DFSG NEW review for rust-polycool version 0.4.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable

Licensing

The crate is dual-licensed MIT OR Apache-2.0 (SPDX Apache-2.0 OR MIT in every src/*.rs header, license = "MIT OR Apache-2.0" in Cargo.toml.orig, and the standard LICENSE-MIT/LICENSE-APACHE texts). Both licences are free and compatible; no field-of-use, non-commercial or no-modification clauses. The tree contains only .rs/.toml/.md/.json sources — no binaries, minified content, fonts, images or vendored third‑party code (deps are registry packages, not embedded). debian/copyright is DEP-5 machine-readable, begins with the correct Format: line, and is accurate and complete: Files: * covers all upstream files with the right holders (Raph Levien 2018, the Kurbo Authors 2025) and dual licence, Files: debian/* covers packaging, and standalone License paragraphs carry the full MIT text and a /usr/share/common-licenses/Apache-2.0 reference.

Packaging

Standard, current debcargo 2.8.4 output: debian/rules is dh $@ --buildsystem cargo with debhelper-compat 13, Build-Depends(-Arch) use the classic <profile.nocheck> rust-team pattern, and the binary librust-polycool-dev (any, Multi-Arch: same) has correct Depends/Provides — every referenced package resolvable in the archive (librust-arrayvec-dev 0.7.8-1, librust-arbitrary-dev 1.4.2-2, librust-libm-dev 0.2.16-1, librust-arbtest-dev 0.3.2-1). The single relax-deps.patch cleanly drops criterion and the benches it needs; debian/patches/series is consistent. debian/tests/control provides six cargo-auto-test autopkgtests covering all feature combinations, with flaky/!riscv64 restrictions matching the test_is_broken flags in debcargo.toml. Changelog, debian/upstream/metadata and Vcs-* fields (salsa debcargo-conf) are all in order.

Issues

None.

Verified ◂

• Read the full tree: top level (Cargo.toml, Cargo.toml.orig, CHANGELOG.md, LICENSE-APACHE, LICENSE-MIT, README.md, .cargo_vcs_info.json, Cargo.lock), all 8 files of src/, and every debian/ file (control, rules, changelog, copyright, debcargo.toml, cargo-checksum.json, source/format, tests/control, upstream/metadata, patches/series, patches/relax-deps.patch). .pc/ and debian/ excluded from copyright inventory; benches/ absent (deleted by the patch).
• Every upstream source file has // Copyright 2025 the Kurbo Authors + // SPDX-License-Identifier: Apache-2.0 OR MIT; LICENSE-MIT (2018 Raph Levien) and LICENSE-APACHE are the standard, complete texts; no file lacks a licence or carries a different one.
• debian/copyright stanzas match the files: Files: * (MIT or Apache-2.0), Files: debian/*, standalone MIT text and common-licenses Apache-2.0 reference; DEP-5 Format line is canonical.
• Read the cargo.pm dh-cargo buildsystem on the system; deps cross-checked via apt-cache: all Depends/Build-Depends names resolve to existing packages with satisfying versions.
• No vendored third-party code, embedded copies, or generated/binary artifacts: Cargo.lock lists dependencies only, and debian/cargo-checksum.json is debcargo's (empty-checksum) standard artifact.
• uscan found the packaged version as the newest upstream release (upstream 0.4.0, packaged 0.4.0).

Not confirmed ◂

• Did not execute dpkg-buildpackage or the autopkgtests here, so the build/test run was not observed; the setup matches the standard debcargo template used across the rust team.
• dh-cargo's man page is not installed on this system, so the exact dh_auto_test behaviour (build-time cargo test) could not be cross-checked; dev-dependencies for tests are declared only in tests/control, as is customary for debcargo packages.
• lintian and licensecheck results were produced separately and were not part of this review.

Proposed changes ◂

None.