rust-ruby-prism-sys 2.1.0+ds-1

Package Information

Description	Rust bindings to Ruby's prism parsing library - Rust source code Source code for Debianized Rust crate "ruby-prism-sys"
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	Simon Quigley <tsimonq2@debian.org>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/ruby-prism-sys] (browse)
Tracker	https://tracker.debian.org/pkg/rust-ruby-prism-sys
Uploaded	1 hour ago

New Package Report

.changes◂

Changed-By	Simon Quigley <tsimonq2@debian.org>
Architecture	source amd64
Distribution	unstable
Date	Fri, 06 Nov 2026 20:20:39 -0600
Source	rust-ruby-prism-sys
Version	2.1.0+ds-1

Changelog◂

rust-ruby-prism-sys (2.1.0+ds-1) unstable; urgency=medium
 .
   * Package ruby-prism-sys 2.1.0 from crates.io using debcargo 2.8.4

.dsc◂

Priority	optional
Component	main
Package-List	librust-ruby-prism-sys-dev deb rust optional arch=any
Section	rust

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: ruby-prism-sys
Upstream-Contact:
 Steve Loveless <steve.loveless@gmail.com>
 Ian Ker-Seymer <hello@ianks.com>
 Kevin Newton <kddnewton@gmail.com>
Source: https://github.com/ruby/prism
Comment:
 vendor/ is excluded from the upstream tarball (+ds). The Prism C
 library is taken from the Debian ruby-prism package.

Files: *
Copyright: 2022-present, Ruby developers
License: Expat

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Simon Quigley <tsimonq2@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for rust-ruby-prism-sys version 2.1.0+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 1 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The licence is Expat/MIT throughout, the full text is included, and nothing in the tree restricts use, modification or distribution, so the package is DFSG-free. debian/copyright is DEP-5 and its stanzas and short names match upstream's license = "MIT" in Cargo.toml. It does not, however, name a copyright holder: the only upstream stanza says Copyright: 2022-present, Ruby developers, a collective that appears nowhere upstream, while Cargo.toml names three individual authors and Debian's ruby-prism records Shopify Inc. for the same repository. That inaccuracy is the only licensing defect.

Packaging

Standard debcargo packaging, in good shape: compat 13 with dh-sequence-cargo, a correct <\!nocheck> split (the build step only copies sources; everything is compiled in the test step), rust/, ruby and ruby-prism dependencies all present in both Build-Depends-Arch and the -dev package's Depends, plausible autopkgtests, current Standards-Version (4.7.4 against Policy 4.7.4.1), sane DEP-3 patches and a sensible use-system-prism approach with a correctly formed dh-cargo:deb-built-using line (Expat needs no Built-Using). One real defect: the declared ruby-prism range permits 2.1.x while the patched build script aborts unless the gem version is exactly 2.1.0, so the next 2.1.1 upload of ruby-prism breaks every build that satisfies the declared relations.

Issues

important licensing 1. Files: * names no real copyright holder ('Ruby developers') instead of the authors in Cargo.toml or Shopify Inc. ◂

Files: debian/copyright:12-14, Cargo.toml:9-13, Cargo.toml.orig:9-13, debian/copyright.debcargo.hint:11-16
Basis: checked, in the package or with a reference tool
Evidence: debian/copyright: Files: * / Copyright: 2022-present, Ruby developers. Cargo.toml: authors = ["Steve Loveless <steve.loveless@gmail.com>", "Ian Ker-Seymer <hello@ianks.com>", "Kevin Newton <kddnewton@gmail.com>"]. The debcargo hint that the maintainer replaced had FIXME (overlay) UNKNOWN-YEARS Steve Loveless ... for the same three. Debian's own record for the same repository (/usr/share/doc/ruby-prism/copyright) says Files: * / Copyright: 2022-2026 Shopify Inc..
Problem: The Expat/MIT text requires the copyright notice to be retained, and Policy 12.5 requires debian/copyright to record the copyright holders. 'Ruby developers' is not an entity named by upstream and identifies nobody: it neither matches the three authors the crate declares nor the holder Debian records for ruby/prism, from which the shipped bindings and doc comments derive. The file therefore misdescribes who holds copyright in the source it covers.
Fix: Replace the holder with the people Cargo.toml names (Steve Loveless, Ian Ker-Seymer, Kevin Newton, with the years from upstream git history) and, since src/bindings.rs is bindgen output over prism's headers, add Shopify Inc. (as in Debian's ruby-prism copyright) to the same or a separate stanza.

minor packaging 2. ruby-prism range allows any 2.1.x, but the patched build script aborts unless the gem is exactly 2.1.0 ◂

Files: debian/control:11-12, debian/control:29-30, debian/debcargo.toml:8, debian/patches/use-system-prism.patch
Basis: checked, in the package or with a reference tool
Evidence: control: ruby-prism (>= 2.1.0) <!nocheck>, ruby-prism (<< 2.2.0) <!nocheck> and the same in Depends. use-system-prism.patch, system_prism_root(): abort('prism gem version mismatch') unless s.version.to_s == ENV.fetch('CARGO_PKG_VERSION'), with CARGO_PKG_VERSION = 2.1.0.
Problem: The declared relations and the enforced condition disagree. Any ruby-prism 2.1.1 to 2.1.99 satisfies Depends and Build-Depends-Arch, so the -dev package stays installed and buildable-looking, yet the build script of this crate and of every package depending on it panics with 'prism gem version mismatch' — a failure that cannot be fixed by the dependent package. Today's archive has only 2.1.0-1 (apt-cache), so nothing is broken yet.
Fix: Make the two agree: bound the relation to the gem version actually supported, e.g. ruby-prism (>= 2.1.0), ruby-prism (<< 2.1.1) in debian/debcargo.toml and debian/control, or relax the check in the patch to compare major.minor (or to the same range the packaging declares).

