DFSG NEW review for rust-jsonschema-value version 0.58.6-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole crate is a single-module MIT-licensed Rust library with one author (Dmitry Dygalo), stated in Cargo.toml.orig (license.workspace = true, project is MIT). debian/copyright is clean DEP-5 format with Files: * / Files: debian/* stanzas, both MIT, and a full License: MIT text. The prescan's author check found every copyright holder named in debian/copyright. The only non-code files are JSONB test fixtures (TSV/JSONL text data generated by tools/gen-jsonb-fixtures.sh against PostgreSQL); they are test data under the crate, not built artifacts, and present no DFSG or provenance concern. No files lack a licence, no non-free terms, no embedded third-party code — all dependencies (ahash, bytecount, fraction, getrandom, magnus, num-, pyo3, rb-sys, serde_json, zmij) are resolved via Debian's librust--dev packages rather than vendored.

Packaging

Standard debcargo-generated rust-team package: dh with --buildsystem cargo, debhelper-compat 13, dh-sequence-cargo, correct Build-Depends with <!nocheck> profiles, Multi-Arch: same, proper Provides for all feature combinations, autopkgtests for every feature via cargo-auto-test (with sensible !riscv64 exclusions for the pyo3/magnus feature tests), Standards-Version 4.7.4 (current), reasonable dependent-version relaxations in relax-deps.patch. No policy or upgrade concerns found. The relax-deps.patch lacks DEP-3 headers (routine for debcargo, minor). One dependency version I could not confirm satisfies the build dependency (see unconfirmed).

Issues

minor packaging 1. relax-deps.patch has no DEP-3 headers ◂

• Files: debian/patches/relax-deps.patch
• Basis: checked, in the package or with a reference tool
• Evidence: Patch Index: jsonschema-value/Cargo.toml opens directly with the diff, no Description:, Forwarded:, Author:, or Last-Update: headers (Policy §4.14 recommends DEP-3).
• Problem: Patches without DEP-3 headers are harder to evaluate for forwarding and provenance; Debian Policy 4.14 recommends the format.
• Fix: Add DEP-3 headers (Description/Origin/Forwarded/Author/Last-Update) to relax-deps.patch.

Verified ◂

• All 27 upstream files scanned; every copyright holder found is named in debian/copyright (prescan author check: 'every holder found is named').
• Whole tree is MIT, single author Dmitry Dygalo; no other licence text found anywhere in src/ or tests/.
• debian/copyright is machine-readable DEP-5 (Field: Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/), covers * and debian/*, supplies full MIT text.
• JSONB fixtures (tests/fixtures/jsonb-corpus*.tsv, *.jsonl) are generated test data (headers: 'generated by tools/gen-jsonb-fixtures.sh against PostgreSQL'), text format, not built artifacts; no preferred-form or DFSG concern.
• No files without licence, no non-free terms, no minified/built/binary files in the tree (prescan found none).
• All Build-Depends/Depends package names and <!nocheck> profile marking checked; magnus 0.8, pyo3 0.28, getrandom 0.4.2, fraction 0.15.3 all present in the archive.
• Autopkgtests run all features via cargo-auto-test; !riscv64 exclusions used only for the pyo3/magnus feature tests which need libpython/libruby.
• Standards-Version 4.7.4 matches current Policy 4.7.4.1; debhelper compat 13 means dh skips test override hooks under nocheck correctly.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.59.0, packaged 0.58.6), which is not a fault of the package.

Not confirmed ◂

• librust-zmij-1+default-dev (>= 1.0.23) (Build-Depends and Depends) — the archive lists librust-zmij-dev 1.0.21-1 only; Cargo.lock pins zmij 1.0.23, the relax-deps.patch leaves zmij at exactly "1.0.23", and apt-cache shows 1.0.21 only. If zmij 1.0.23 is not accepted into unstable/NEW, the build dependency is unsatisfiable and the build fails; the tool reports no newer zmij in NEW. Uncertain whether recent archive/NEW changes ship 1.0.23.

Proposed changes ◂

None.