DFSG NEW review for rust-vello-common version 0.3.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 6 found

Licensing

The code itself is free software: every src/*.rs file carries SPDX-License-Identifier: Apache-2.0 OR MIT, the full MIT text ships in LICENSE-MIT, and the Apache-2.0 pointer is correct. But debian/copyright is not accurate or complete: its blanket Files: * stanza attributes the whole tree to the Vello Authors under Apache-2.0/MIT only, while src/encode.rs and src/math.rs explicitly contain code translated from Skia and copied from tiny-skia (both BSD-3-Clause, with notices that would have to be reproduced) and src/flatten_simd.rs copies code from kurbo (Apache-2.0/MIT but by the Kurbo Authors). Those holders and the BSD-3-Clause text are absent.

Packaging

A clean, conventional debcargo-generated Rust source package: compat 13 with the substvars actually needed below 14, all declared dependencies exist in unstable at satisfying versions, the single patch is applied and is needed for the fearless-simd 1.0 port, nine autopkgtests with sensible feature/arch restrictions, Standards-Version 4.7.4 against current Policy 4.7.4.1, and a sane changelog and Vcs-*. The only packaging complaint is the patch's missing DEP-3 metadata, which is minor.

Issues

1. [blocker] [licensing] debian/copyright attributes copied third-party code to the Vello Authors only

• Files: debian/copyright:6-8, src/encode.rs:126, src/encode.rs:972, src/math.rs:31, src/flatten_simd.rs:5, src/flatten_simd.rs:244
• Basis: inferred from what was read, not seen directly
• Evidence: debian/copyright:6-8 has Files: * / Copyright: 2020-2026 the Vello Authors / License: Apache-2.0 or MIT, but the tree says: src/encode.rs:126 // The implementation of radial gradients is translated from Skia., src/encode.rs:972 /// Copied from <https://github.com/linebender/tiny-skia/.../src/shaders/radial_gradient.rs#L182>, src/math.rs:31 // From <https://github.com/linebender/tiny-skia/.../path/src/scalar.rs#L12>, src/flatten_simd.rs:5 well as some code that was copied from kurbo and src/flatten_simd.rs:244 The below methods are copied from kurbo.
• Problem: The single blanket stanza claims every file is the Vello Authors' work under Apache-2.0/MIT. That is inaccurate for the copied portions: the radial-gradient code is a port of Skia and parts of encode.rs/math.rs are copied from tiny-skia, both distributed under BSD-3-Clause (Skia copyright Google Inc.; tiny-skia copyright Yevhenii Reizner), whose notice and disclaimer must be retained when redistributing; flatten_simd.rs copies kurbo code, which is Apache-2.0/MIT but whose copyright is held by the Kurbo Authors, and neither LICENSE-MIT nor LICENSE-APACHE in the package names them. debian/copyright therefore neither names all holders nor reproduces the BSD-3-Clause licence text, so it does not describe the licensing of every file (and the BSD notice requirement is unmet). The licences are compatible with the DFSG; the defect is the copyright file.
• Fix: Add Files: stanzas for src/encode.rs, src/math.rs and src/flatten_simd.rs that list every holder (the Vello Authors, Google Inc. for the Skia-derived code, Yevhenii Reizner/the tiny-skia authors, the Kurbo Authors as applicable) with the corresponding years, set License: to the real combination (e.g. Apache-2.0 or MIT and BSD-3-Clause), and add a stand-alone License: BSD-3-Clause paragraph containing the full text and the upstream copyright line(s). Also ask upstream to carry the third-party notices in the crate.

2. [minor] [packaging] Sole quilt patch has no DEP-3 header or forwarding status

• Files: debian/patches/upgrade-fearless-simd.patch:1, debian/patches/series:1
• Basis: inferred from what was read, not seen directly
• Evidence: The patch begins directly with diff --git a/Cargo.toml b/Cargo.toml and has no Description:, Origin:, Forwarded: or Last-Update:; debian/patches/series contains only upgrade-fearless-simd.patch.
• Problem: The patch ports the crate from fearless-simd 0.7 to 1.0 (Cargo.toml plus #[simd]/token() API changes). Without a DEP-3 header its purpose, author and upstream status are undocumented, so the next maintainer cannot tell whether it may be dropped on the next upstream release or should be forwarded (Policy 4.3 asks that changes not specific to Debian be sent upstream).
• Fix: Prefix the patch with a DEP-3 header giving at least Description:, Origin: or Forwarded: (a link to an upstream PR/issue, or a justification for not-needed), and Last-Update:.

