[barnumbirr]

A desktop API client for HTTP, WebSocket and GraphQL in the manner of Postman, with no account or cloud service: collections with environments, history, pre-request and test scripts, imports from curl, OpenAPI and Postman, and collection directories committed and pushed through git. Rust on iced, MIT.

Three commits: the package, staged; its packages.txt line, pushed after the staged run went green on all six legs; and a second lock patch for rustls.

Vetting

All three passes clear, checked today.

pass	result
not in Debian	absent from trixie, testing and unstable, all four components
no upstream .deb	41 releases, zero .deb assets
no third-party channel	upstream documents its GitHub release assets and a source build, nothing else

Whole-fleet re-check at this addition: all 37 enrolled packages are still absent from Debian.

Build

• --no-default-features, which upstream's Cargo.toml and README name as the build for package managers. It compiles out the in-app updater, so nothing in the binary can replace /usr/bin/rustman, and debian/rules fails the build if the updater's GitHub endpoint survives.
• Debian's SQLite and zlib, asserted in the binary's NEEDED. libgit2 stays vendored: libgit2-sys wants 1.9.4 and trixie has 1.9.0.
• The version is stamped into Cargo.toml and Cargo.lock from DEB_VERSION_UPSTREAM, as upstream's release job does from the tag, so the app reports 0.3.15-dev.51.
• Two git dependencies, rustman-engine and upstream's fork of iced-code-editor, are pinned by commit in Cargo.lock and fetched from GitHub at build and rebuild time.

Three things found while packaging

Depends has to name the display libraries. winit dlopens all of them, so the binary links only libc, libgcc_s, zlib and SQLite, and ${shlibs:Depends} sees none. In a container holding only the package's Depends it panicked at startup on libX11.so.6, then libXcursor.so.1, libX11-xcb.so.1 and libXi.so.6 against a separate X server, and with NoWaylandLib against a headless Weston: winit picks Wayland whenever WAYLAND_DISPLAY is set and does not fall back. With the eight libraries now in Depends, the UI renders on both, on all three suites. DEP-8 cannot catch this class, because its own test Depends (xvfb, xdotool) install the same X libraries.

rust-i18n 3.1.2 made every build different. debrebuild failed twice with size differs, and the original and both rebuilds all differed from each other, by up to 384 bytes of .text. Building one tree twice and comparing every crate's rlib narrowed it to one crate, the editor widget, whose rust_i18n::i18n!("locales", fallback = "en") emits its translation tables by iterating a HashMap, seeded randomly in every process. rust-i18n-macro 3.1.3 and later iterate a BTreeMap. debian/patches/cargo-lock-rust-i18n-3.1.5.patch ships the lock resolved with 3.1.5 and the build stays --locked, the same shape as rathole's lock patch. Reaching 3.1.5 meant dropping proc-macro-crate 2.0.2, whose exact toml_datetime pin conflicts with the toml that 3.1.5 needs. Besides the three rust-i18n crates, the patch updates the toml crates, which are reached only through the proc macro, and removes serde_yml and libyml. With the patch, two builds of one tree give identical bytes for all 1,119 rlib and rmeta files and for the binary. The same change is proposed upstream as rust-man-org/rustman#65.

rustls 0.23.43 carries two TLS advisories that apply to a client. cargo audit on upstream's lock reports 15 vulnerabilities, and rustls is the one that reaches the binary: it is the TLS stack behind every HTTPS request. RUSTSEC-2026-0349 lets an unauthenticated ServerHello downgrade later connections to classical key exchange, and RUSTSEC-2026-0285 accepts TLS 1.3 handshake messages across encryption levels; its other two need the brotli feature, which is off, or code that formats session values with Debug. debian/patches/cargo-lock-rustls-0.23.46.patch moves it to the semver-compatible 0.23.46, which also brings aws-lc-rs 1.18.2, aws-lc-sys 0.46.0 and rustls-webpki 0.103.15, plus crossbeam-epoch 0.9.21 for RUSTSEC-2026-0204. It is a separate patch so each one maps to one upstream change and can be dropped on its own. Applied in order, the two give exactly the lock upstream would have with both changes merged, which cargo accepts unchanged under --locked. The 10 advisories left reach no code this build runs: quinn-proto is not compiled, quick-xml runs only at build time inside wayland-scanner, and zip's three concern extracting archives to disk, which neither calamine nor the compiled-in code does.

Verification

• debrebuild: all OK on all four checksums, twice, trixie amd64, before enrolment and again with both lock patches. arm64 cannot run here, so that half falls to reproducible.pkg.haus after the merge.
• CI's trixie and unstable amd64 .debs are byte-identical to the local builds.
• DEP-8 passes under autopkgtest on trixie, testing and unstable. send-request types a URL into the window under Xvfb, then asserts that a local server received the request and that the 418 it answered is in rustman's SQLite history. Four mutations trip it on trixie and unstable: a stub window, no window, history writes broken in the binary, and libxkbcommon-x11 removed.
• Lintian clean on trixie and testing; unstable adds only initial-upload-closes-no-bugs, as every package does. Two overrides: no-manual-page, since main() reads no arguments and there is no --help to generate a page from, and embedded-library for the YAML parser behind OpenAPI import.
• Smoke-tested on trixie: an HTML response shown as text, with Open in browser handing xdg-open a temp file holding the full source; Settings with no Updates card.
• TLS, on trixie and unstable with both lock patches: an HTTPS request to a server whose CA is not trusted fails without reaching it; once the CA is in the system trust store, requests complete against a TLS 1.3 server and against a server capped at TLS 1.2.
• Build-Depends complete: a plain debian:trixie with only build-essential and apt-get build-dep builds it, with neither git nor cmake present. That build runs under dpkg's -O2 CFLAGS, which aws-lc-sys 0.46.0 handles: the jitterentropy failure monolith hit with 0.45.0 is fixed in this release.
• Watch file verified at authoring time: uscan reports 0.3.15-dev.51, matching what is packaged.

Note on merging

release.yml fires on a push to master touching */debian/changelog, so merging builds every suite and arch, tags rustman/v0.3.15-dev.51-1, and dispatches the ingest. It publishes.

Upstream is five months old, with four contributors (one author holds 69 of 89 commits), 41 releases and 21 commits in the last month. Every release since 2026-06-14 is tagged X.Y.Z-dev.N; if upstream ever cuts a plain X.Y.Z after X.Y.Z-dev.N, dpkg sorts it lower and that bump needs a hand-written version.