Hi,

The derivre package is declared with

    Section: FIXME-(packages."(name)".section)

which is not a valid section name, not even syntactically.

   Simon

And all that for a test binary that we shouldn't even be shipping in the
first place - I think that must have been an accidental consequence of
debcargo defaults.  I'll clean that up, thanks.

The Debian NEW review of rust-derivre 0.3.12-3 has been completed.

Decision: ACCEPTED
Reviewer: Andrew McMillan

Review comment:

Hi,

Some packaging-quality issues.  I suspect you already know these though...

Major downgrade of hashbrown (0.17.1 → 0.14.5).

Cargo.toml.orig:20 requires 0.17.1, but debian/patches/relax-version.patch rewrites it to 0.14.5 (two major versions older) purely because Debian only has 0.14 (control:18,37). The crate uses hashbrown::hash_table::Entry/HashTable (src/hashcons.rs:1,4), which still exist in 0.14 so it compiles, but this silently changes the hash-table implementation upstream pinned — worth flagging for review rather than accepting blindly.

Test-only dev-dependencies missing from Build-Depends-Arch.

The crate's test targets (tests/basic.rs, fowler.rs, etc.) depend on bstr, serde, toml (Cargo.toml:86-99), but none of these appear in control Build-Depends. They're only listed in debian/tests/control for autopkgtest. Since debian/rules is a plain dh $@ --buildsystem cargo with no nocheck, the build-time test run cannot build these targets — a likely FTBFS unless tests are intentionally skipped. (Worth verifying against CI.)


Thanks!

