DFSG NEW review for rust-libsodium-sys-stable version 1.24.3+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The crate is dual-licensed MIT OR Apache-2.0, stated in Cargo.toml (license = "MIT OR Apache-2.0") and carried by LICENSE, LICENSE-MIT and LICENSE-APACHE. debian/copyright is machine-readable DEP-5 and its Files: * stanza names all holders found in the tree (Frank Denis/jedisct1, dnaq, the sodiumoxide Developers) under MIT or Apache-2.0, with the full MIT text included and Apache-2.0 referenced from /usr/share/common-licenses. The two Files-Excluded entries are genuinely absent from the repacked source, and the +ds suffix matches the repack.

Packaging

A standard debcargo-generated Rust -sys crate: debhelper compat 13 with dh $@ --buildsystem cargo, correct Build-Depends-Arch split for an Architecture: any / Multi-Arch: same -dev package, feature collapse expressed via Provides, system-libsodium patch that removes the download-and-build path, relaxed crate versions to the archive's, and autopkgtests covering the default and use-pkg-config feature sets. The one cosmetic leftover is a pair of debcargo review hint files still shipped under debian/.

Issues

1. [minor] [packaging] Leftover debcargo .hint files with FIXME content are shipped under debian/

• Files: debian/copyright.debcargo.hint, debian/rules.debcargo.hint
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright.debcargo.hint contains FIXME (overlay) UNKNOWN-YEARS dnaq, License: UNKNOWN-LICENSE; FIXME (overlay) and Comment: FIXME (overlay): ... you should review and fix this before uploading to the archive.
• Problem: These are debcargo's internal review scaffolding: they repeat the auto-generated content with FIXME placeholders that the maintainer has already resolved in the real debian/copyright and debian/rules. They are not installed and are not referenced by debian/rules, so they are harmless, but shipping them leaves placeholder-laden duplicate files in the source package.
• Fix: Delete debian/copyright.debcargo.hint and debian/rules.debcargo.hint before upload; the resolved files (debian/copyright, debian/rules) remain.

Verified

• The pre-scan found no missing copyright holders (all holders in the tree are named in debian/copyright), so there were no scan-flagged files to account for.
• License evidence read in full: LICENSE (MIT, Copyright (c) 2019-2026 Frank Denis), LICENSE-MIT (MIT, Copyright (c) 2015 The sodiumoxide Developers), LICENSE-APACHE (Apache-2.0), and Cargo.toml license = "MIT OR Apache-2.0". No non-free terms, no public domain/All rights reserved/GNU-style wording elsewhere in the tree.
• Files-Excluded: LATEST.tar.gz* and tests/wasi_component_test.rs are both genuinely absent from the unpacked tree, so the repack is consistent with the +ds version suffix.
• src/sodium_bindings.rs is committed bindgen output; its generator (src/gen.sh) and the input headers (libsodium via libsodium-dev) are available, so its preferred form for modification is present and it is not a DFSG concern.
• Read all of debian/ (control, rules, changelog, copyright, source/format, tests/control, upstream/metadata, debcargo.toml, the three patches and series), build.rs in full, Cargo.toml and Cargo.toml.orig, and the LICENSE*/README files.
• The build-dependencies removed by use-system-libsodium.patch (minisign-verify, tar, zip, vcpkg) are only referenced inside /* ... */ comment blocks in build.rs, so the crate compiles against the remaining deps (cc, libflate, pkg-config, ureq, libc); the Build-Depends-Arch list matches Cargo.toml exactly.
• dh-cargo is available (dh-cargo 34 provides dh-sequence-cargo), and cargo itself arrives transitively via dh-cargo's Depends.
• uscan found the packaged version as the newest upstream release (upstream 1.24.3, packaged 1.24.3+ds).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• I could not confirm from the tree whether a build with DEB_BUILD_PROFILES=nocheck (which drops the <!nocheck> arch build-deps, including rustc) still resolves /usr/share/rustc/architecture.mk, which dh-cargo's pre_building_step reads unconditionally. This is debcargo's standard output for arch crates, so I did not treat it as a fault, but I could not verify the file's owning package from the reviewing system's readable paths.

Proposed changes

None.