Review: rust-micromap 0.3.0-1

Package Information

Description	Fastest alternative to HashMap, for maps smaller than 20 keys - Rust source code Source code for Debianized Rust crate "micromap"
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	Eric Dorland <eric@debian.org>
Sponsor	eric@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/micromap] (browse)
Tracker	https://tracker.debian.org/pkg/rust-micromap
Uploaded	29 days ago

New Package Report

.changes◂

Distribution	unstable
Source	rust-micromap
Version	0.3.0-1
Changed-By	Eric Dorland <eric@debian.org>
Architecture	amd64 source

Changelog◂

rust-micromap (0.3.0-1) unstable; urgency=medium
 .
   * Package micromap 0.3.0 from crates.io using debcargo 2.8.4

.dsc◂

Section	rust
Priority	optional
Component	main
Package-List	librust-micromap-dev deb rust optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: micromap
Upstream-Contact: Yegor Bugayenko
Source: https://github.com/yegor256/micromap

Files: *
Copyright: 2023-2026 Yegor Bugayenko
License: MIT

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Eric Dorland <eric@debian.org>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 24 days ago.

Report◂

DFSG NEW review for rust-micromap version 0.3.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 1 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable

Licensing

The whole upstream tree is under the MIT licence (SPDX SPDX-License-Identifier: MIT headers in every source file, LICENSE.txt, LICENSES/MIT.txt, and the REUSE.toml override), which is DFSG-compliant, and debian/copyright is in DEP-5 format with the full MIT text. But the Files: * stanza credits only Yegor Bugayenko, while several files additionally carry SPDX-FileCopyrightText: Copyright (c) 2025 owtotwo; that co-holder is not represented, so debian/copyright is incomplete.

Packaging

Clean, standard debcargo 2.8.4 output: debhelper-compat 13 with dh-sequence-cargo, correct Build-Depends-Arch profiles, a single librust-micromap-dev package with the usual Provides/versions, Multi-Arch: same, autopkgtests for all feature sets, 3.0 (quilt) with a single Debian patch, Vcs-* and upstream/metadata present, Standards-Version 4.7.4. Only minor points: a debcargo-generated patch without a DEP-3 header, and a placeholder debian/cargo-checksum.json. All runtime and test dependencies exist in the archive.

Issues

important licensing 1. debian/copyright omits the co-holder 'owtotwo' present in several files ◂

Files: debian/copyright (Files: * stanza), src/set/union.rs:2, src/set/bitand.rs:2, src/map/methods.rs:2, tests/random.rs:2, benches/bench.rs:2
Evidence: debian/copyright Files: * has Copyright: 2023-2026 Yegor Bugayenko, but e.g. src/set/union.rs line 2 reads // SPDX-FileCopyrightText: Copyright (c) 2025 owtotwo (same in src/set/{bitand,difference,eq,extend,intersection,sub,symmetric_difference}.rs, src/map/methods.rs, tests/random.rs, benches/bench.rs, examples/lru_cache.rs and four .github/workflows files).
Problem: The Copyright field of a Files paragraph must record all copyright holders of the matched files (debian/copyright machine-readable format, Policy 12.5). With owtotwo present in the file notices but absent from debian/copyright, the file does not accurately and completely describe the copyright of the source. debcargo's own hint (debian/copyright.debcargo.hint) already listed this holder, so the information was dropped when the hint was turned into the final file.
Fix: Add 2025 owtotwo to the Copyright field of the Files: * stanza (or add a separate Files paragraph for the affected files) so both holders are recorded; only the holder is missing, the MIT licence attribution itself is correct.

minor packaging 2. debian/cargo-checksum.json is a placeholder, not the crate's checksums ◂

Files: debian/cargo-checksum.json
Evidence: The file contains {"package":"Could not get crate checksum","files":{}}.
Problem: debcargo normally writes the crate's package checksum and the per-file sha256 map here; dh-cargo installs this as the registry crate's .cargo-checksum.json, and an empty map means the unpacked source is not checked against upstream checksums. The placeholder shows debcargo could not reach crates.io when the package was generated, so the recorded checksum is meaningless.
Fix: Regenerate with crates.io reachable (re-run debcargo) so the real package checksum and file map are written, or ship the checksum obtained from the .crate.

minor packaging 3. debian/patches/relax-deps.patch has no DEP-3 header ◂

Files: debian/patches/relax-deps.patch, debian/patches/series
Evidence: The patch begins directly with Index: micromap/Cargo.toml; there is no Description:, Author:, Origin: or Forwarded: field.
Problem: DEP-3 (Patch Tagging Guidelines, referenced by Policy 4.3) expects at least a Description and, where applicable, Forwarded/Origin, so a later maintainer can tell why the patch exists and whether it was sent upstream. The patch's purpose — relaxing the dev-dependencies and the rand API use to the versions in Debian — is only inferable from its diff.
Fix: Prepend a short DEP-3 header (e.g. Description: Use rand 0.10 and drop unavailable dev-dependencies, Forwarded: not-needed).

Verified ◂

Read debian/ in full: control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, cargo-checksum.json, watch, source/format, tests/control, upstream/metadata, patches/{series,relax-deps.patch}.
Grepped the whole upstream tree (excluding .pc/) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU, Apache, Mozilla Public, public domain, All rights reserved, BSD, ISC and copyleft: the only licence found anywhere is MIT.
Every source file sampled (src/lib.rs, src/map.rs, src/set.rs, src/map/, src/set/, tests/, benches/bench.rs, examples/lru_cache.rs, rebuild_benchmark.sh, .gitattributes, .gitignore, .rultor.yml, .github/workflows/) carries SPDX-License-Identifier: MIT; LICENSE.txt and LICENSES/MIT.txt are the MIT text; REUSE.toml overrides data/doc files (Cargo.lock, *.json, *.md, *.txt) to MIT.
No binary files in the tree (no .jar/.so/.a/.pyc/fonts/images); listed the orig tarball and confirmed it matches the unpacked tree, no repacking and no Files-Excluded needed.
No embedded third-party code copies; the crate has one optional dependency, serde.
Checked dependencies against the archive: librust-serde-dev 1.0.229 (>= 1.0.228 satisfied), librust-rand-dev 0.10.3+ds-1 (provides librust-rand-0.10+default-dev, matches the patch), librust-hashbrown-dev 0.16.1, librust-litemap-dev 0.8.2, librust-uuid-dev 1.26.1, librust-bincode-dev 2.0.1 — all exist.
Source format 3.0 (quilt); changelog version 0.3.0-1, distribution unstable, date 2026-10-09, no bug closures; dh rules uses --buildsystem cargo with debhelper-compat 13; autopkgtest control covers default/all-features/serde/std/none.
uscan found the packaged version as the newest upstream release (upstream 0.3.0, packaged 0.3.0).

Not confirmed ◂

Whether the placeholder debian/cargo-checksum.json breaks the dh-cargo build or the installed crate's checksum verification; a build (or building a dependent crate) would show it.
Whether tests/random.rs compiles against Debian's rand 0.10.3 after the patch (it uses rand::RngExt and rand::rngs::SmallRng); a build/autopkgtest would confirm, but nothing in the package suggests an error and I could not build.

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Hi,

A couple of very minor issues in the full review detail. It would be interesting to understand whether the "debian/cargo-checksum.json" issue is a real thing, or a problem we should tell the LLM to ignore on Rust packages.

Thanks!

Back to Dashboard | View all reviews for this package