Full review details: https://dfsg-new-queue.debian.org/reviews/rust-derivre

We believe that the bug you reported is fixed in the latest version of
rust-derivre, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149034@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated rust-derivre package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 26 Sep 2026 21:30:43 BST
Source: rust-derivre
Binary: librust-derivre-dev
Architecture: amd64 source
Version: 0.3.12-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed-By: Colin Watson <cjwatson@debian.org>
Description:
 librust-derivre-dev - Derivative-based regular expression engine - Rust source code
Closes: 1149034
Changes:
 rust-derivre (0.3.12-3) unstable; urgency=medium
 .
   * Team upload.
   * Package derivre 0.3.12 from crates.io using debcargo 2.8.4
   * Stop building derivre binary package, since it's just a test binary and
     there's no point shipping it (closes: #1149034).
Checksums-Sha256:
 07b4f07b57ec987e790e750a33058c864ec3c9159d3daac89d9dc025cf3b83d1 51772 librust-derivre-dev_0.3.12-3_amd64.deb
 81c5a0d9e2321b7a17315a8609fc8b3e4fbef1bfc4e64348b252698ff77dde84 25879 rust-derivre_0.3.12-3_amd64.buildinfo
 6c3c49215c1b687e0d7097009dd1a79dde619e4ace1beeecf39e3c215713d6f6 2747 rust-derivre_0.3.12-3.dsc
 a892ec3953f4ca893e8d2086ed03d4b58e19c77ffb864a574b332d7d40c175f3 59370 rust-derivre_0.3.12.orig.tar.gz
 1f9d0330925f65ee658e9c6ab62ed2fd17d458fcbd710d3f500ed1ae206825bd 3244 rust-derivre_0.3.12-3.debian.tar.xz
Checksums-Sha1:
 da07eec5f11eefe225f292edc4f55cf84f358c2e 51772 librust-derivre-dev_0.3.12-3_amd64.deb
 b0fe7eba936181a6ffbfb5f1adb42b52e6300d5a 25879 rust-derivre_0.3.12-3_amd64.buildinfo
 5caebad825fc11509f542b0b47b9df65ccf6b29c 2747 rust-derivre_0.3.12-3.dsc
 cb81a4c9bc76045036e43aed17592a81977bf073 59370 rust-derivre_0.3.12.orig.tar.gz
 8b03f59dbd41e9d083bcf1bdd3b1b9311832e34f 3244 rust-derivre_0.3.12-3.debian.tar.xz
Files:
 70bf1d4617d456719ff521961421e835 51772 rust optional librust-derivre-dev_0.3.12-3_amd64.deb
 18008df4d4cc3e6168c114b74db2cdb1 25879 rust optional rust-derivre_0.3.12-3_amd64.buildinfo
 9b731b712487c8471da0c458a18f63d3 2747 rust - rust-derivre_0.3.12-3.dsc
 4d3ad4f79abba72469b85f4b96e0b736 59370 - - rust-derivre_0.3.12.orig.tar.gz
 17140ec3769001f195e23b07f80da18c 3244 - - rust-derivre_0.3.12-3.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEErApP8SYRtvzPAcEROTWH2X2GUAsFAmq4K3MACgkQOTWH2X2G
UAuWvg/8DWOFELcO1gEbDdgLvQNytFKl7vMzwzGpeRh00Z9DAbnrONIi0826+uaL
d3/OqjoqQvByJmt7Wm/aMbQ0BZWqnrUcwYQnImff5GXyrVTM/NmUU4I0wepyeRKN
rquX6pKk9Zo5PRBPSiERpMGJhF8iESRZwKewHsYnVsVFTGWBEMIlWnwJD/fY4JX4
O0UqQi6Atxhfb3XslhjKtqju5XYl9QV6gtFIDAQnJYRsXmgwfEi+KYqKBKESxWa+
13e8eIAMT2mp5a5bTd4iKR38T/DKsvoy2RPFgPuqmDOuUPiAJWD3QFeMFpO8faa5
FWGFDPt4gN0H7cpC6/dz0IgtWr/FkFlicwNgwscCla/UUetRnONDYrgF69h3HIWE
lLIbUbe0HdNBTSy+jw6gLUJEpkER3c9sbJmYVVU3atoPFFX1Yx53f0QtqEQtX/V5
eMt+TGEo9jt9B8RGNrowkYeRjGDDjknScqGvvwkyOpJC+bdVZK4JZEiD82jNbN/A
tCMCygo6sHMEj5HxYQr7kFlzM/kWQxjhNpneilgmznKGI3Hb9/tWWWtoLimxGkDh
g5uV9f9hvswoi5HBAI84JE6Umbhj4S1BXmiJgV9G2l1HFfaePCOb+aIB4OvcIEF4
RzG4+PKXwUeWI6AUeAeYZVaY0ZQDypcKibFvsRy9khTgfnurrEc=
=0Qj2
-----END PGP SIGNATURE-----

Thanks for the review!

This is expected - unfortunately the upstream Rust ecosystem tends to
bump in a semver-incompatible fashion rather often (much more often
than regular C libraries would bump their soname), often for minor
issues not relevant for most reverse dependencies. Coupled with a
tendency to blindly bump dependency versions to the latest, without
actually using any of the newly introduced features/interfaces, we
end up with a wide range of versions of any particular crate in the
wild, where versions can be nominally incompatible, but mostly
compatible in practice. Of course *real breaking changes* exist as
well. If we would not have a lot of patches down- or upgrading
version constraints in Cargo.toml, we'd run afoul of the goal of not
having N versions of any particular upstream project in the archive,
if we can avoid it. We try to keep the number of "semver-suffixed"
crate packages (rust-foo-N or rust-foo-0.N) to what is actually
needed.

Such patches make up the vast majority of patching that happens in
rust-* packages.. Dropping them would mean introducing a lot more
rust-foo-N packages, which would make our lives and that of other
teams (including the DFSG team ;)) harder!

This is also expected. dev-dependencies often introduce cyclic
dependencies which would make upgrading and testing migration harder
if included as regular build dependencies.

debcargo generated source packages will do the following:
- if there are no dev-dependencies in Cargo.toml, the test suite
is run as part of the build and as autopkgtests
- if there are dev-dependencies in Cargo.toml, at build time only a
build test is done, the full test suite is postponed to autopkgtests

Hope this does sound reasonable :)
Fabian

Thanks for the response.  yes - as I stated in my earlier e-mail - I
expected that these things were known and understood.

Cheers,
Andrew.