DFSG NEW review for rust-twofish-0.7 version 0.7.1+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The crate is MIT OR Apache-2.0, as its Cargo.toml, README, LICENSE-MIT and LICENSE-APACHE all state. The only copyright notice in the tree is Copyright (c) 2017 Alexander Krotov in LICENSE-MIT, and debian/copyright names it together with RustCrypto Developers under Files: *; a later debian/* stanza covers the packaging. The MIT text is reproduced in full and Apache-2.0 is referenced to /usr/share/common-licenses/Apache-2.0. No non-free terms, unlicensed files or generated/binary artifacts without source are present.

Packaging

Standard debcargo-generated packaging: 3.0 (quilt), debhelper compat 13 with dh-sequence-cargo, dependencies and Provides/Replaces matching the debcargo-conf convention (same shape as e.g. librust-sha2-0.10-dev), all referenced packages present in the archive, one-patch series relaxing the hex-literal dev-dependency, an autopkgtest that matches the crate's features, and Standards-Version 4.7.4 against Policy 4.7.4.1. No policy violation found.

Issues

None.

Verified

• Read every file in the tree: Cargo.toml, Cargo.toml.orig, CHANGELOG.md, README.md, LICENSE-APACHE, LICENSE-MIT, .cargo_vcs_info.json, src/lib.rs, src/consts.rs, src/tests.rs, tests/mod.rs, and all of debian/; .pc/ and debian/cargo-checksum.json were passed over as instructed.
• Only copyright notice in upstream source: LICENSE-MIT:1 Copyright (c) 2017 Alexander Krotov; debian/copyright maps it to Files: * with 2017 Alexander Krotov and 2016-2023 RustCrypto Developers, matching Cargo.toml authors = ["RustCrypto Developers"].
• Licence evidence: Cargo.toml license = "MIT OR Apache-2.0", README Licensed under either of: Apache License 2.0 / MIT, LICENSE-APACHE is the complete Apache-2.0 text, LICENSE-MIT the complete MIT text; a grep for Copyright/(C)/SPDX/Licensed under/GNU/Apache License/Mozilla/public domain/All rights reserved over the tree additionally hit only LICENSE-APACHE generic terms and README, nothing in src/ or tests/.
• The License: MIT paragraph in debian/copyright reproduces the LICENSE-MIT permission notice; License: Apache-2.0 points at /usr/share/common-licenses/Apache-2.0, which exists on the system.
• debian/copyright is DEP-5 with the canonical Format URL, and its Files: debian/* stanza covers all packaging files (including debian/copyright.debcargo.hint). The hint file is a debcargo artifact whose FIXME (overlay)/UNKNOWN-LICENSE placeholders are resolved in debian/copyright; it is not installed (no debian/*.install or debian/docs).
• Files-Excluded: benches/** is consistent: no benches/ directory exists in the tree, and debian/debcargo.toml has excludes = ["benches/**"], matching the +ds version.
• No built, minified or binary artifacts: Cargo.toml is cargo's normalised form but its source Cargo.toml.orig is shipped alongside; src/consts.rs tables and tests are plain source.
• Packaging files read: debian/control, rules, changelog, copyright, debcargo.toml, patches/series, patches/relax-deps.patch, source/format (3.0 quilt), tests/control, upstream/metadata.
• Build dependencies resolve in the archive: librust-cipher-0.4-dev 0.4.4-1 provides librust-cipher-0.4+default-dev and +zeroize-dev, librust-cipher-0.4+dev-dev, and librust-hex-literal-dev 1.1.0-1 provides librust-hex-literal-1+default-dev (checked with apt-cache); dh-cargo 34 provides dh-sequence-cargo and satisfies the test's dh-cargo (>= 33~).
• ${misc:Depends} is present in the binary package, as required at debhelper compat 13 (debian/control).
• Standards-Version 4.7.4 against the system's debian-policy 4.7.4.1: first two components equal, so current.
• Breaks/Replaces: librust-twofish-dev (<< 0.7.2~) match the archive's existing librust-twofish-dev 0.7.1-1 source of the same crate and the normal debcargo semver-suffix transition (compare librust-sha2-0.10-dev's identical Replaces/Provides shape).
• debian/patches/relax-deps.patch changes only the hex-literal dev-dependency from 0.3 to 1 in the cargo-generated Cargo.toml; src/tests.rs and tests/mod.rs use only the hex! macro, and debian/tests/control depends on librust-hex-literal-1+default-dev, so the patch is consistent with the test setup.
• debian/changelog: one entry, 0.7.1+ds-1, distribution unstable, urgency medium, signed by the Uploaders entry; debian/watch, checked separately, not reviewed.
• uscan found the packaged version as the newest upstream release (upstream 0.7.1, packaged 0.7.1+ds).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Whether hex-literal 1.1.0's hex! produces the same array type as 0.3 for tests/mod.rs was not compiled here; the usage (Some(hex!("...")) compared with &cipher[..]) depends only on the inferred length, and the package is assumed to build and pass its tests.

Proposed changes

None.