-3.0-or-later" in Cargo.toml, Cargo.toml.orig and README.md. No per-file headers, no embedded/vendored third-party code, no attribution of a different upstream.
Inventoried the tree: only .rs, .toml, .lock, .md, .yml, .scd, .conf and text control files — no binary blobs, .so/.jar/.class/.pyc, minified JS/CSS, fonts, images or generated code without its input, so nothing lacks its preferred form for modification.
Confirmed the quilt patch is applied: Cargo.toml russh features are ["flate2", "serde"], Cargo.toml.orig still has aws-lc-rs.
Checked every Build-Depends-Arch name with apt-cache: librust-russh-0.64+flate2-dev, librust-reqwest-0.13+rustls-dev, librust-toml-1+default-dev, librust-rand-0.10+default-dev, librust-tokio-1+signal-dev all resolve as virtual packages provided by librust-*-dev; scdoc and dh-sequence-cargo (dh-cargo) exist.
Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1; the DEP-5 Format line is the exact current https:// URL.
Checked debhelper semantics: debian/hussh.install shipping contrib/hussh.conf to /etc/ results in a conffile via dh_installdeb's auto-detection; the execute_before/execute_after hook targets and override_dh_dwz are valid at compat 13; dh_installsystemd is in the default sequence, so contrib/hussh.service (DynamicUser + StateDirectory=hussh + /var/lib/hussh working dir) is installed and enabled.
uscan found the packaged version as the newest upstream release (upstream 0.2.2, packaged 0.2.2).

Not confirmed ◂

The shipped Cargo.lock still lists aws-lc-rs/aws-lc-sys while the patched Cargo.toml no longer requests that feature; whether the build regenerates or ignores the lock (dh-cargo does not pass --locked) can only be shown by a build.
debian/cargo-checksum.json contains the stub {"package":"Could not get crate checksum","files":{}}; whether dh-cargo needs a populated checksum for this binary crate is for a build to show.
Upstream provenance of contrib/hussh.service, contrib/hussh.initd and the .github workflows (all presumed by the same author) could not be checked against the upstream git history; no differing copyright notice appears in them.

Proposed changes ◂

None.

Review Information

rejected — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Hi,

Debian does not have section 'network' - it should be section 'net'.

See: https://www.debian.org/doc/debian-policy/ch-archive.html#sections

Additionally "debian/patches/strip-aws-lc.patch" is missing DEP-3 Headers explaining the source of the patch, whether it has been forwarded upstream, and so forth. While this is not a mandatory thing, it is very much best practice to do this.

Thanks!

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.2.3-1	e8f18742…	2026-10-16 02:47	2026-10-16 02:47	awm	accepted	VIEW

Back to Dashboard | View all reviews for this package