DFSG NEW review for rust-dashu-int version 0.6.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 3 minor
• debian/watch: version 5
• debian/copyright: machine-readable

Licensing

debian/copyright is in DEP-5 format (correct https Format: URL) and matches the evidence in the tree. Upstream declares license = "MIT OR Apache-2.0" in Cargo.toml/Cargo.toml.orig and in the header of src/lib.rs; the only other licence notice in the package is NOTICE.md, which reproduces the MIT licence of the ibig crate this one was forked from (Copyright (c) 2020 Tomek Czajka), and both holders — Jacob Zhong (2022-2026) and Tomek Czajka (2020-2026) — appear in the Files: * stanza with the same MIT or Apache-2.0 terms. Both licences are DFSG-free and mutually compatible; the MIT text is reproduced in full and Apache-2.0 is pointed at /usr/share/common-licenses/Apache-2.0, as Policy 12.5 requires. No file lacks a licence, no non-free or field-of-use terms, no excluded files, and no binary/minified/generated-without-source files.

Packaging

Normal debcargo output and in good shape: source format 3.0 (quilt), debhelper-compat 13 with dh-sequence-cargo, the canonical two-line debian/rules, Multi-Arch: same on the -dev package, correct Provides for every feature name, autopkgtest stanzas for the default set and each feature, Vcs-* pointing at debcargo-conf, Standards-Version 4.7.4 (current) and a clean changelog. Every dependency in Build-Depends, Build-Depends-Arch and debian/tests/control resolves in the archive, including the feature pseudo-packages, and the one patch does something necessary (dropping the rkyv 0.7 and rand 0.9 features whose crates Debian does not have) although nothing references the removed features unconditionally. Only minor things to fix: the patch lacks a DEP-3 header, debian/cargo-checksum.json is a placeholder, and the binary synopsis is 105 characters with debcargo's FIXME asking for an override left in place.

Issues

1. [minor] [packaging] debian/cargo-checksum.json is a stub: no file hashes and a placeholder crates.io checksum

• Files: debian/cargo-checksum.json:1
• Evidence: {"package":"Could not get crate checksum","files":{}}
• Problem: This file is installed verbatim as /usr/share/cargo/registry/dashu-int-0.6.2/.cargo-checksum.json (dh-cargo's configure and build copy it into debian/_source/copied_sources and then into the registry; see /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm), so the crate ships without a record of its crates.io checksum and with no per-file checksums at all. It reads as a failed or offline debcargo run — debian/changelog names debcargo 2.8.5+alpha.0 — and means the vendored source can never be checked against what crates.io published. I could not test what, if anything, this changes at build time (dh-cargo deletes Cargo.lock at configure time and builds against a directory source, so the placeholder package value is probably never compared with anything).
• Fix: Regenerate the file with a debcargo that can reach crates.io, so that package is the published sha256. An empty files map is normal for a crate whose sources Debian patches (/usr/share/cargo/scripts/prune-checksums does exactly that), but the package checksum must be real.

2. [minor] [packaging] relax-deps.patch has no DEP-3 header, so the change to upstream Cargo.toml is undocumented

• Files: debian/patches/relax-deps.patch:1
• Evidence: The file begins with diff --git a/Cargo.lock b/Cargo.lock — there is no Description:, Origin:/Author: or Forwarded: field anywhere before the diff.
• Problem: The reader has to reconstruct from the diff alone that the change drops the optional rkyv_v07 and rand_v09 dependencies (justified: neither librust-rkyv-0.7-dev nor librust-rand-0.9-dev exists in the archive), and there is nothing to say whether it was offered upstream. The Cargo.lock half has no effect on the Debian build at all, since dh-cargo's configure deletes Cargo.lock and the build regenerates it, which makes a header explaining the intent more, not less, useful.
• Fix: Add a DEP-3 header, e.g. Description: Drop the rkyv 0.7 and rand 0.9 features, whose crates are not in Debian, Author:/Origin: of the change and Forwarded: not-needed (or the URL of the upstream issue/PR).

3. [minor] [packaging] Binary synopsis is 105 characters and debcargo's FIXME asking for an override was left in debian/control

• Files: debian/control:111, debian/control:24
• Evidence: Description: Arbitrary-precision integer math library for Rust, balancing ergonomics and efficiency - Rust source code (105 characters), preceded by # FIXME (packages."(name)".section) debcargo auto-generated summary for librust-dashu-int-dev is very long, consider overriding
• Problem: Policy 3.4.1: "The single line synopsis should be kept brief—certainly under 80 characters." This one is 105 characters and the display software truncates it, and the tool that generated it explicitly asked the packager to override it; the unaddressed FIXME is also visible to anyone reading the source package.
• Fix: Override the summary in the debcargo package configuration (as the FIXME hint suggests) or shorten the Description in debian/control, e.g. Arbitrary-precision integers for Rust - Rust source code, and drop the FIXME comment.

