DFSG NEW review for rust-object-store version 0.14.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is in DEP-5 format with a Files: * stanza (Apache-2.0, 2020-2026 The Apache Software Foundation) and a Files: debian/* stanza, with the full licence referred to /usr/share/common-licenses/Apache-2.0. All 59 Rust source files, README.md, dev/release/README.md and Cargo.toml.orig carry the ASF Apache-2.0 header; LICENSE.txt is the Apache-2.0 text and NOTICE.txt states the same holder and years as the copyright file. No other holder, licence notice or non-free term occurs in the tree, and the MIT alternative recorded in Cargo.toml is documented in the copyright file's Comment and is not needed because every file grants Apache-2.0.

Packaging

Standard debcargo packaging: debhelper compat 13 with dh-sequence-cargo, a Build-Depends-Arch matching the default-feature build dh-cargo performs, a complete Depends/Provides set for the 19 features in the patched Cargo.toml, Standards-Version 4.7.4 (current against Policy 4.7.4.1), DEP-3 patches that lower dependency versions to Debian's, autopkgtest entries for default, fs and --all-features, and a sound changelog. The removed cloud features, the dependency backports and the deleted wasm/windows targets are explained in debian/README.source and debian/changelog; I found no policy violation or quality problem.

Issues

None.

Verified

• Read debian/copyright in full: DEP-5 with Format:, Upstream-Name: object_store, Source:, Files: * (Apache-2.0, 2020-2026 The Apache Software Foundation), Files: debian/* and a stand-alone License: Apache-2.0 paragraph pointing at /usr/share/common-licenses/Apache-2.0.
• All 59 .rs files under src/ carry the ASF header (Licensed to the Apache Software Foundation (ASF) ... under the Apache License, Version 2.0) at line 4; README.md, dev/release/README.md and Cargo.toml.orig carry the same header. LICENSE.txt is the unmodified Apache-2.0 text and NOTICE.txt is Copyright 2020-2026 The Apache Software Foundation.
• The prescan author check scanned all 66 upstream files and found every holder named in debian/copyright; my own grep for Copyright/(C)/SPDX/licence wording across the tree found only the ASF header, the Apache-2.0 licence text and the NOTICE, so no further holder or licence stanza is needed.
• Cargo.toml and Cargo.toml.orig say license = "MIT/Apache-2.0"; the files themselves grant Apache-2.0 only, and the copyright Comment records why Debian distributes under Apache-2.0, so electing that option is accurate rather than an omission.
• No compiled, minified, archive, font or image files exist in the tree; Cargo.lock is cargo metadata, not a build product, and dh-cargo deletes it before installing (rm_files("Cargo.lock") in cargo.pm). No vendored third-party code is present.
• dh-cargo's get_sources/install copies NOTICE.txt and LICENSE.txt into /usr/share/cargo/registry/object_store-0.14.2/, so Apache-2.0 section 4(d) retention is satisfied.
• Packaging files read in full: control, rules, changelog, debcargo.toml, README.source, source/format, tests/control, upstream/metadata and all eight patches; manual patches (itertools, nix, test-dependencies, provider-only-dependencies, network-dependency-compat, http-connector-example) have DEP-3 Description/Forwarded/Last-Update headers, the two auto/*.patch are debcargo-generated.
• Every librust-* relationship checked exists in unstable at a satisfying version: itertools 0.14.0, nix 0.30.1, quick-xml 0.38.4, reqwest 0.13.5, rand 0.10.3, md-5 0.11.0, base64 0.22.1, thiserror 2.0.21, http-body-util 0.1.5, hyper-util 0.1.19, serde-urlencoded 0.7.1, futures-executor 0.3.34, tempfile 3.27.0, regex 1.13.1; rustc 1.97/1.98 satisfies the 1.85 constraints and the Breaks: rustc (<< 1.85~) (the same field form appears on librust-rand-dev and librust-reqwest-dev).
• The 19 Provides feature names match exactly the features of the patched Cargo.toml (7 explicit plus 12 implicit optional-dependency features), and Depends covers every normal and optional dependency including the chrono/serde, quick-xml serialize/overlapped-lists, rand std/std-rng/thread-rng and reqwest http2/rustls/stream feature packages.
• debian/tests/control Depends match Cargo.toml's dev-dependencies (futures-executor, hyper server, hyper-util, nix fs, rand, regex, reqwest gzip, tempfile); Testsuite: autopkgtest and Testsuite-Triggers are present in the .dsc; the flaky marks follow from the test_is_broken settings in debcargo.toml.
• The filter_targets/remove_features debcargo settings are evidenced by the applied auto/*.patch, which remove the wasm/windows targets and the aws/azure/gcp/ring/aws-lc-rs features; debian/README.source documents the resulting feature scope and the validation runs.
• uscan found the packaged version as the newest upstream release (upstream 0.14.2, packaged 0.14.2).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

None.

Proposed changes

None.