DFSG NEW review for rust-planus-codegen version 1.3.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the current Format URL. The whole upstream tree is dual-licensed MIT or Apache-2.0 (Cargo.toml license = "MIT/Apache-2.0", LICENSE-MIT and LICENSE-APACHE), the Files: * Copyright matches the notice in LICENSE-MIT (2021 The Planus Project Developers), the full MIT text is reproduced and Apache-2.0 is referenced to /usr/share/common-licenses. A later debian/* stanza covers the packaging. No file carries a different notice, no non-free wording exists anywhere, and the prescan's author check found no holder missing from the file.

Packaging

Debcargo-generated packaging of good quality: dh compat 13 with dh-sequence-cargo, correct Build-Depends-Arch/Depends split at the exact crate versions, Multi-Arch: same and the Breaks on old rustc as debcargo emits them, Standards-Version 4.7.4 (current 4.7.x), sane initial changelog closing the ITP, Vcs-* and upstream/metadata present, and three autopkgtests using dh-cargo's cargo-auto-test. The two patches only relax askama and vec_map to the versions Debian ships, have DEP-3 headers, and are explained in debian/README.source; their rationale checks out against the source (VecMap uses only API available in 0.8.1). All build and test dependencies resolve in the archive or in NEW (planus-types).

Issues

None.

Verified

• Prescan: it singled out no files; its author check reports every holder found is named in debian/copyright (3 declared authors). Nothing to account for file by file.
• Tree inventory (27 files, .pc/ and debian/cargo-checksum.json excluded): Cargo.toml, Cargo.toml.orig, Cargo.lock, askama.toml, .cargo_vcs_info.json, LICENSE-MIT, LICENSE-APACHE and src/ (5 modules, 12 askama .template files). All text; no built binaries, minified files, PDFs, fonts or archives.
• Licence evidence: grepping the whole tree for Copyright/(C)/©/SPDX/Licensed under/Permission is hereby granted/GNU/Apache/MPL/public domain/All rights reserved found notices only in LICENSE-MIT (Copyright (c) 2021 The Planus Project Developers) and the Apache text; no per-file headers differ. So Files: * -> MIT or Apache-2.0 and the collective holder are accurate for every upstream file.
• LICENSE-APACHE is the standard Apache License 2.0 text (sections 1-9, 177 lines, no additional terms); LICENSE-MIT is verbatim MIT matching the License: MIT paragraph in debian/copyright.
• Templates in src/templates/{rust,dot}/*.template are hand-written askama input referenced from src/templates.rs (template_module!); no third-party provenance and covered by Files: *.
• Cargo.lock and .cargo_vcs_info.json are cargo/crates.io metadata from the upstream tarball, not copyrightable source; the dh-cargo buildsystem's configure removes Cargo.lock before the crate is installed into the registry (that stale lock, still naming askama 0.15.1 / vec_map 0.8.2, therefore never reaches a binary).
• Dependencies checked with apt-cache: librust-askama-dev 0.16.1-1 provides librust-askama-0.16+default-dev; librust-vec-map-dev 0.8.1 provides librust-vec-map-0.8+default-dev; librust-thiserror-dev 2.0.21; librust-random-color-dev 1.1.0; librust-heck-dev 0.5.0; librust-eyre-dev 0.6.14; rustc 1.97.1/1.98.1 and dh-cargo 34. librust-planus-types-1+default-dev is not in the archive, but apt-cache reports librust-planus-types-dev is built by rust-planus-types 1.3.0-1, waiting in NEW, so it is satisfiable and not a fault.
• Patches: both are in debian/patches/series and in .pc/applied-patches, carry Description/Author/Forwarded/Last-Update headers, and change only version requirements (askama 0.15.1 -> 0.16, vec_map 0.8.2 -> 0.8.1) in Cargo.toml and the informational Cargo.toml.orig. The code's VecMap use (with_capacity, insert, index/get) is present in 0.8.1.
• Autopkgtest tests/control is the debcargo-generated form; grepping src for #[test]/#[cfg(test)] finds none, so the three cargo-auto-test runs only compile the crate, which is what debian/README.source says as well.
• debian/rules is the debcargo stub; the dh_auto_test override runs cargo test --all and (compat 13) is skipped by dh under nocheck, so Build-Depends-Arch is correctly marked <!nocheck>.
• Standards-Version 4.7.4 matches the 4.7.x Policy on this system; changelog is 1.3.0-1, unstable, initial release closing #1152608; Vcs-Git/Vcs-Browser and debian/upstream/metadata are consistent with the crates.io source and GitHub repo.
• The library shells out to rustfmt in format_string (src/rust/mod.rs:1014-1030) only when generate_rust(.., format=true) asks for it; not reported: Debian Rust library packages do not declare external tools used on one code path (cf. librust-bindgen-dev, which does not declare clang), and the error is explicit.
• uscan found the packaged version as the newest upstream release (upstream 1.3.0, packaged 1.3.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• No build or test could be run. The askama 0.15.1 -> 0.16 migration in askama-0.16.patch is declared compatible by debian/README.source and nothing in the package shows otherwise, but its compilation is assumed, not observed.
• debian/README.source describes a "separate Debian validation check" that renders and compiles generated bindings; it is not shipped in debian/tests, so that upstream-facing validation is outside this package.

Proposed changes

None.