DFSG NEW review for rust-x-wing version 0.1.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with correct Format line. One Files stanza covers the whole upstream tree (Apache-2.0 or MIT, Copyright 2024-2026 RustCrypto Developers, matching LICENSE-MIT and Cargo.toml's license = "Apache-2.0 OR MIT") and a later Files: debian/* stanza covers the packaging. The MIT permission notice is reproduced in full and Apache-2.0 is referenced via /usr/share/common-licenses/Apache-2.0, whose short name is correct; LICENSE-APACHE in the tree is the unmodified Apache 2.0 text. No non-free wording, no unlicensed file, and no third-party code is embedded. The only file of external origin, tests/test-vectors.json, is numeric KAT data cited to the IETF draft and carries no separate licence term.

Packaging

Standard, unmodified debcargo 2.8.4 output: debhelper compat 13 with dh-sequence-cargo, source format 3.0 (quilt) with no patches, Multi-Arch: same -dev package with complete Provides, Breaks: rustc (<< 1.85~) matching rust-version 1.85, and a full autopkgtest matrix (default, all features, each feature). Every Build-Depends, Depends and autopkgtest dependency resolves in the archive (including versioned virtual feature packages and the >= 1.8.1 zeroize constraint). Changelog, Vcs-*, Homepage and Standards-Version 4.7.4 (Policy 4.7.4.1) are all sound.

Issues

None.

Verified

• Read every upstream file (Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, README.md, CHANGELOG.md, LICENSE-APACHE, LICENSE-MIT, src/lib.rs, src/error.rs, tests/kats.rs, tests/test-vectors.json) and every file under debian/; debian/watch and debian/cargo-checksum.json were left out as instructed.
• The upstream files in the working tree match the sizes of the members in rust-x-wing_0.1.1.orig.tar.gz (e.g. src/lib.rs 14.6KB, tests/test-vectors.json 15.0KB, Cargo.toml 3.2KB), and debian/patches does not exist, so no source change is applied outside the packaging.
• grep for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/'Permission is hereby granted'/GNU General Public/Apache License/Mozilla Public/public domain/'All rights reserved' over the whole tree (including hidden files) found only the Apache-2.0 boilerplate in LICENSE-APACHE and Copyright (c) 2024-2026 RustCrypto Developers in LICENSE-MIT; no file notice names a holder absent from debian/copyright.
• debian/copyright: Files: * / Copyright: 2024-2026 RustCrypto Developers / License: Apache-2.0 or MIT, matching LICENSE-MIT line 1 and Cargo.toml.orig license = "Apache-2.0 OR MIT"; Files: debian/* gives the Debian Rust Maintainers and kpcyrd for the packaging files. Per copyright-format 6.9, * matches at any depth and matches dotfiles, so .cargo_vcs_info.json and the files under src/ and tests/ are covered.
• The MIT standalone paragraph in debian/copyright reproduces LICENSE-MIT's permission and warranty text; Apache-2.0 refers to /usr/share/common-licenses/Apache-2.0, a file that exists and matches the shipped LICENSE-APACHE (plain Apache 2.0, no added or removed terms). Both licences are permissive and mutually compatible.
• No licence or provenance problems in the source: src/lib.rs and src/error.rs are original code built on the declared RustCrypto dependencies (kem, ml-kem, sha3, shake, x25519-dalek, zeroize); no vendored third-party source, no generated code, no minified or binary file, no fonts or images.
• tests/test-vectors.json is four X-Wing known-answer test records (hex seed/eseed/ss/sk/pk/ct values only, no code and no notice); tests/kats.rs cites the IETF draft repository as their origin. It is covered by the crate's dual licence and its use is test data only.
• Cargo.lock is Cargo metadata, not a copy of third-party source; dh-cargo removes it before building (rm_files("Cargo.lock") in /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm), so it is not a built artefact needing its own source.
• Packaging is standard debcargo output: debian/debcargo.toml (overlay = ".", collapse_features = true), X-Cargo-Crate/X-Cargo-Crate-Version, source format 3.0 (quilt), debian/rules is the usual dh $@ --buildsystem cargo, no patches or series to review.
• All declared dependencies were checked with apt-cache: librust-kem-0.3+{default,getrandom}-dev via librust-kem-dev 0.3.0-1; librust-ml-kem-0.3+{hazmat,zeroize}-dev via librust-ml-kem-dev 0.3.2-1; librust-x25519-dalek-3+{static-secrets,zeroize}-dev via librust-x25519-dalek-dev 3.0.0+dfsg-1; librust-sha3-0.12-dev 0.12.0-1; librust-shake-0.1-dev 0.1.0-1; librust-zeroize-1+default-dev 1.9.0-2 (satisfies >= 1.8.1); librust-getrandom-0.4+{default,sys-rng}-dev 0.4.2-3; librust-rand-core-0.10+default-dev 0.10.1-1; librust-hex-0.4+serde-dev; librust-serde-1+derive-dev; librust-serde-json-1+default-dev; dh-sequence-cargo via dh-cargo 34.
• dh-cargo's cargo.pm sub test runs cargo build (only test as an argument switches it to cargo test), so the dev-dependencies (getrandom, hex, rand-core, serde, serde_json) are correctly absent from Build-Depends; at compat 13 dh skips dh_auto_test, and the build dependencies are marked <!nocheck> accordingly.
• debian/tests/control runs cargo-auto-test for default, --all-features and each of the getrandom/hazmat/zeroize/no-default-features variants; @ in Depends expands to the built librust-x-wing-dev, which carries the collapsed feature dependencies, so the feature tests have what they need.
• debian/changelog is 0.1.1-1/unstable with a valid date (Fri, 30 Oct 2026), no bogus bug closures; Standards-Version 4.7.4 is current per the reviewing system's Policy 4.7.4.1 (first two components match); Homepage and Vcs-Git/Vcs-Browser point at the upstream and Debian Rust team locations.
• uscan found the packaged version as the newest upstream release (upstream 0.1.1, packaged 0.1.1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• The licence terms of the external repository named in tests/kats.rs (github.com/dconnolly/draft-connolly-cfrg-xwing-kem) for tests/test-vectors.json could not be consulted (no network); the file itself contains only numeric test vectors and no notice, and I found no evidence in the package of a licence term that would differ from the crate's Apache-2.0/MIT.

Proposed changes

None.