DFSG NEW review for rust-jsonschema-regex version 0.58.6-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is tiny and its licensing is consistent: only src/lib.rs and src/syntax.rs are upstream code, both covered by the MIT grant (Cargo.toml license = "MIT", matching the MIT text reproduced in debian/copyright, which is also the author's declared licence for the jsonschema repository this crate is extracted from). debian/copyright starts with the correct DEP-5 Format line, puts debian/* in a later stanza that overrides the Files: * catch-all, names the upstream holder declared in Cargo.toml (Dmitry Dygalo dmitry@dygalo.dev) and the Debian holders, and includes the full MIT text, as required since MIT is not in /usr/share/common-licenses. No file carries a different or missing licence, no non-free terms, no binary or minified or generated-without-input files, and no vendored third-party code: the one dependency, regex-syntax, is a separate Debian package.

Packaging

Standard, clean debcargo output following the Debian Rust team's practice. debian/rules is the two-line cargo buildsystem invocation, debhelper compat 13 with dh-sequence-cargo (dh-cargo 34 provides it), the crate dependencies sit in Build-Depends-Arch behind <!nocheck>, and every name in the dependency fields exists in the archive at a usable version (librust-regex-syntax-0.8+default-dev via librust-regex-syntax-dev 0.8.11+dfsg-1, librust-regex-1+default-dev via librust-regex-dev 1.13.1-1, librust-test-case-3+default-dev via librust-test-case-dev 3.3.1-7, rustc 1.97.1 against the 1.85.0 floor). Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1, the Provides set correctly covers the 0, 0.58 and 0.58.6 semver levels, the changelog version, X-Cargo-Crate-Version and the autopkgtest commands all agree on 0.58.6, source format is 3.0 (quilt) with no patches needed, and Vcs-* point at debcargo-conf's src/jsonschema-regex. No maintainer scripts, so nothing to break upgrades. I found nothing a sponsor would require changed.

Issues

None.

