DFSG NEW review for rust-dua-core version 4.1.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable

Licensing

debian/copyright is in machine-readable DEP-5 format with the correct Format: URI, a Files: * stanza (2019-2026 Sebastian Thiel, Expat) and a debian/* stanza (Debian Rust Maintainers / Simon Quigley, Expat), plus the complete Expat permission text (Expat is not in /usr/share/common-licenses, so the full text must be present, and it is). Upstream declares license = "MIT" in Cargo.toml; Expat is the same permission text and the wording copyright-format 1.0 §7.1 asks for, so the short name is right, not wrong. No file in the tree carries any other copyright or licence notice, and there is no vendored third-party code, binary blob or source-less generated file. Licensing is DFSG-free and accurately described.

Packaging

A standard, clean debcargo-generated source package: debhelper compat 13 with dh-sequence-cargo, a correct Build-Depends / Build-Depends-Arch split, rustc:native (>= 1.88) matching rust-version = "1.88" and edition 2024, matching Breaks: rustc (<< 1.88~), Multi-Arch: same on the arch:any -dev package, versioned Provides, correct Section/Homepage/Vcs-*/Standards-Version 4.7.4 (current Policy is 4.7.4.1), a patch series with the debcargo auto/auto-remove-targets.patch, debian/tests/control with three cargo-auto-test stanzas, and upstream/metadata and debcargo.toml present. All Build-Depends exist and are satisfiable (rustc 1.97.1, librust-crossbeam-dev 0.8.4, librust-tempfile-dev 3.27.0, dh-cargo 34). The one anomaly is debian/cargo-checksum.json, noted below.

Issues

1. [minor] [packaging] debian/cargo-checksum.json records a placeholder instead of the crate checksum

• Files: debian/cargo-checksum.json
• Evidence: {"package":"Could not get crate checksum","files":{}}
• Problem: This file is debcargo's record of the sha256 of the published dua-core-4.1.0 .crate; here the package value is debcargo's error string rather than a hash, and the files map is empty. dh-cargo installs this file into the crate's registry directory as /usr/share/cargo/registry/dua-core-4.1.0/.cargo-checksum.json, whose package field is the checksum Cargo verifies against the checksum recorded in a dependent's Cargo.lock (that is why the Rust team's /usr/share/cargo/scripts/prune-checksums empties files but deliberately keeps package). A placeholder there means a later Debian package that Build-Depends on librust-dua-core-dev and whose Cargo.lock records the real crates.io checksum for dua-core cannot verify the crate.
• Fix: Regenerate the file with the real sha256 of dua-core-4.1.0.crate (run debcargo where it can read the crates.io index), so package holds the actual checksum.

Verified

• Read all of debian/ (control, rules, changelog, copyright, copyright.debcargo.hint, debcargo.toml, watch, source/format, patches/series, patches/auto/auto-remove-targets.patch, tests/control, upstream/metadata, cargo-checksum.json).
• Full non-debian inventory: Cargo.toml, Cargo.toml.orig, Cargo.lock, CHANGELOG.md, .cargo_vcs_info.json, src/lib.rs, src/windows.rs, src/macos/{mod,attributes,tests}.rs, tests/dua.rs; confirmed against the member lists of rust-dua-core_4.1.0.orig.tar.gz and rust-dua-core_4.1.0-1.debian.tar.xz (the .orig has no debian/ and no LICENSE file).
• Grepped every non-.pc file (gitignore:false) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU, Apache, Mozilla Public, public domain, All rights reserved, and for MIT/Expat/BSD/GPL/LGPL/MPL: the only matches are in debian/ (debian/copyright says Expat, debian/copyright.debcargo.hint and Cargo.toml say MIT).
• Ran a second targeted grep over src/ and tests/ for copyright/licence/spdx/permission/warranty: no licence headers anywhere; nothing to conflict with the Files: * stanza.
• The .cargo_vcs_info.json, Cargo.toml.orig and debian/copyright.debcargo.hint confirm the source is the crates.io tarball of the dua-lib member of the dua-cli repository; debcargo then shipped its overlay files (debcargo.toml, copyright.debcargo.hint) unchanged, which is normal for decargo-conf packages.
• Build-Depends satisifiability checked with apt-cache: rustc/cargo 1.97.1+dfsg1-1 satisfies rustc:native (>= 1.88); librust-crossbeam-0.8+default-dev is provided by librust-crossbeam-dev 0.8.4-1+b1; librust-tempfile-3+default-dev by librust-tempfile-dev 3.27.0-1; dh-sequence-cargo by dh-cargo 34; libstd-rust-dev exists.
• The Expat text in debian/copyright is complete, so Policy 12.5 is satisfied even though upstream ships no separate licence file; no Files-Excluded is needed as the source is the unmodified crates.io tarball.
• No maintainer scripts, no debian/install|links|docs, and no debian/tests/control dependency problem: the three test stanzas' Depends are the arch-independent dh-cargo/rustc plus the dev-dependencies, with @ as debcargo's placeholder for the binary's own Depends.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 4.2.0, packaged 4.1.0), which is not a fault of the package.

Not confirmed

• Whether the placeholder checksum in debian/cargo-checksum.json actually blocks dependents depends on cargo's and dh-cargo's handling of a directory-source .cargo-checksum.json, which cannot be observed from the source alone; building a package that Build-Depends on librust-dua-core-dev (e.g. a dua-cli rebuild against it) would show whether cargo reports checksum for dua-core v4.1.0 changed between lock files.
• debian/tests/control restricts only the --no-default-features stanza to Architecture: !riscv64; the reason is not recorded in the package, and only a test run on riscv64 would show if the restriction is still needed.

Proposed changes

None.