DFSG NEW review for rust-lamlvm version 0.1.3-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 (copyright-format 1.0) and accurate. Files: * covers every upstream file (all 17 the prescan saw: the crate's Rust sources, Cargo.toml[.orig/.upstream], Cargo.lock, .cargo_vcs_info.json, README.md, PROVENANCE.md, CHANGELOG.md, LICENSE-MIT, examples/walk_ext4_on_lv.rs): the copyright holders it names (main--, 2022; Lamco Development LLC, 2026) are exactly those in LICENSE-MIT, and no other holder appears anywhere in the tree (grep for Copyright/(C)/(c)/SPDX-License-Identifier/Licensed under/GNU/Apache/MPL/All rights reserved finds only LICENSE-MIT and debian/). The crate is a documented fork of rust-lvm2 v0.0.3 (MIT), which is why the main-- holder is not in the sources' own notices; the Comment in the Files: * stanza and PROVENANCE.md explain this, and upstream's Cargo.toml.orig/Cargo.toml.upstream carry license = "MIT". The Expat short name is the copyright-format name for MIT, its full text is reproduced (MIT is not in /usr/share/common-licenses), the licence of the code is the same as the fork's, and there is nothing non-free, no bundled third-party code, no binary or generated file and no Files-Excluded needed (the orig tarball is the unmodified crates.io tarball).

Packaging

A debcargo 2.8.4 generated rust-team package (librust-lamlvm-dev, Architecture: any, Multi-Arch: same), and it is in good shape. debhelper-compat (= 13) with dh-sequence-cargo (provided by dh-cargo 34 in unstable) plus dh $@ --buildsystem cargo in debian/rules; the explicit --buildsystem is redundant next to dh-sequence-cargo but harmless. Every Build-Depends-Arch/Depends name exists in the archive (checked with apt-cache: librust-{embedded-io-0.6,nom-7,serde-1,snafu-0.9,tracing-0.1}-{alloc,std,derive}+-dev, libstd-rust-dev, rustc), as do all five autopkgtests' extra dependencies (librust-ext4-view-0.9+default-dev 0.9.3-1, librust-ruzstd+default-dev 0.8.3-2, librust-sha2-0.11+default-dev 0.11.0-1, librust-tracing-subscriber-0.3+default-dev, dh-cargo 34 >= 33). Standards-Version 4.7.4 equals the current Policy version, Vcs-Git/Vcs-Browser point at debcargo-conf as the rust team requires, Homepage and Section are present, and ${misc:Depends} is correct for the -dev package at compat 13 in the usual rust-team form (compare librust-snafu-dev, which likewise lists no libstd-rust-dev). The single patch, drop-example-relax-ruzstd.patch, carries proper DEP-3 headers (Description, Author, Forwarded: not-needed, Last-Update) and its two hunks are coherent: Cargo.toml sets autoexamples = false, so removing the [[example]] target is enough to stop the example being built, and the ruzstd dev-dependency range still admits 0.8.3. The changelog entry is dated, targets unstable and matches the version; there are no maintainer scripts to get wrong.

Issues

None.

Verified

• The prescan (/review-input/prescan.md) found no copyright holder missing from debian/copyright: "every holder found is named in debian/copyright", over the 17 non-debian files, which matches the 17 upstream files in the tree.
• Independent grep of the whole tree (.pc/ excluded) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public, GNU Lesser, Apache License, Mozilla Public, public domain, All rights reserved matched only LICENSE-MIT (lines 3-4) and debian/copyright / debian/copyright.debcargo.hint; no other licence text or holder exists, and none of the src/*.rs files carries a per-file notice.
• README.md and PROVENANCE.md both state the licence (MIT) and the fork's provenance; PROVENANCE.md names the vendored upstream commit and the upstream author, consistent with the GitHub pseudonym main-- used in LICENSE-MIT and debian/copyright.
• The lib.rs header links the libyal libvslvm format documentation as a format reference only; no code or text from it is present (grep for GPL/LGPL/kernel/libyal in src matches only that URL), so no additional licence applies.
• No binary, minified, generated or data file is in the tree: every non-debian file is .rs, .md, .toml, .json or the Cargo.lock text, and grep for include_bytes!/include_str! in src matches nothing.
• The example kept in the tree is deliberately not orphaned: Cargo.toml has autoexamples = false and no [[example]] table, so examples/walk_ext4_on_lv.rs is not a build target and does not need its removed embedded-io-adapters dev-dependency; README.md's pointer to it remains a valid file reference.
• The crate as shipped carries no tests: debian/tests/control has five cargo-auto-test entries with dev-dependencies (ext4-view, ruzstd, sha2, tracing-subscriber), but upstream's Cargo.toml sets autotests = false and its include list omits tests/, and grep for #[test]/#[cfg(test)]/``` in src finds nothing. The autopkgtests therefore exercise compilation of the crate and its features (including --all-features and --no-default-features) rather than any test body; that is upstream's tarball content, not a packaging error, and all the declared dependencies exist.
• dh-cargo's buildsystem removes Cargo.lock (rm_files("Cargo.lock") in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm, configure), so the shipped Cargo.lock still naming the patched-away embedded-io-adapters 0.6.2 and ruzstd 0.9.1 does not affect the build or the autopkgtests; the cargo wrapper (/usr/share/cargo/bin/cargo) uses the .cargo-checksum.json only as a directory-source checksum record.
• The two unwrap!/panic! sites in src (lib.rs:388 under #[expect(clippy::unwrap_used)] after ensure!(meta_root.0.len() == 1, ...), and src/metadata/deserialize.rs:151 in MapAccess::next_value_seed) are guarded by contract, not reachable from the parsed data, and are upstream code, not packaging.
• uscan found the packaged version as the newest upstream release (upstream 0.1.3, packaged 0.1.3).

Not confirmed

• Whether an ITP bug exists for this new package that the changelog should close with Closes: #NNNNNN; the package itself names no bug number and the .dsc carries none, so this could not be checked. debcargo-generated rust-team changelogs habitually omit it.
• A build and the autopkgtests could not be run here; the checks above are static (dependency names resolved with apt-cache, debhelper/cargo behaviour read from the installed files under /usr).

Proposed changes

None.