DFSG NEW Queue

DFSG, Licensing & New Packages Team

rust-nostr 0.45.6-1

Package Information

DescriptionNostr protocol - Rust source code

Source code for Debianized Rust crate "nostr"

MaintainerDebian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed ByYing-Chun Liu (PaulLiu) <paulliu@debian.org>
Sponsorpaulliu@debian.org
Distributionunstable
Architectureany
VCSgit: https://salsa.debian.org/rust-team/debcargo-conf.git [src/nostr] (browse)
Trackerhttps://tracker.debian.org/pkg/rust-nostr
Uploaded3 hours ago

New Package Report

.changes◂
Architectureamd64 source
Distributionunstable
Sourcerust-nostr
Version0.45.6-1
Changed-ByYing-Chun Liu (PaulLiu) <paulliu@debian.org>
Changelog◂ 
rust-nostr (0.45.6-1) unstable; urgency=medium
 .
   * Package nostr 0.45.6 from crates.io using debcargo 2.8.3
.dsc◂
Package-Listlibrust-nostr-dev deb rust optional arch=any
Sectionrust
Priorityoptional
Componentmain
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: nostr
Upstream-Contact:
 Yuki Kishimoto <yukikishimoto@protonmail.com>
 Nostr Dev Kit Developers
Source: https://github.com/nostrdevkit/nostr.git

Files: *
Copyright:
 2022-2023 Yuki Kishimoto <yukikishimoto@protonmail.com>
 2023-2026 Nostr Dev Kit Developers
 2023-2026 Rust Nostr Developers
 2021 Paul Miller
License: MIT

Files: src/nips/nip11.rs
Copyright:
 2022 Thomas (0xtlt)
 2022-2023 Yuki Kishimoto <yukikishimoto@protonmail.com>
 2023-2025 Rust Nostr Developers
License: MIT

Files: src/nips/nip06/bip32.rs
Copyright:
 2022-2023 Yuki Kishimoto <yukikishimoto@protonmail.com>
 2023-2026 Nostr Dev Kit Developers
 2023-2026 Rust Nostr Developers
License: CC0-1.0

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: CC0-1.0
 Debian systems provide the CC0 1.0 Universal License in
 /usr/share/common-licenses/CC0-1.0

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 3 hours ago.

Report◂

DFSG NEW review for rust-nostr version 0.45.6-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 1 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 and accounts for the whole tree: Files: * (MIT) names all four holders that the file headers carry (Yuki Kishimoto, Nostr Dev Kit Developers, Rust Nostr Developers and 2021 Paul Miller), src/nips/nip11.rs adds Thomas (0xtlt), src/nips/nip06/bip32.rs is correctly singled out as CC0-1.0 (its only header is // SPDX-License-Identifier: CC0-1.0), and debian/* has its own stanza. The full MIT text is included, the CC0 paragraph points at /usr/share/common-licenses/CC0-1.0, which exists, and the tarball is the unrepacked crates.io crate, so there is nothing to exclude. No non-free wording, and no file without a licence, was found anywhere in the tree.

Packaging

Standard, clean debcargo 2.8.3 output: compat 13 with dh $@ --buildsystem cargo, correct Build-Depends/Build-Depends-Arch split, every dependency and feature package exists in the archive at a version the relaxed requirements accept, and Breaks: rustc (<< 1.85.0~) matches rust-version = 1.85.0. The three patches carry DEP-3 headers and adapt the code to the versions Debian actually has (secp256k1 0.33.1, faster-hex 1.0.0). The only thing a sponsor would ask for is the ITP bug number in the changelog.

