• Files: debian/tests/control:1-14, src/lib.rs:168-170, Cargo.toml:66

• Basis: checked, in the package or with a reference tool

• Evidence:

  Test-Command: /usr/share/cargo/bin/cargo-auto-test nostr-memory 0.45.2 --all-targets --all-features
  Restrictions: allow-stderr, flaky
  

  and in src/lib.rs: ```
  #[cfg(test)]
  mod tests {
  use nostr_database_test_suite::database_unit_tests;

  while the shipped manifest ends with an empty `[dev-dependencies]` (`Cargo.toml:66`).
  

• Problem: --all-targets makes cargo test compile src/lib.rs's #[cfg(test)] mod tests, which imports nostr_database_test_suite. That crate is a workspace-only path dependency that was stripped when the crate was published to crates.io, so it is not in the crate's [dev-dependencies] and does not exist in Debian: the import is an E0432/E0433 error, and impl Deref for TestDatabase is E0405 because Deref is not in scope. /usr/share/cargo/bin/cargo-auto-test swallows only E0463+E0465 and E0554 failures, so it reports these. Restrictions: flaky does not make a compile error pass, and debian/debcargo.toml itself records that the target cannot be built (test_is_broken = true), so the three stanzas fail on every autopkgtest run and the package will not migrate to testing.

• Fix: Remove the three stanzas until the test suite can build, or change them to cargo-auto-test nostr-memory 0.45.2 without --all-targets (which only compiles the library), or add a DEP-3 patch that drops the broken #[cfg(test)] mod tests and forward it upstream.

Verified

• Whole tree read (11 upstream files): LICENSE is the MIT text, Cargo.toml has license = "MIT", and grepping the tree for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public License, GNU Lesser, Apache License, Mozilla Public, public domain, All rights reserved found hits only in LICENSE and debian/*; the four src/*.rs files carry no notice of their own.
• Prescan author check: every holder it found is named in debian/copyright — 2022-2023 Yuki Kishimoto and 2023-present Nostr Dev Kit Developers in LICENSE are both in Files: * (the 2023-2026 there versus 2023-present is year drift, not a missing holder).
• Files: * is the only stanza matching upstream files and Files: debian/* follows it, so it overrides for debian/; nothing was removed from the crates.io tarball, so no Files-Excluded is needed, and debian/copyright includes the full MIT text rather than pointing at /usr/share/common-licenses.
• debian/copyright.debcargo.hint is debcargo's hint file: its FIXME (overlay) placeholders are resolved in the real debian/copyright, it is covered by Files: debian/*, and it is installed nowhere.
• The prescan listed no built files, minified code, PDFs, images or non-free wording, and none are in the tree; Cargo.lock and .cargo_vcs_info.json are generated data covered by Files: *. There are no LICENSE/COPYING/NOTICE/AUTHORS files in subdirectories and no vendored third-party code.
• <!nocheck> on every Build-Depends-Arch entry is correct for this source-only -dev package: dh-cargo's sub build (/usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm) only copies sources for a lib package, and the crate is compiled solely by cargo build/cargo test in sub test, i.e. in dh_auto_test, which compat 13 skips under nocheck.
• debian/rules's override_dh_auto_test: dh_auto_test -- test --all || true is the workaround for test_is_broken = true in debian/debcargo.toml, whose comment explains the broken test target; because dh-cargo compiles the crate in the test step, this does mean the build does not verify compilation itself.
• Standards-Version 4.7.4 matches Policy 4.7.4.1's first two components and is current; debhelper-compat (= 13) with dh-sequence-cargo is right, and ${misc:Depends} is present (not required at compat 13).
• librust-tokio+sync-dev (>= 1.37) is satisfied: the virtual package is provided by librust-tokio-dev 1.53.2-1 with that version.
• debian/changelog: 0.45.2-1, unstable, urgency medium, and Fri, 13 Nov 2026 is that date's weekday; DEP-14 Vcs-Git/Vcs-Browser with [src/nostr-memory], Section: rust, Multi-Arch: same, the Provides list and Breaks: rustc (<< 1.85.0~) are debcargo's standard form.
• debian/source/format is 3.0 (quilt) with no debian/patches, so nothing to review there; debian/watch left to the separate uscan check.
• uscan found the packaged version as the newest upstream release (upstream 0.45.2, packaged 0.45.2).

Not confirmed

• librust-btreecap-0.1+default-dev, librust-nostr-0.45+std-dev and librust-nostr-database-0.45-dev are in neither the package lists (as of 2026-11-13) nor the NEW queue, so nothing in the tool's lists satisfies those Build-Depends-Arch/Depends entries; they may have been accepted since, and the build would stop immediately if they were not.
• Whether flaky is a restriction the installed autopkgtest recognises could not be checked: autopkgtest is not installed on the reviewing system and the copy of the autopkgtest spec in Policy 4.7.4.1 is an older one that does not define it. Either way the stanzas cannot pass for the reason given in the issue.

Proposed changes

None.