DFSG NEW review for rust-planus-types version 1.3.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is in DEP-5 format and accurately describes the tree. Upstream is dual-licensed MIT or Apache-2.0: LICENSE-MIT carries Copyright (c) 2021 The Planus Project Developers, which is the holder in the Files: * stanza, and LICENSE-APACHE is stock Apache-2.0 with no separate holder. The MIT text is reproduced verbatim and Apache-2.0 is referred to /usr/share/common-licenses/Apache-2.0, which Policy 12.5 allows. Files: * covers every upstream file (manifests, Cargo.lock, .cargo_vcs_info.json, both LICENSE files, all of src/) and Files: debian/* covers the packaging. The sources are hand-written type definitions with no third-party code, generated code or non-free terms.

Packaging

Standard debcargo 2.8.4 output, correctly assembled: debhelper compat 13 with dh-sequence-cargo, Standards-Version 4.7.4 (current against Policy 4.7.4.1), Section rust, Architecture any with Multi-Arch: same, versioned Provides, and Build-Depends-Arch entries all marked <!nocheck>. The single patch has a complete DEP-3 header, is justified in debian/README.source, and only relaxes lalrpop-util from 0.22.2 to the 0.20 series Debian ships; dh-cargo deletes Cargo.lock at configure time, so the lock's 0.22.2 entry has no effect. Autopkgtest stanzas exist and the build-time test passes test to cargo. All dependencies resolve in the archive except planus-lexer (see Not confirmed).

Issues

None.

Verified

• debian/copyright read in full: exact copyright-format 1.0 Format: line, Files: * (2021 The Planus Project Developers, MIT or Apache-2.0), Files: debian/* (2026 Debian Rust Maintainers, 2026 Steffen Moeller), and stand-alone MIT and Apache-2.0 License paragraphs.
• Files: * covers the whole upstream tree: Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, LICENSE-APACHE, LICENSE-MIT and src/{lib,ast,cst,intermediate}.rs. Nothing else exists outside debian/ and .pc/ (full-tree listing with hidden files checked).
• LICENSE-MIT:3 Copyright (c) 2021 The Planus Project Developers matches the Files: * Copyright field; LICENSE-APACHE is unmodified Apache-2.0 text ending at END OF TERMS AND CONDITIONS with no named holder.
• Grepping src/, Cargo.toml, Cargo.toml.orig and Cargo.lock for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Apache/MIT found only Cargo.toml:35 license = "MIT/Apache-2.0"; the .rs files have no per-file notices, which the crate-level LICENSE files plus Files: * cover.
• The MIT text in debian/copyright is verbatim LICENSE-MIT; the Apache-2.0 reference to /usr/share/common-licenses/Apache-2.0 is permitted by Policy 12.5 (verbatim text required only for licences not in /usr/share/common-licenses).
• Prescan: the author check found the one holder it saw (The Planus Project Developers) named in debian/copyright and listed no individual files, so there was nothing to account for as a file-level finding.
• src/ is hand-written: lib.rs only declares ast/cst/intermediate; no build.rs, no include_str!/include_bytes!/env!, no generated parser, and no vendored third-party code. The only lalrpop-util use is use lalrpop_util::ErrorRecovery; and the two type references (src/cst.rs:2,8,39), which matches debian/README.source.
• Packaging read in full: control, rules, changelog, source/format (3.0 quilt), patches/series, patches/relax-deps.patch, tests/control, upstream/metadata, debcargo.toml, README.source, copyright.debcargo.hint. No maintainer scripts, .install/.links/.docs/dirs files exist, and debian/upstream/metadata uses valid DEP-12 fields.
• Standards-Version 4.7.4 against Policy 4.7.4.1 is current; Priority is omitted, which Policy A10.3 (4.7.3) now stops recommending in source packages.
• Dependency versions checked with apt-cache: librust-codespan-dev 0.13.1-1, librust-indexmap-dev 2.14.2-1, librust-lalrpop-util-dev 0.20.0-1+b2 and librust-string-interner-dev 0.19.0+ds1-2 provide exactly the versioned virtual packages in Build-Depends-Arch/Depends; rustc 1.97.1 and 1.98.1 in the archive satisfy rustc (>= 1.88).
• The Cargo.lock pin of lalrpop-util 0.22.2 cannot affect the build: dh-cargo's configure step calls rm_files("Cargo.lock") (checked in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm) before cargo prepare-debian, and the patch sets version = "0.20" in Cargo.toml.
• override_dh_auto_test: dh_auto_test -- test --all becomes cargo test --all via cargo.pm's test(); at compat 13 dh skips this override under nocheck, and every Build-Depends-Arch entry is correctly marked <!nocheck>.
• debian/copyright.debcargo.hint still holds debcargo's FIXME placeholders, but it is a source-only hint file and is not installed; the effective, corrected file is debian/copyright.
• The patch relaxes a dependency version only (0.22.2 to 0.20) and touches no Rust source; README.source documents the public-API consequence and the downstream adaptation.
• uscan found the packaged version as the newest upstream release (upstream 1.3.0, packaged 1.3.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• librust-planus-lexer-1+default-dev (>= 1.3.0), in both Build-Depends-Arch and Depends, is absent from the archive lists and from the NEW queues as of 2026-10-30; it is presumably the sibling planus-lexer crate from the same 1.3.0 upload, so the build depends on that package landing, and the name follows this package's own Provides scheme rather than being a misspelling.
• lalrpop-util 0.20.0's ErrorRecovery API could not be inspected (the crate source is not installed under /usr/share/cargo/registry on the reviewing system). src/cst.rs:6-9 derives Eq and PartialEq on ParseError, which contains ErrorRecovery, so the archive build is what confirms 0.20.0's derives; README.source argues the fields used exist there.

Proposed changes

None.