Review: rust-hussh 0.2.3-1

Package Information

Description	Memory-safe SSH daemon for restricted TCP forwarding A minimal SSH server that only implements TCP forwarding ("direct-tcpip"). It is intended for use as a restricted SSH tunnel, proxy or jump host where interactive login sessions and remote command execution are not required or desired. Only public-key authentication is supported, password logins are never accepted. An optional low-interaction honeypot mode can log or report unsolicited password authentication attempts.
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	kpcyrd <git@rxv.cc>
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/hussh] (browse)
Tracker	https://tracker.debian.org/pkg/rust-hussh
Uploaded	23 days ago

New Package Report

.changes◂

Architecture	amd64 source
Distribution	unstable
Date	Thu, 15 Oct 2026 16:40:03 +0000
Source	rust-hussh
Version	0.2.3-1
Changed-By	kpcyrd <git@rxv.cc>

Changelog◂

rust-hussh (0.2.3-1) unstable; urgency=medium
 .
   * Package hussh 0.2.3 from crates.io using debcargo 2.8.4

.dsc◂

Priority	optional
Component	main
Package-List	hussh deb net optional arch=any
Section	net

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: hussh
Upstream-Contact: kpcyrd <git@rxv.cc>
Source: https://github.com/kpcyrd/hussh

Files: *
Copyright: 2026 kpcyrd <git@rxv.cc>
License: GPL-3.0-or-later

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 kpcyrd <git@rxv.cc>
License: GPL-3.0-or-later

License: GPL-3.0-or-later
 Debian systems provide the GPL 3.0 in /usr/share/common-licenses/GPL-3

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 23 days ago.

Report◂

DFSG NEW review for rust-hussh version 0.2.3-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

debian/copyright is machine-readable DEP-5 with the canonical Format URL and accurate stanzas: Files: * (2026 kpcyrd, GPL-3.0-or-later) and Files: debian/* (Debian Rust Maintainers + kpcyrd, GPL-3.0-or-later), with the GPL-3 text referenced from /usr/share/common-licenses/GPL-3. Upstream declares GPL-3.0-or-later in Cargo.toml, Cargo.toml.orig and README.md, and ships the verbatim GPLv3 text as LICENSE-GPL-3.0-or-later. No other file carries a licence or copyright notice, and there is no vendored third-party code, no binary/generated-without-source file and no non-free term. The source is DFSG-free and debian/copyright describes it correctly.

Packaging

Debcargo-generated overlay package (dh $@ --buildsystem cargo, debhelper compat 13 via dh-sequence-cargo). The single quilt patch carries DEP-3 headers and only removes an aws-lc-rs russh feature absent from Debian's russh; the systemd unit and conffile are installed, the man page is generated from contrib/hussh.1.scd with scdoc, and both generated files are removed in dh_clean. All Build-Depends(-Arch) resolve in the archive, Standards-Version 4.7.4 matches current Policy 4.7.4.1, the changelog is well-formed and Vcs-*/Homepage are correct. No policy violation, broken upgrade or user-visible defect found.

Issues

None.

Verified ◂

Prescan author check: ALL SOURCE AUTHORS LISTED IN debian/copyright - both holders (kpcyrd, Debian Rust Maintainers) are present; nothing to add.
LICENSE-GPL-3.0-or-later is the verbatim GPLv3 text (Copyright (C) 2007 Free Software Foundation, Inc.); it is the licence text itself, folded into the Files: * GPL-3.0-or-later stanza, so the FSF notice needs no separate stanza.
No per-file copyright/licence headers exist anywhere in the tree: checked every file under src/ (12 files), contrib/ (5), .github/workflows/ (2), and Cargo.toml, Cargo.toml.orig, Cargo.lock, README.md, Makefile, Dockerfile, .gitignore, .dockerignore, .cargo_vcs_info.json; only Cargo.toml/.orig/README.md declare license = "GPL-3.0-or-later". The only noncommercially hit is the wording of GPL-3 §6b, not a licence restriction.
No vendored/embedded third-party code, no .jar/.so/.class/.pyc, no minified JS/CSS, no PDFs, archives or firmware; nothing binary or built was found, matching the scan.
Patch strip-aws-lc.patch removes only "aws-lc-rs", from Cargo.toml's russh features; DEP-3 headers (Description, Author, Origin, Forwarded, Last-Update) are present.
Build-Depends(-Arch) resolve: librust-russh-dev 0.64.1-2 provides +flate2/+serde; librust-rand-dev 0.10.3, librust-toml-dev 1.1.6, librust-reqwest-dev 0.13.5, librust-env-logger-dev 0.11.10, librust-tokio-dev 1.53.1, librust-arc-swap-dev 1.9.2, libstd-rust-dev 1.97.1, scdoc 1.11.5, and dh-sequence-cargo is provided by dh-cargo 34.
Standards-Version 4.7.4 vs current Policy 4.7.4.1 (first two components match) - current.
debian/source/format is 3.0 (quilt); debian/rules installs the conffile (contrib/hussh.conf -> /etc/) and man page, copies contrib/hussh.service for dh_installsystemd and removes both generated files in execute_after_dh_clean.
uscan found the packaged version as the newest upstream release (upstream 0.2.3, packaged 0.2.3).

Not confirmed ◂

debian/cargo-checksum.json contains {"package":"Could not get crate checksum","files":{}} instead of a crate SHA-256 - debcargo failed to fetch the checksum. A build would show whether it matters: dh-cargo's cargo.pm copies it to .cargo-checksum.json without parsing it and cargo ignores that file for a path crate, so it appears harmless for this bin-only package.
Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: glob: " /usr/share/cargo" is not a file of the package or of the reviewing system.

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.2.2-1	9f746d8b…	2026-10-15 09:16	2026-10-15 09:21	awm	rejected	VIEW

Back to Dashboard | View all reviews for this package