Review: rust-sha1dc 0.1.5-1

Package Information

Description	Hardware-accelerated SHA-1 with collision detection - Rust source code Source code for Debianized Rust crate "sha1dc"
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	Simon Quigley <tsimonq2@debian.org>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/sha1dc] (browse)
Tracker	https://tracker.debian.org/pkg/rust-sha1dc
Uploaded	1 month, 2 days ago

New Package Report

.changes◂

Date	Tue, 06 Oct 2026 17:49:10 -0500
Source	rust-sha1dc
Version	0.1.5-1
Changed-By	Simon Quigley <tsimonq2@debian.org>
Architecture	source amd64
Distribution	unstable

Changelog◂

rust-sha1dc (0.1.5-1) unstable; urgency=medium
 .
   * Package sha1dc 0.1.5 from crates.io using debcargo 2.8.4

.dsc◂

Section	rust
Priority	optional
Component	main
Package-List	librust-sha1dc-dev deb rust optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: sha1dc
Upstream-Contact: Sam Reis
Source: https://github.com/srijs/sha1dc

Files: *
Copyright: 2017 Marc Stevens (Cryptology Group, Centrum Wiskunde & Informatica)
 2017 Dan Shumow (Microsoft Research)
 2026 Sam Reis
License: Expat or Apache-2.0

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Simon Quigley <tsimonq2@debian.org>
License: Expat or Apache-2.0

License: Apache-2.0
 Debian systems provide the Apache 2.0 license in
 /usr/share/common-licenses/Apache-2.0

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 24 days ago.

Report◂

DFSG NEW review for rust-sha1dc version 0.1.5-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable

Licensing

Licensing is DFSG-compliant and debian/copyright is accurate and complete. The crate is dual-licensed MIT OR Apache-2.0 (LICENSE-MIT and LICENSE-APACHE at the top level, matching Cargo.toml license = \"MIT OR Apache-2.0\"); both are free licences, no NC/ND/field-of-use restrictions. The whole source tree (all Rust source, tests, test-vector data, docs, Cargo metadata) is covered by Files: *, whose copyright holders (Marc Stevens 2017, Dan Shumow 2017, Sam Reis 2026) exactly match the LICENSE-MIT header, and whose License: Expat or Apache-2.0 matches the texts; the Expat text is reproduced in full and Apache-2.0 is correctly referenced to /usr/share/common-licenses/Apache-2.0. No file carries a different or missing licence. No minified code, binaries (the only binary files are 128-640 B hash-collision test vectors in tests/data), firmware or fonts.

Packaging

Packaging is of good quality and standard for a debcargo-generated Debianized Rust crate: debhelper-compat 13 + dh-sequence-cargo with dh $@ --buildsystem cargo; correct Build-Depends/Build-Depends-Arch split with <!nocheck> profile, rustc >= 1.87 matching rust-version; Multi-Arch: same, canonical Provides list and Breaks: rustc (<< 1.87~); sane changelog (0.1.5-1, unstable, medium); 3.0 (quilt) with no patches needed; autopkgtests via cargo-auto-test covering --all-features and no-default-features variants; upstream/metadata present; Vcs-* pointing at the rust-team debcargo-conf repo. Every dependency resolves in the archive (rustc 1.97.1, dh-cargo 34, librust-hex-literal/libstd/quickcheck/sha1 dev packages all present at versions matching Cargo.lock). Standards-Version 4.7.4 vs current 4.7.4.1 is a trivial point-release lag.

Issues

None.

Verified ◂

Enumerated the entire tree (glob with gitignore:false, hidden:true), excluding .pc/ and debian/: 32 files in src/, tests/, tests/data, plus LICENSE-APACHE, LICENSE-MIT, README.md, Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, .gitignore. No vendored third-party code, no subdirectory LICENSE/COPYING/NOTICE/AUTHORS files, no hidden files missed.
Grep of the whole tree for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/permission/GPL/LGPL/Apache/MPL/public domain/All rights reserved found licence text only in the two top-level LICENSE files, README, and debian/copyright.
LICENSE-MIT names exactly 2017 Marc Stevens (Cryptology Group ...), 2017 Dan Shumow (Microsoft Research), 2026 Sam Reis; debian/copyright Files: * lists the same three holders. Upstream-Contact (Sam Reis) and Homepage/Source (github.com/srijs/sha1dc) are consistent.
debian/copyright is machine-readable (format-1.0 URL), Parser-clean stanzas: Files: * and Files: debian/*, Email 'Expat or Apache-2.0' standalone paragraphs, no Files-Excluded, no draft-format fields. Expat full text present; Apache-2.0 referenced to /usr/share/common-licenses/Apache-2.0 (correct).
Cargo.toml declares license = \"MIT OR Apache-2.0\", edition 2024, rust-version 1.87; no build-time or runtime [dependencies], only dev-dependencies (hex-literal, quickcheck, sha1).
All binary data files (tests/data/sha-mbles-1.bin, sha-mbles-2.bin, sha1_reducedsha_coll.bin, 128-640 B) are raw hash-collision test vectors, judged from name/size; no executables or minified code anywhere.
debian/tests/control has 4 stanzas (--all-features, default, --no-default-features --features std, --no-default-features) via cargo-auto-test; Depends resolve: librust-hex-literal-1+default-dev, librust-quickcheck-1-dev, librust-sha1-0.11+default-dev all exist (provided by hex-literal-dev 1.1.0-1, quickcheck-dev 1.1.0-1, sha1-dev 0.11.0-1, matching Cargo.lock); dh-cargo (>= 33~) satisfied (34); rustc (>= 1.87) satisfied (1.97.1).
debian/control: Build-Depends resolves (debhelper-compat 13, dh-sequence-cargo provided by dh-cargo 34), Standards-Version 4.7.4 vs Policy 4.7.4.1 (point-release lag), no missing/wrong dependencies; Provides/Breaks follow rust-team convention for librust-* packages.
debian/source/format 3.0 (quilt); no patches/series needed; no maintainer scripts (none required for a source-only -dev crate); upstream/metadata and Vcs-Git/Browser point to the rust-team debcargo-conf repo; changelog well-formed.
uscan found the packaged version as the newest upstream release (upstream 0.1.5, packaged 0.1.5).

Not confirmed ◂

autopkgtest is not installed on the reviewing system, so I could not confirm that the Architecture: !riscv64 field in two debian/tests/control stanzas is honoured; Debian Policy's autopkgtest document (4.7.4.1) does not list an Architecture field among the valid fields and says unknown fields cause the stanza to be skipped. The field is standard debcargo 2.8.4 output in pervasive rust-team use, so it is almost certainly accepted in practice.
The ubc_check/*.rs files are marked @generated by codegen/ but the codegen generator is not shipped in the crates.io tarball (only its output); the generated code is readable Rust under the crate's MIT OR Apache-2.0 licence and derives from MIT-licensed upstream sha1collisiondetection, so this is not a DFSG problem, but I could not inspect the unshipped generator.
Did not byte-inspect the three small .bin test-vector files; judged only from name, size and the tests that consume them.

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 24 days ago, started 24 days ago, completed 24 days ago.

Final Comment

Back to Dashboard | View all reviews for this package