DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: rust-vte4-sys 0.10.0-1

Package Information

DescriptionFFI bindings to vte-2.91-gtk4 - Rust source code

Source code for Debianized Rust crate "vte4-sys"

MaintainerDebian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed ByJeremy Bícha <jbicha@ubuntu.com>
Sponsorjbicha@debian.org
Distributionunstable
Architectureany
VCSgit: https://salsa.debian.org/rust-team/debcargo-conf.git [src/vte4-sys] (browse)
Trackerhttps://tracker.debian.org/pkg/rust-vte4-sys
Uploaded27 days ago

New Package Report

.changes◂
Distributionunstable
DateSun, 11 Oct 2026 14:21:32 +0200
Sourcerust-vte4-sys
Version0.10.0-1
Changed-ByJeremy Bícha <jbicha@ubuntu.com>
Architecturesource amd64
Changelog◂ 
rust-vte4-sys (0.10.0-1) unstable; urgency=medium
 .
   * Package vte4-sys 0.10.0 from crates.io using debcargo 2.8.4
.dsc◂
Sectionrust
Priorityoptional
Componentmain
Package-Listlibrust-vte4-sys-dev deb rust optional arch=any
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: vte4-sys
Source: https://gitlab.gnome.org/World/Rust/vte4-rs

Files: *
Copyright: 2024-2026 Bilal Elmoussaoui
 2021-2023 Marc-André Lureau
License: MIT

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Jeremy Bícha <jbicha@ubuntu.com>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 24 days ago.

Report◂

DFSG NEW review for rust-vte4-sys version 0.10.0-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 2 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable

Licensing

debian/copyright is in DEP-5 format with the right Format line, and its two stanzas (Files: * and debian/*) cover every file in the tree: gir-generated src/lib.rs, build.rs, tests/abi.rs, tests/constant.c, tests/layout.c, tests/manual.h, Cargo.toml, Cargo.toml.orig, Cargo.lock, Gir.toml, versions.txt, .cargo_vcs_info.json, LICENSE and debian/. MIT is the correct short name: both Cargo.toml and Cargo.toml.orig declare license = "MIT", the LICENSE file is that MIT text verbatim, and since MIT is not in /usr/share/common-licenses the full licence text is reproduced in the stand-alone License paragraph, as required. No non-free or field-of-use terms, no licence notice anywhere in the tree that contradicts it, no unlicensed file, and no binary, font, image, minified or compressed file of unclear provenance. The only part I could not cross-check is the identity and years of the copyright holders, which the source itself does not state (see unconfirmed).

Packaging

Standard debcargo 2.8.4 output and good quality: debhelper compat 13 with dh-sequence-cargo and dh $@ --buildsystem cargo, a single Architecture: any, Multi-Arch: same -dev package (correct for Rust), Build-Depends/Build-Depends-Arch split with the <!nocheck> profile, and every Build-Depends and Depends name resolvable in the archive (libvte-2.91-gtk4-dev 0.84.1, librust-gtk4-sys-dev 0.11.5, gio/glib/gobject/pango-sys 0.22.9, cairo-sys-rs 0.22.9, system-deps 7.0.8, libc 0.2.186, dh-cargo 34). Standards-Version 4.7.4 equals current Policy, 3.0 (quilt) source format, Vcs-* and upstream/metadata present, autopkgtests generated for the feature sets, changelog sane. Only two minor points, neither blocking: a placeholder checksum file and a patch without a DEP-3 header.

Issues

minor packaging 1. debian/cargo-checksum.json holds a placeholder instead of the crates.io checksum ◂
  • Files: debian/cargo-checksum.json:1
  • Evidence: {"package":"Could not get crate checksum","files":{}}
  • Problem: The file is not the crates.io sha256 of the crate: it is the string debcargo writes when it could not obtain the checksum. It is not inert — dh-cargo copies it verbatim into the installed crate (doit("cp", "debian/cargo-checksum.json", "$copied_sources/.cargo-checksum.json") in the cargo buildsystem, and the same copy is installed under /usr/share/cargo/registry/), so /usr/share/cargo/registry/vte4-sys-0.10.0/.cargo-checksum.json ships a package value that is not a checksum at all. Cargo takes a directory source's package checksum from that field, so it can never match the real crates.io sha256 recorded in any consumer's Cargo.lock, and the field no longer records the provenance of the tarball. (An empty files map is normal and harmless; the bogus package value is not.)
  • Fix: Regenerate the file so that package is the real sha256 of vte4-sys-0.10.0.crate, by running debcargo with network access (or by putting the checksum in by hand) and re-uploading.
minor packaging 2. disable-abi-tests.patch has no usable DEP-3 header and its purpose is undocumented ◂

  • Files: debian/patches/disable-abi-tests.patch:1-4, debian/patches/series:2

  • Evidence:

    Subject: Disable tests that depend on an unreleased

version of vte2.91
--- a/Cargo.toml

  • Problem: The patch carries no DEP-3 fields: no Description:, no Forwarded:/Author:. Its only field is a Subject that the blank line truncates, so the parsed subject is Disable tests that depend on an unreleased and the next line (version of vte2.91) is not a valid control field at all. The reason for the patch — the crate's only test needs vte 0.86 APIs that Debian does not have — is therefore nowhere in the source package. Related consequence worth deciding on: with the abi test now [[disabled.test]], debian/debcargo.toml's whitelist = ["tests/*.c"] and the librust-shell-words-1+default-dev/librust-tempfile-3+default-dev autopkgtest dependencies exist only for a test that no longer runs, and the autopkgtests merely compile the crate.