Verified ◂

Full upstream tree read (Cargo.toml, Cargo.toml.orig, Cargo.lock, README.md, .cargo_vcs_info.json, build/main.rs, build/vendored.rs, src/lib.rs) plus the head and tail of the 12163-line src/bindings.rs; no .gitignore exists and nothing was hidden from the search.
No file in the tree carries a copyright notice, SPDX tag or licence statement: grep for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/All rights reserved/public domain matched only #[repr(C)] in src/bindings.rs. There is no LICENSE/COPYING/NOTICE/AUTHORS file in the crate; Cargo.toml declares license = "MIT", which is the Expat text debian/copyright reproduces in full.
src/bindings.rs is pregenerated bindgen output (/* automatically generated by rust-bindgen 0.73.2 */), regenerable from the allowlist in build/main.rs, which ships; it contains only type/function declarations and doc comments copied from prism's headers, with no third-party licence text (grep for onigmo/ICU/licence terms: nothing), and Expat covers it.
build/main.rs and build/vendored.rs are ordinary upstream build scripts; after use-system-prism.patch the C sources come from Debian's ruby-prism gem at build time rather than from vendor/, so no prism source is redistributed here.
The +ds repack is clean: vendor/ is absent from the tree and is the only entry in the orig tarball's exclusion set; Cargo.toml's include still lists vendor, which is harmless. debian/copyright's Comment explains the removal.
debian/patches: three patches, all applied (per .pc/Cargo.toml); the two hand-written ones carry DEP-3 headers (Description, Author, Origin: vendor, Forwarded, Last-Update), the third is the debcargo-generated feature removal. relax-deps.patch is not obsolete: librust-shlex-2-dev does not exist in the archive (apt-cache), only librust-shlex-dev 1.3.0.
The stale Cargo.lock (bindgen 0.73.2, shlex 2.0.1) is not a problem: the cargo buildsystem in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm runs rm_files("Cargo.lock") in its configure step, and cc 1.0 / shlex 1.3 requirements resolve against librust-cc-dev 1.2.60 and librust-shlex-dev 1.3.0.
The <!nocheck> annotations on all of Build-Depends-Arch are right: with dh-cargo the build step only copies sources, and at compat 13 dh skips the dh_auto_test override under nocheck, so rustc/cargo/the crates are only needed for the test step.
debian/tests/control is the debcargo-generated three-test set; @ pulls the runtime Depends (ruby, ruby-prism, librust-cc-1+default-dev) into the testbed, and the C compiler cc needs comes with rustc's Depends (gcc, libc-dev, binutils, apt-cache), so the build script's compilation is covered. The third test's Architecture: !riscv64 is generated, not a fault.
The buildscript's dh-cargo:deb-built-using=prism=0=<gem path> uses the documented 0= form of /usr/share/cargo/bin/dh-cargo-built-using; 0 is correct because Expat requires no Built-Using, and since the -dev package ships only sources no Built-Using/Static-Built-Using is generated for it.
debian/control: compat 13 via debhelper-compat, Multi-Arch: same consistent with ruby-prism's own Multi-Arch: same, Provides list is the standard debcargo set, Standards-Version 4.7.4 is current against Policy 4.7.4.1, Vcs-Git/Vcs-Browser/Homepage/upstream metadata consistent, 3.0 (quilt), changelog version/distribution/date sane.
ruby-prism 2.1.0-1 is in the archive (apt-cache show), so today both the >= 2.1.0 and << 2.2.0 relations are satisfiable and the build script's exact-match check passes.
uscan found the packaged version as the newest upstream release (upstream 2.1.0, packaged 2.1.0+ds).

Not confirmed ◂

Whether Debian's ruby-prism binary package actually installs the gem's src/ and include/ directories, which build/vendored.rs asserts with 'Debian prism gem at ... is missing src/ or include/'. The reviewing system has no ruby-prism installed and apt-cache gives no file lists; a build in a chroot with ruby-prism would show it immediately.
Whether ruby -rprism resolves to the ruby-prism gem rather than ruby 3.3's default prism 0.19.0 gem (present here as /usr/lib/ruby/3.3.0/prism.rb with a default gemspec), which would make the version check abort. RubyGems' activation of the highest installed version is what would make it succeed; I could not run ruby to confirm.

Proposed changes ◂

None.

Uploader's response to the LLM review

The licensing note is the same mistake as on rust-ruby-prism: v2.1.0 LICENSE.md names Ruby developers, after https://github.com/ruby/prism/commit/5092bf7f65635bfe6e0a042f98b76fc1010f1378. The Cargo.toml authors are Upstream-Contact.

The minor note is right. The dependency allows any 2.1.x, and the build script accepts only gem 2.1.0. Sid has ruby-prism 2.1.0-1, so this build is fine. I will tighten the dependency to ruby-prism (= 2.1.0) in a follow-up.

— Simon Quigley (tsimonq2), 0 hours ago

Back to Dashboard | View all reviews for this package