Verified

• Prescan: the author check found no holder missing from debian/copyright (ALL SOURCE AUTHORS LISTED IN debian/copyright); it listed no file to account for, and it flagged no built, non-free or unlicensed file. Its scan covered the 6 non-debian files in the tree.
• Full tree inventory (glob with hidden and gitignore disabled, .pc/ and debian/cargo-checksum.json excluded): src/lib.rs, src/syntax.rs, Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, plus debian/. Nothing else exists, so the inventory of upstream files is complete and Files: * covers all of it (src/*.rs, Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json).
• Cargo.toml (cargo-normalised from Cargo.toml.orig's license.workspace = true) declares license = "MIT" and authors Dmitry Dygalo <dmitry@dygalo.dev>; debian/copyright names exactly that holder and licence. Cargo.toml.orig declares no licence field of its own, so the crate's declared licence is neither dual nor different.
• debian/copyright: DEP-5 with the correct Format URL, Files: * then Files: debian/* (later stanza overrides), full standalone MIT Licence paragraph including the blank-line . markers. No Files-Excluded field, and none is needed: no file in the tree was repacked away.
• Grep across the whole tree (gitignore false, case-insensitive) for copyright/licence evidence (Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General/Lesser Public, Apache License, Mozilla Public, public domain, All rights reserved) matched only debian/copyright and debian/copyright.debcargo.hint, plus incidental (c) matches inside Rust code; no source file carries a second holder or a different licence. A second grep for non-free wording (non-commercial, no-derivative, field-of-use, Good-not-Evil, prior-written-permission, CC-BY/ShareAlike, OpenSSL/SSLeay, Unicode Inc, INRIA, royalty) found nothing.
• src/lib.rs and src/syntax.rs are hand-written, commented Rust: no embedded third-party code, no copied Unicode tables (identifier predicates use char::is_alphabetic/is_alphanumeric, syntax.rs:491-499; the whitespace tables at lib.rs:325 and lib.rs:584-592 are ECMA-262 character lists), no base64 blobs or generated tables, no include!/include_bytes!/include_str!, no fixtures or external test data. No LICENSE/COPYING/NOTICE/AUTHORS file exists anywhere in the tree.
• No built artefact of any kind ships: no ELF, no .so/.a, no .jar/.class, no minified JS/CSS, no PDF or generated documentation. Cargo.lock and .cargo_vcs_info.json are cargo-generated from inputs that are present (Cargo.toml, the vcs metadata itself), and the crate ships no vendor/ directory, so nothing is an embedded copy of a library Debian already packages (regex-syntax is an ordinary dependency, librust-regex-syntax-dev 0.8.11+dfsg-1).
• debian/control: Build-Depends (debhelper-compat (= 13), dh-sequence-cargo) and Build-Depends-Arch (cargo:native, rustc:native >= 1.85.0, libstd-rust-dev, librust-regex-syntax-0.8+default-dev >= 0.8.9) all carry <!nocheck> correctly; the regex-syntax version floor matches Cargo.toml's 0.8.9. Depends is ${misc:Depends} plus the same crate dependency. Architecture: any with Multi-Arch: same is the debcargo convention for a source-only -dev package. Breaks: rustc (<< 1.85.0~) matches rust-version 1.85.0. Names checked with the apt-cache tool: librust-regex-syntax-0.8+default-dev (provided by librust-regex-syntax-dev 0.8.11+dfsg-1), librust-regex-1+default-dev (librust-regex-dev 1.13.1-1), librust-test-case-3+default-dev (librust-test-case-dev 3.3.1-7), dh-cargo 34 (Provides dh-sequence-cargo), rustc 1.97.1+dfsg1-1 > 1.85.0.
• Cargo.lock pins crates.io versions (e.g. test-case 3.4.0, syn 3.0.6) that differ from what Debian ships, but this cannot break the build: dh-cargo's buildsystem removes Cargo.lock in configure before cargo prepare-debian --link-from-system (/usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm), and it classifies librust-jsonschema-regex-dev as the lib package, so no Built-Using substvar is generated or needed in debian/control.
• Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: first two components match, so it is current (Policy 5.6.11); nothing in the 4.7.x upgrading checklist (A10.2-A10.6: shared-library linker scripts, non-free-firmware copyright rationale, contrib build restrictions, maintainer-script alternatives/diversions, hard links, Description/Binary in .changes, systemd units) applies to this source-only package.
• debian/rules is a minimal dh $@ --buildsystem cargo; no debian/patches and no patch series, which is consistent with 3.0 (quilt) when upstream needs no changes; no maintainer scripts and no *.maintscript, so no upgrade or idempotence concerns; debian/changelog: version 0.58.6-1, distribution unstable, urgency medium, valid RFC-2822 date for the stated Friday, no bug closures needed for a new package; debian/watch was not reviewed per the instructions.
• debian/copyright.debcargo.hint is the debcargo-conf input for the generated debian/copyright (it still carries the FIXME (overlay) UNKNOWN-YEARS placeholder and its explanatory Comment). It ships inside debian/* (covered by the MIT stanza there), is inert, and is the standard Rust-team layout; the generated debian/copyright has the years filled in, so I did not treat the hint as an issue.
• debian/tests/control provides three autopkgtest stanzas (--all-features, default, --no-default-features) whose dependencies and command versions match Cargo.toml's dev-dependencies (regex 1.11.1, test-case 3) and the crate version 0.58.6; all three carry Restrictions: allow-stderr, flaky, which is debcargo's output for test_is_broken = true in debian/debcargo.toml (documented there as waiting on bug #1151013). That is the Rust team's documented escape hatch for a test suite that cannot pass yet, and I did not count it as a defect.
• debian/source/format is 3.0 (quilt); debian/upstream/metadata uses the DEP-12 fields Archive/Repository-Browse/Repository/Documentation with URLs consistent with debian/control's X-Cargo-Crate jsonschema-regex 0.58.6 and the crates.io origin.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.59.0, packaged 0.58.6), which is not a fault of the package.

Not confirmed

• The crate ships no LICENSE/COPYING file, so the MIT identification rests on Cargo.toml's license = "MIT" (cargo-inlined from the upstream workspace) rather than on a licence text shipped with the source; no copy of the jsonschema repository's LICENSE file exists on this system and none could be fetched, so upstream's own licence wording was not compared against the MIT text in debian/copyright.
• The upstream copyright years 2020-2026 in the Files: * stanza were taken over from debcargo's git-derived hint (the hint itself says the years were extracted from upstream git and were UNKNOWN-YEARS at generation time); I could not check them against upstream's git history.

Proposed changes

None.