Issues

minor packaging 1. Initial-changelog entry does not close the ITP bug (no Closes: line) ◂
  • Files: debian/changelog:1-6
  • Basis: checked, in the package or with a reference tool
  • Evidence: * Package nostr 0.45.6 from crates.io using debcargo 2.8.3 with no Closes: #NNNNNN in the entry for 0.45.6-1.
  • Problem: This is the first upload of a new source package, so an ITP bug is filed against wnpp; without a Closes: line the upload leaves it open and the package is not linked to its intent, which ftp-master and the BTS expect of an initial upload.
  • Fix: Add Closes: #<itp> to the 0.45.6-1 changelog entry.
Verified ◂
  • Licensing, whole tree (111 files): every .rs file carries only Copyright (c) 2022-2023 Yuki Kishimoto, Copyright (c) 2023-2025 Rust Nostr Developers, Copyright (c) 2021 Paul Miller and/or Copyright (c) 2022 Thomas (0xtlt) with Distributed under the MIT software license; the only SPDX header in the tree is src/nips/nip06/bip32.rs SPDX-License-Identifier: CC0-1.0. All of these holders are named in debian/copyright, and the 2023-2026 ranges there cover src/nips/nip66.rs (2026 Rust Nostr Developers) and src/nips/nip51.rs (2023-2025).
  • LICENSE is the MIT text with Copyright (c) 2022-2023 Yuki Kishimoto / Copyright (c) 2023-present Nostr Dev Kit Developers; the MIT text is reproduced in the stand-alone License: MIT paragraph, and /usr/share/common-licenses/CC0-1.0 exists for the CC0 pointer.
  • No DFSG problem found: grep over the tree for non-commercial, no-modification, field-of-use, CC-BY-NC/ND, GNU/Apache/MPL wording found nothing; no file lacks a licence statement, the later src/nips/nip11.rs, src/nips/nip06/bip32.rs and debian/* stanzas override Files: * in the right order, and MIT and CC0-1.0 are compatible in one binary.
  • rust-nostr_0.45.6.orig.tar.gz is the crates.io crate unmodified (Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, CHANGELOG.md, README.md, LICENSE, examples/, src/); nothing was removed, so no Files-Excluded is needed and none is claimed.
  • src/nips/nip44/nip44.vectors.json is the NIP-44 test-vector data (included with include_str! in v2.rs tests), plain JSON, covered by Files: *; Cargo.lock and .cargo_vcs_info.json are crates.io metadata files, neither built nor generated from missing sources.
  • debian/copyright.debcargo.hint is debcargo's generated template; it is not installed by any package, its UNKNOWN-LICENSE; FIXME (overlay) placeholders are superseded by the reviewed debian/copyright, and its per-file holder list agrees with the final file.
  • Dependencies checked in the archive: librust-secp256k1-dev 0.33.1, librust-faster-hex-dev 1.0.0, librust-bech32-dev 0.11.0 (provides +alloc/+std), librust-bitcoin-hashes-dev 1.0.0, librust-bip39-dev 3.0.0 (provides +std), librust-opaquerr-dev 0.2.0, librust-rand-dev 0.10.3 (provides +sys-rng), librust-universal-time-dev 0.3.1, librust-aes-0.8-dev 0.8.4, librust-cbc-0.1-dev 0.1.2, librust-chacha20-0.9-dev 0.9.1, librust-chacha20poly1305-0.10-dev 0.10.1, librust-scrypt-dev 0.12.0, librust-zeroize-dev 1.9.0, librust-url-dev 2.5.8, librust-unicode-normalization-dev 0.1.26, librust-reqwest-0.12-dev 0.12.28, librust-tokio-dev 1.53.2, and dh-sequence-cargo is provided by dh-cargo 34.
  • Build-Depends-Arch covers exactly the non-optional dependencies and the enabled std/alloc feature dependencies of the default build; the dev-dependencies (reqwest, tokio) are rightly only in debian/tests/control, because dh_auto_test for the cargo buildsystem runs cargo build (sub test in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm), not cargo test.
  • debian/patches: three patches with Description/Author/Last-Update/Forwarded headers; 0001 relaxes Cargo.toml version ranges to the versions Debian has, 0002 adapts to the context-free secp256k1 0.33 API and 0003 to faster-hex 1.0's hex_decode_array; each matches the security-relevant version in the archive (0.33.1, 1.0.0) and keeps the previous error/validation behaviour.
  • debian/control: Standards-Version 4.7.4 (the Policy here is 4.7.4.1, so current), debhelper compat 13 via debhelper-compat, Multi-Arch: same on the -dev package, Breaks: rustc (<< 1.85.0~) matching rust-version = 1.85.0, Provides covering the crate's compatible names and every feature, Vcs-Git/Vcs-Browser in debcargo-conf style, source format 3.0 (quilt).
  • debian/tests/control holds 17 debcargo-generated entries; the --all-targets --all-features one is the only one without Restrictions: flaky, so the fullest test is the strict one.
  • uscan found the packaged version as the newest upstream release (upstream 0.45.6, packaged 0.45.6).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC0-1.0).
Not confirmed ◂
  • upstream requires bip39 ^2.1 but Debian ships 3.0.0; nip06/mod.rs calls Mnemonic::parse_normalized and to_seed_normalized, and the 3.0.0 source is not available on this system, so I could not confirm those still exist there.
  • patch 0002 assumes SecretKey::from_secret_bytes, SecretKey::to_secret_bytes, XOnlyPublicKey::to_byte_array/from_byte_array, Keypair::from_secret_key(&sk) without a context and secp256k1::schnorr::verify are in secp256k1 0.33.1; Debian's secp256k1 source is not installed here, so I could not check the signatures.
  • every feature test except --all-features carries Restrictions: flaky while debcargo.toml only marks the feature sets without alloc/std as test_is_broken; I could not check whether collapse_features = true makes debcargo mark all tests of the collapsed binary flaky, so I did not report it.
Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 2 hours ago.

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
0.45.6-1 f44a1460… 2026-11-03 17:47 2026-11-03 17:47 dfsg-uploader rejected VIEW

Back to Dashboard | View all reviews for this package