DFSG NEW review for rust-planus-lexer version 1.3.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every file in the source is covered by debian/copyright, which is DEP-5, and the terms are DFSG-free. Upstream is dual-licensed MIT OR Apache-2.0, matching Cargo.toml (license = "MIT/Apache-2.0") and the two shipped licence files; LICENSE-MIT names the single holder, 2021 The Planus Project Developers, which is exactly what the Files: * stanza says. The MIT text is reproduced in full and Apache-2.0 is referenced from /usr/share/common-licenses. No vendored third-party code, no non-free terms, no binaries or generated files lacking their sources.

Packaging

This is a clean, unmodified debcargo 2.8.4 upload of a single-crate library: compat 13 with dh-sequence-cargo, correct Architecture/Multi-Arch and relationship fields, all build and test dependencies satisfiable in the archive, autopkgtest tests present, sane changelog and Vcs-* fields, and no patches or maintainer scripts are needed. Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 at two components. No packaging issues worth reporting were found.

Issues

None.

Verified

• Prescan: it flagged no file and no missing holder (Result: every holder found is named in debian/copyright). The only copyright notice in the tree is LICENSE-MIT:3 Copyright (c) 2021 The Planus Project Developers, which the Files: * stanza names verbatim; LICENSE-APACHE carries the bare Apache-2.0 text with no holder line.
• Full inventory (glob with gitignore: false, hidden files included): 11 upstream files — src/{lib,error,full_lexer,raw_lexer,text_lexer}.rs, Cargo.toml, Cargo.toml.orig, Cargo.lock, LICENSE-APACHE, LICENSE-MIT, .cargo_vcs_info.json — and 11 files under debian/. I read all five src/*.rs files in full; they are hand-written Rust with no embedded third-party code and no non-free wording.
• No built, minified, binary, PDF, font or image files exist in the tree; nothing in it is generated code whose input is missing. .cargo_vcs_info.json and Cargo.lock are shipped by cargo package upstream and are plain text under the same licence.
• No embedded copies of third-party code: codespan, derive_more and logos are ordinary Cargo dependencies resolved to Debian packages, and Cargo.lock lists only crates.io registry entries.
• debian/copyright: starts with the exact copyright-format 1.0 URL; Files: * followed by Files: debian/* (so the Debian stanza correctly overrides the catch-all for every depth below debian/); MIT-or-Apache-2.0 matches Cargo.toml and the two LICENSE files; the MIT text in the file matches LICENSE-MIT including its layout; Apache-2.0 is referenced as /usr/share/common-licenses/Apache-2.0, which exists.
• debian/copyright.debcargo.hint still has debcargo's FIXME (overlay) UNKNOWN-AUTHORS placeholders, but it is debcargo's input template, not the shipped copyright file: it is not installed into any binary package, and it is itself covered by Files: debian/*. debian/copyright has real values and no FIXME text, so it is not an inaccuracy in the licensing statement.
• The unpacked tree matches the source package: contents of rust-planus-lexer_1.3.0.orig.tar.gz (top-level planus-lexer-1.3.0/) and rust-planus-lexer_1.3.0-1.debian.tar.xz are exactly the files present, and .pc/ (empty quilt series, applied-patches empty) is not in either tarball. There are no patches and no debian/patches directory.
• Dependencies: librust-codespan-0.13+default-dev (>= 0.13.1) is provided by librust-codespan-dev 0.13.1-1, librust-derive-more-2+default-dev/+is-variant-dev (>= 2.1.1) by librust-derive-more-dev 2.1.1-1, librust-logos-0.16+default-dev by librust-logos-dev 0.16.1-1 (all via the apt-cache tool), and rustc 1.97.1/1.98.1 satisfies rustc:native (>= 1.88), matching rust-version = "1.88" and Breaks: rustc (<< 1.88~).
• dh-cargo's build step only copies the crate sources and compilation happens in test (sub build/sub test in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm), so <!nocheck> on cargo, rustc and the crate deps in Build-Depends-Arch is consistent, and at compat 13 dh skips the override_dh_auto_test target under nocheck.
• Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: first two components equal, so not an issue. Changelog is unstable, 1.3.0-1, initial upload closing an ITP, signed by the sole Uploader on a correctly dated Friday; Vcs-Git/Vcs-Browser (debcargo-conf subdirectory) and Homepage agree with the control fields and upstream/metadata.
• debian/tests/control provides three autopkgtest runs (all features, default, no default features) against dh-cargo; the package has no maintainer scripts, no install/links/docs/dirs files, and needs none.
• uscan found the packaged version as the newest upstream release (upstream 1.3.0, packaged 1.3.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• The third autopkgtest entry (--no-default-features) carries Architecture: !riscv64 with no comment. I could not check why; it withholds one test run on one architecture and is not a packaging fault.
• The ITP number in the changelog (#1151237) could not be checked, as the BTS is not reachable from the reviewing environment.

Proposed changes

None.