Verified

• Read debian/copyright in full: DEP-5, Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/, Files: * (MIT or Apache-2.0; 2022-2026 Jacob Zhong, 2020-2026 Tomek Czajka), Files: debian/* (Debian Rust Maintainers, Alexander Kjäll), stand-alone License: Apache-2.0 (points to /usr/share/common-licenses/Apache-2.0) and License: MIT (full Expat text); no Files-Excluded.
• Grepped the whole tree (except .pc/) for copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General/GNU Lesser, Apache License, Mozilla Public, public domain, All rights reserved, BSD and licen*. The only notices are src/lib.rs:1-17 (Apache-2.0 or MIT, Copyright (c) 2022 Jacob Zhong) and NOTICE.md (the MIT text of ibig, Copyright (c) 2020 Tomek Czajka, the crate dashu-int was forked from per README.md and CHANGELOG.md). No other holder or licence is claimed anywhere in the shipped files, so the Files: * stanza covers every notice and the notices match its licence names (no GPL/LGPL/MPL/CC/unknown terms at all).
• Full file inventory (hidden files included, .pc/ ignored): ~120 files, all .rs/.py/.md/.toml/.json/.lock. No .so, .jar, .class, .pyc, .exe, no firmware, fonts, images, PDFs or minified JS/CSS, so there is no file without its preferred form for modification. The single Python file, src/mul/ntt/compute_constants.py, is the generator for the OMEGA_MAX / CRT_INV_IJ constants in src/arch/*/ntt.rs, i.e. its input is present.
• src/third_party/* are trait implementations for third-party crates (num-integer, num-modular, num-order, num-traits, rand 0.8/0.9/0.10, rkyv 0.7/0.8, serde, zeroize), not embedded copies of those crates: each file is a mod of impl blocks (checked src/third_party/{mod,num_integer,num_modular,rand,rkyv_v08,zeroize}.rs). A grep for adapted|ported from|based on|taken from|derived from|borrowed|provenance found nothing beyond the documented ibig port, and the crate depends on those crates rather than vendoring them.
• Checked every name in Build-Depends, Build-Depends-Arch and debian/tests/control against the archive's package lists with apt-cache: all resolve, including the feature pseudo-packages (librust-rkyv-0.8+pointer-width-32-dev, librust-rkyv-0.8+alloc-dev, librust-dashu-base-0.6+std-dev, librust-cfg-if-1+default-dev, librust-static-assertions-1+default-dev, librust-criterion-0.5+html-reports-dev, librust-postcard-1+alloc-dev, librust-serde-test-1+default-dev, librust-num-order-1-dev, librust-num-integer-0.1-dev), and dh-sequence-cargo is provided by dh-cargo 34. Dashu-base has 0.6.1-1 and num-modular 0.6.6-1, so the >= 0.6.1 / >= 0.6.5 lower bounds hold.
• Read debian/rules, changelog, source/format, tests/control, upstream/metadata, debcargo.toml, copyright.debcargo.hint and cargo-checksum.json. Standards-Version 4.7.4 equals the installed Policy version (4.7.4.1, no changes to the checklist); the changelog is well formed (unstable, 0.6.2-1, a Sunday) and closes no bug; Rules-Requires-Root is absent, which Policy 4.9.3 permits.
• Verified the relax-deps patch's justification: no librust-rkyv-0.7-dev and no librust-rand-0.9-dev exist in the archive, and the code behind the removed features is only referenced behind #[cfg(feature = "rkyv_v07")] / #[cfg(feature = "rand_v09")] (src/third_party/mod.rs:14,28, and one #[cfg(feature = "rand_v09")] fn in src/third_party/rand.rs:224), so nothing in the tree requires the removed dependencies.
• Sampled the source for architecture-specific and generated code: src/arch/{x86,x86_64,generic_16/32/64_bit} are Rust, using core::arch intrinsics and runtime is_x86_feature_detected! with #[target_feature(enable = "bmi2")] (src/mul/simple.rs:184-327); build.rs only emits cargo:rustc-check-cfg for the force_bits cfg used by src/arch/mod.rs.
• uscan found the packaged version as the newest upstream release (upstream 0.6.2, packaged 0.6.2).

Not confirmed

• debian/debcargo.toml sets test_is_broken = true for the lib+num-integer and lib+num-integer_v01 feature configurations (the two autopkgtest stanzas marked Restrictions: allow-stderr, flaky) without any explanation. I could not tell from the package which test fails or why, nor whether the first, not-flaky --all-features autopkgtest stanza — which enables both features — is affected by the same failure.
• All per-feature autopkgtest stanzas except the --all-features one carry Architecture: !riscv64, but nothing in debian/ (not even debian/debcargo.toml) records who restricted them or why; I could not determine whether that is a debcargo default for collapsed feature tests or a hand edit.
• This is a new source package (librust-dashu-int-dev is not in the archive lists). If an ITP was filed for it, debian/changelog does not close it; I have no tool to look up bug numbers.

Proposed changes

None.