Verified

• Read all of debian/: control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, patches/series and the patch, source/format, tests/control, upstream/metadata; no install/links/docs files or maintainer scripts exist.
• debian/copyright is DEP-5 (correct Format: URL); the MIT licence is given in full and Apache-2.0 is referenced as /usr/share/common-licenses/Apache-2.0.
• All src/*.rs files (33) carry Copyright <year> the Vello Authors (2024-2026) and SPDX-License-Identifier: Apache-2.0 OR MIT; LICENSE-MIT is Copyright 2020 the Vello Authors; README.md states the dual licence. The year range 2020-2026 in the blanket stanza is consistent.
• src/pico_svg.rs copies code from Vello with the same authors and licence, so it needs no separate stanza.
• Binary probe assets: assets/probe_depth_buffer.rgba, assets/probe_gradient.rgba, assets/probe_image_bilinear.rgba, assets/probe_image_nearest.rgba, assets/probe_solid_rect.rgba and assets/probe_transformed.rgba (the six the scan flagged) are 784-byte (14x14x4) raw per-cell RGBA reference images, the same class as assets/probe_alpha_blending.rgba, assets/probe_blending.rgba, assets/probe_filter.rgba and assets/probe_opacity_layer.rgba. They are loaded with include_bytes! in src/probe.rs:230-239 and have ten companion probe_*.png files plus assets/README.md explaining their regeneration; they are the project's generated probe test data, not third-party or unclear-provenance material, and are covered by Files: *.
• No minified JS/CSS, archives, bytecode, firmware, vendored libraries or other built files; the only non-source blobs are the probe assets above. debian/copyright.debcargo.hint is debcargo's overlay template and is not installed in any binary package.
• Standards-Version 4.7.4 is current (Policy 4.7.4.1; first two components match). debhelper compat 13 with dh-sequence-cargo; ${misc:Depends} is present, as required below compat 14, and no shared libraries exist for a shlibs substvar.
• Every dependency name exists in unstable/NEW with a satisfying version: librust-fearless-simd-dev 1.0.0 (provides -1-dev, +std, +libm), librust-fearless-simd-macros-dev 0.1.0, librust-bytemuck-dev 1.25.2 (+derive, +extern-crate-alloc), librust-png-dev 0.18.1-3, librust-peniko-dev 0.6.1 (+bytemuck, +std, +libm), librust-libm-dev 0.2.16, librust-roxmltree-dev 0.20.0, librust-log-dev 0.4.34, librust-thiserror-dev 2.0.21, librust-smallvec-dev 1.16.2, librust-guillotiere-dev 0.7.0; rustc 1.97.1 satisfies >= 1.89.
• Binary package metadata is consistent: Multi-Arch: same, Provides covering all crate features and name variants, Breaks: rustc (<< 1.89~) matching rust-version = "1.89", Vcs-Git/Vcs-Browser/Homepage and X-Cargo-Crate/Version all correct.
• The patch is applied (Cargo.toml has fearless_simd = "1" and fearless_simd_macros, and the sources use #[simd]/token()); its removal would break the build against Debian's fearless-simd 1.0.
• Nine autopkgtests use dh-cargo and @ with appropriate feature and Architecture: !riscv64 restrictions; flaky is set on the feature combinations that need it.
• uscan found the packaged version as the newest upstream release (upstream 0.3.0, packaged 0.3.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Nothing was built or run: compilation of the fearless-simd 1.0 port and the probe tests were not exercised.
• The Skia, tiny-skia and kurbo copyright notices are not present in the package, so their exact wording (needed for the debian/copyright fix) could not be quoted here.

Proposed changes

None.