  • Fix: Give the patch a proper DEP-3 header, e.g. Description: Disable the abi test, which needs the unreleased vte 2.91.86 and Forwarded: not-needed on one line, and either drop the now-unused whitelist/test dependencies or say in the header why they are kept.

Verified ◂
  • Read every file under debian/ (control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, cargo-checksum.json, source/format, tests/control, upstream/metadata, patches/series, both patches) and every upstream file, the large generated ones (src/lib.rs 1699 lines, tests/abi.rs 512 lines) in part rather than in full.
  • grep over the whole tree with gitignore: false for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public/Lesser, Apache License, Mozilla Public, public domain, All rights reserved: the only hits are LICENSE (the MIT text, with no copyright line) and debian/*. No upstream file carries a per-file licence or copyright notice.
  • The MIT text in debian/copyright's Licence paragraph matches LICENSE verbatim, including NONINFRINGEMENT. IN NO EVENT; Cargo.toml and Cargo.toml.orig both say license = "MIT".
  • The tree contains only text: .rs, .c, .h, .toml, .json, .lock, .txt, LICENSE — no binary, image, font, minified or compressed file that would need a preferred form for modification.
  • src/lib.rs, build.rs, tests/abi.rs and tests/*.c are gir-generated (// This file was generated by gir); the generator inputs/versions are shipped in Gir.toml and versions.txt, so the shipped files are what upstream maintains.
  • Dependency names checked with apt-cache and all exist: libvte-2.91-gtk4-dev 0.84.1-1+b1, librust-gtk4-sys-dev 0.11.5-1 (provides gtk4-sys-0.11+default-dev), librust-gdk4-sys-0.11+default-dev, librust-gio/glib/gobject/pango-sys-dev 0.22.9-1, librust-cairo-sys-rs-dev 0.22.9-1, librust-system-deps-dev 7.0.8+dfsg-2, librust-libc-dev 0.2.186-1, librust-shell-words-dev 1.1.1-1, librust-tempfile-dev 3.27.0-1, dh-cargo 34 (Provides: dh-sequence-cargo).
  • Both patches apply in the unpacked tree: Cargo.toml has [[disabled.test]] and no v0_86 = ["v0_84"] feature, while lib.rs keeps #[cfg(feature = "v0_86")] items guarded by the check-cfg lints added by the autogenerated patch — so the removed features are dead code and not a compile warning source.
  • Standards-Version 4.7.4 is current: the reviewing system's Policy is 4.7.4.1 and its upgrading checklist has nothing after 4.7.4. The packaging also lacks a Priority field, which is allowed: Rules-Requires-Root now defaults to no (Policy 5.6.31) and Priority defaults to optional (the .dsc's Package-List says optional).
  • No Files-Excluded in debian/copyright and none needed: the unpacked tree equals the orig tarball plus debian/ and the two quilt patches, and debian/ contains no file outside the debian.tar.xz.
  • debian/copyright.debcargo.hint is kept alongside the real copyright (normal debcargo workflow); it still holds FIXME placeholders, but it is a debcargo input, not the copyright file, and the file that is installed and read by dh-cargo-built-using is debian/copyright.
  • uscan found the packaged version as the newest upstream release (upstream 0.10.0, packaged 0.10.0).
Not confirmed ◂
  • The copyright holders and years in the Files: * stanza (2024-2026 Bilal Elmoussaoui, 2021-2023 Marc-André Lureau) are not attested anywhere in the tarball: LICENSE has no copyright line and no source file carries a notice, so they rest on debcargo's reading of the upstream git history, which debian/copyright.debcargo.hint admits may be wrong. I have no tool that can fetch gitlab.gnome.org, so I could not confirm them; a maintainer who has the repository should.
  • What cargo does with the non-hash package value in the installed .cargo-checksum.json for consumers of librust-vte4-sys-dev. Cargo tolerates the empty files map, but I could not build anything to see whether a bogus package string breaks a consumer's build or is simply ignored.
  • Whether cargo test on the shipped Cargo.toml emits any warning for the invented [[disabled.test]] table; a build or a cargo metadata run would show it, and it is at most a warning.
  • Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: glob: " /usr/share/cargo" is not a file of the package or of the reviewing system.
Proposed changes ◂

None.

Review Information

accepted — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Hi,

You're probably expecting this, after the last one...

debian/patches/disable-abi-tests.patch has "Subject:" header rather than "Description:" / "Forwarded:" / "Author:"

Thanks!

Back to Dashboard | View all reviews for this package