DFSG NEW review for rust-turboshake version 0.7.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 4 found

Licensing

The crate is dual-licensed MIT OR Apache-2.0. debian/copyright is DEP-5, has a Files: * stanza for all upstream files and a debian/* stanza for the packaging, names the RustCrypto Developers holder, and carries the MIT text plus a pointer to /usr/share/common-licenses/Apache-2.0. Both licences are free and mutually compatible. No file carries a different or additional licence; the only notices are LICENSE-MIT, LICENSE-APACHE and the dual-licence statement in README.md, all covered by Files: *.

Packaging

Standard debcargo-generated Rust library packaging. debian/control has correct Build-Depends/Build-Depends-Arch with sensible <!nocheck> markers, the binary package has correct Multi-Arch/Provides/Breaks and feature dependencies, all named packages exist in the archive, rules uses dh with the cargo buildsystem at compat 13, autopkgtests run the full feature matrix, and changelog/version/Vcs/Standards-Version (4.7.4 vs current 4.7.4.1) are in order. No patches and no maintainer scripts.

Issues

None.

Verified

• Read debian/copyright in full: DEP-5, Files: * (2023-2026 RustCrypto Developers, MIT or Apache-2.0), Files: debian/* (2026 Debian Rust Maintainers, kpcyrd), and stand-alone License paragraphs for MIT (full text) and Apache-2.0 (pointer to /usr/share/common-licenses/Apache-2.0, whose file exists).
• Inventoried the whole upstream tree (src/lib.rs, tests/turboshake.rs, tests/data/*, benches/mod.rs, README.md, CHANGELOG.md, Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, LICENSE-MIT, LICENSE-APACHE) and grepped it for copyright/licence wording: no per-file headers, no additional holder and no licence other than MIT/Apache-2.0; LICENSE-MIT (Copyright (c) 2026 The RustCrypto Project Developers) and LICENSE-APACHE are the upstream licence files, and Files: * covers them and every other upstream file.
• tests/data/turboshake128_6.blb, tests/data/turboshake128_7.blb, tests/data/turboshake256_6.blb and tests/data/turboshake256_7.blb are upstream TurboSHAKE test-vector data in the blobby format, consumed via include_bytes! by the new_test! macro in tests/turboshake.rs:62-77; they are test data, not built or generated artifacts, and are covered by the Files: * stanza.
• Cargo.toml is cargo's normalized manifest and Cargo.toml.orig the original, so no generated build input is missing; Cargo.lock and .cargo_vcs_info.json are cargo metadata only, and .cargo_vcs_info.json records the upstream vcs commit/path.
• debian/copyright.debcargo.hint is debcargo's source-only template with FIXME/UNKNOWN-LICENSE placeholders; it is not installed in the binary package, and debian/copyright has resolved those placeholders into an accurate dual-licence stanza.
• Packaging files read in full: control, rules, changelog, debcargo.toml, source/format (3.0 quilt), tests/control, upstream/metadata; no debian/patches directory and .pc/applied-patches is empty, so there are no patches to review.
• Checked build/test dependencies with apt-cache: librust-digest-0.11-dev (+alloc/+zeroize/+dev), librust-keccak-0.2+default-dev, librust-sponge-cursor-0.1+default-dev (+zeroize) and librust-hex-literal-1+default-dev are provided by digest 0.11.3-4, keccak 0.2.2-1, sponge-cursor 0.1.0-1 and hex-literal 1.1.0-1; dh-cargo is version 34, satisfying the autopkgtest Depends of >= 33~.
• Confirmed in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm that build only copies sources for a library package while test runs cargo build/test, so the <!nocheck> markers on the cargo/rustc/dependency Build-Depends-Arch entries are right at compat 13; the bench's #![feature(test)] is handled by /usr/share/cargo/bin/cargo-auto-test, which reruns with RUSTC_BOOTSTRAP on E0554.
• debian/changelog is version 0.7.1-1, distribution unstable, urgency medium, dated 2026-10-30, consistent with the 0.7.1 orig tarball; Standards-Version 4.7.4 matches current Policy 4.7.4.1 in its first two components; Vcs-Git/Vcs-Browser point at debcargo-conf with the src/turboshake subdirectory.
• uscan found the packaged version as the newest upstream release (upstream 0.7.1, packaged 0.7.1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• The upstream copyright years 2023-2026 in Files: * could not be compared with upstream Git history (no network access); LICENSE-MIT itself states only 2026, and the debcargo hint notes the years were extracted from the repository.

Proposed changes

None.