DFSG NEW Queue

DFSG, Licensing & New Packages Team

rust-sapling-drawdag 0.2.0-1

Package Information

DescriptionParse an ASCII DAG into graph edges - Rust source code

Source code for Debianized Rust crate "sapling-drawdag"

MaintainerDebian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed ByEric Dorland <eric@debian.org>
Sponsoreric@debian.org
Distributionunstable
Architectureany
VCSgit: https://salsa.debian.org/rust-team/debcargo-conf.git [src/sapling-drawdag] (browse)
Trackerhttps://tracker.debian.org/pkg/rust-sapling-drawdag
Uploaded2 hours ago

New Package Report

.changes◂
Sourcerust-sapling-drawdag
Version0.2.0-1
Changed-ByEric Dorland <eric@debian.org>
Architectureamd64 source
Distributionunstable
Changelog◂ 
rust-sapling-drawdag (0.2.0-1) unstable; urgency=medium
 .
   * Package sapling-drawdag 0.2.0 from crates.io using debcargo 2.8.4
.dsc◂
Package-Listlibrust-sapling-drawdag-dev deb rust optional arch=any
Sectionrust
Priorityoptional
Componentmain
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: sapling-drawdag
Upstream-Contact: Meta Source Control Team <sourcecontrol-dev@meta.com>
Source: https://github.com/facebook/sapling

Files: *
Copyright: 2024-2026 Meta Source Control Team <sourcecontrol-dev@meta.com>
License: MIT

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Eric Dorland <eric@debian.org>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for rust-sapling-drawdag version 0.2.0-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 1 blocker, 0 important, 0 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

All eight upstream files are under the MIT licence and the full MIT text is in debian/copyright, so the package is DFSG-compliant; nothing non-free, no missing licence, no generated-without-source. The copyright field is however inaccurate: the stanza for Files: * names "Meta Source Control Team" as the copyright holder, whereas LICENSE line 3 and the header of every source file say "Copyright (c) Meta Platforms, Inc. and affiliates". The named party is the upstream author contact in Cargo.toml, not the copyright holder stated in the notices.

Packaging

Ordinary debcargo 2.8.4 output and in good order: compat 13 with dh-sequence-cargo, per-arch Build-Depends-Arch with <!nocheck>, a single librust-...-dev binary at Architecture: any / Multi-Arch: same with the usual Provides, autopkgtest running the crate's tests, 3.0 (quilt) with no patches, 0.2.0-1 to unstable, Standards-Version 4.7.4 (current Policy is 4.7.4.1) and correct Vcs-*/Homepage/upstream metadata. No packaging fault found.

Issues

blocker licensing 1. Files: * names Meta Source Control Team as copyright holder, but the notices say Meta Platforms, Inc. and affiliates ◂
  • Files: debian/copyright:7, LICENSE:3, src/lib.rs:2, src/succ.rs:2
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/copyright: Copyright: 2024-2026 Meta Source Control Team <sourcecontrol-dev@meta.com>; LICENSE: Copyright (c) Meta Platforms, Inc. and affiliates.; src/lib.rs and src/succ.rs: * Copyright (c) Meta Platforms, Inc. and affiliates.
  • Problem: copyright-format 1.0 section 6.8 requires the Copyright field to collect the relevant copyright notices and not to sacrifice information; the holder given is the author string from Cargo.toml, not the legal entity in the notices, so neither LICENSE nor any source file is accurately described. MIT also requires the copyright notice to be preserved, and debian/copyright is where Debian records it.
  • Fix: Name the holder the notices name, e.g. Copyright: 2024-2026 Meta Platforms, Inc. and affiliates, keeping the upstream contact address only in Upstream-Contact.
Verified ◂
  • Read every file in the tree (8 upstream files plus debian/): .cargo_vcs_info.json, BUCK, Cargo.lock, Cargo.toml, Cargo.toml.orig, LICENSE, src/lib.rs, src/succ.rs.
  • Licence evidence: only MIT appears anywhere; src/lib.rs:1-6 and src/succ.rs:1-6 carry the Meta Platforms copyright header and 'This source code is licensed under the MIT license found in the LICENSE file'; LICENSE holds the full MIT text; no SPDX tags, no other licence wording.
  • MIT is not in /usr/share/common-licenses, and its full text including the warranty disclaimer is present as the stand-alone License: MIT paragraph, as copyright-format 6.7 requires.
  • No third-party or vendored code: Cargo.toml has no dependencies, src/lib.rs imports only std, and there is no other crate or LICENSE/COPYING/NOTICE file in the tree.
  • The Files: * and debian/* patterns cover every path in the source package under copyright-format 6.9 (* matches slashes), with debian/* overriding for the packaging files.
  • debian/copyright is DEP-5 with the correct Format URL and has no Files-Excluded to contradict the tree.
  • The prescan's author check found no unnamed holder among the 8 files it scanned and listed no file to account for; its name matching treats the two Meta strings as the same entity, which is why it did not catch the mismatch reported above.
  • Cargo.toml.orig, Cargo.toml and .cargo_vcs_info.json are upstream autocargo/crates.io metadata, not built artefacts; BUCK is upstream build metadata text; Cargo.lock is a generated lockfile with a single package entry, its generator (cargo) being upstream's tool, not missing source.
  • debian/ files: control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, source/format, tests/control, upstream/metadata all read; compat 13 means dh_gencontrol supplies relation substvars, so ${misc:Depends} in Depends is correct, and dh skips the dh_auto_test override under nocheck, which the <!nocheck> annotations in Build-Depends-Arch match.
  • debian/rules' dh_auto_test -- test --all reaches /usr/share/cargo/bin/cargo test --all (buildsystem/cargo.pm sub test), and the crate has unit tests (src/lib.rs mod tests).
  • apt-cache: dh-cargo 34 Provides dh-sequence-cargo, so the Build-Depends is satisfiable; cargo is a dependency of dh-cargo, so the autopkgtest's dh-cargo (>= 33~), rustc suffices.
  • uscan found the packaged version as the newest upstream release (upstream 0.2.0, packaged 0.2.0).
Not confirmed ◂

None.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until , because the review found serious issues.

Back to Dashboard | View all reviews for this package