DFSG NEW review for rust-planus-types version 1.3.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is dual-licensed MIT or Apache-2.0. debian/copyright is DEP-5, names 2021 The Planus Project Developers (the holder in LICENSE-MIT) for Files: , and the Debian packaging holders for debian/; the MIT text is reproduced in full and Apache-2.0 is referenced to /usr/share/common-licenses, which is permitted. No file carries a different notice, no restrictive terms were found, and the pre-review author check found no unnamed holder.

Packaging

Standard debcargo-generated packaging for a Rust library crate: compat 13 with dh-sequence-cargo, correct Build-Depends-Arch with <!nocheck>, consistent versioned librust-* dependencies, Multi-Arch: same, Provides for the crate version, autopkgtests for the library package, DEP-3 patch headers, sane changelog, and a current Standards-Version. The only remark is that debian/README.source describes a consumer check that is not part of the package.

Issues

1. [minor] [packaging] debian/README.source describes a consumer check that the package does not contain

• Files: debian/README.source:26, debian/tests/control
• Basis: checked, in the package or with a reference tool
• Evidence: README.source: "Debian validation therefore includes compilation against the packaged dependencies and a separate consumer check that constructs an ErrorRecovery with a real lexer token, embeds it in the public CST types, and checks that error data, dropped tokens and source locations are preserved." debian/tests/control contains only three cargo-auto-test stanzas; the crate has no tests (no #[test]/#[cfg(test)] in src/, and Cargo.toml sets autotests = false).
• Problem: The README claims a validation step that ships nowhere in debian/, so a later maintainer or sponsor cannot rerun the check that justifies the lalrpop-util 0.22 to 0.20 downgrade. The autopkgtests only compile the crate (cargo test --all-targets with no test targets).
• Fix: Either add the described check as a debian/tests script (constructing an ErrorRecovery and embedding it in cst::ParseError) and reference it in debian/tests/control, or amend README.source to say the check was a one-off manual verification and that the shipped tests only compile the crate.

Verified

• Read debian/copyright in full: DEP-5 format, Files: * (2021 The Planus Project Developers, MIT or Apache-2.0), Files: debian/* (Debian Rust Maintainers, Steffen Moeller, 2026), full MIT text, Apache-2.0 pointer to /usr/share/common-licenses. No Files-Excluded and none needed.
• The whole upstream tree was read: Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, LICENSE-APACHE, LICENSE-MIT and the four src/*.rs files. No copyright/licence notice appears in any src file; LICENSE-MIT carries Copyright (c) 2021 The Planus Project Developers, which is exactly the holder in the Files: * stanza.
• LICENSE-APACHE is the complete Apache License 2.0 text (sections 1-9, ending END OF TERMS AND CONDITIONS, no appendix); no additional holder is asserted in it.
• Grep of the tree for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, public domain, All rights reserved and for non-free wording (non-commercial, no modification, field of use) found nothing beyond the two LICENSE files and debian/copyright.
• Cargo.toml is the cargo-normalized form of Cargo.toml.orig, which is shipped, so the generated manifest has its preferred form present; Cargo.lock and .cargo_vcs_info.json are ordinary crates.io release metadata, covered by Files: *.
• The pre-review author check reports every holder found is named in debian/copyright; it listed no files.
• debian/copyright's debian/* stanza covers all 13 files under debian/, including the debcargo template and the patch.
• Dependencies checked with apt-cache: librust-codespan-dev 0.13.1-1, librust-indexmap-dev 2.14.2-1, librust-lalrpop-util-dev 0.20.0-1+b2 and librust-string-interner-dev 0.19.0+ds1-2 provide the +default-dev names and versions required; librust-planus-lexer-dev 1.3.0 is in the NEW queue as rust-planus-lexer 1.3.0-1, so the dependency is satisfiable.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match) is current; Rules-Requires-Root is satisfied by dpkg's default; ${misc:Depends} is present and no ${shlibs:Depends} is needed for a Rust -dev package.
• relax-deps.patch has complete DEP-3 headers (Description, Author, Forwarded: not-needed, Last-Update); the 0.22.2 to 0.20 change is a dependency-version relaxation explained in README.source and is not reported as a fault; it patches both Cargo.toml and Cargo.toml.orig consistently.
• Read /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm: its configure step deletes the shipped Cargo.lock before building and copies debian/cargo-checksum.json, so the stale lock file in the tree does not affect the build.
• changelog: version 1.3.0-1 matches the crate version and X-Cargo-Crate-Version, distribution unstable, date Fri 30 Oct 2026 consistent with its weekday.
• Vcs-Git/Vcs-Browser point at debcargo-conf with the [src/planus-types] subdirectory, as debcargo packages use.
• uscan found the packaged version as the newest upstream release (upstream 1.3.0, packaged 1.3.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Whether lalrpop-util 0.20.0's ErrorRecovery implements the traits cst::ParseError derives (Clone, Debug, Eq, PartialEq) could not be checked: no Rust crate sources are installed on the reviewing system, and there is no network. On the supplied information (README.source and the patch header) the build is assumed to pass.
• Whether the consumer check mentioned in README.source was performed manually during packaging; no artifact of it exists in the package.

Proposed changes

None.