• Read all of debian/ (control, rules, changelog, copyright, libapache-logging-parent-java.docs, .poms, maven.rules, maven.ignoreRules, source/format, patches/series, patches/01-disable-error-prone.patch) and the .dsc beside the tree; the quilt tree is applied and .pc/ was left out.
• Inventory of upstream files: pom.xml, README.adoc, LICENSE.txt, NOTICE.txt, .asf.yaml, .editorconfig, .gitattributes, .gitignore, .java-version, .mvn/jvm.config, antora-playbook.yaml, package.json, package-lock.json, .github/dependabot.yaml, .github/generate-email.sh and 12 files under .github/workflows/ (13 counted there); src/ exists but is empty.
• Every file except package.json/package-lock.json either carries the ASF Apache-2.0 header (pom.xml, README.adoc, .asf.yaml, .editorconfig, .gitattributes, .gitignore, antora-playbook.yaml, generate-email.sh, all .github/workflows/*.yaml) or is the licence itself; LICENSE.txt is the full 202-line Apache License 2.0 text and NOTICE.txt names 'The Apache Software Foundation'. Files: * (Apache-2.0, 2022-2024 ASF) therefore describes the tree accurately; the year drift against a 2025/2026 release is not noteworthy since ASF headers carry no year.
• package.json and package-lock.json are npm metadata for the Antora site build (dependency names, versions, registry URLs, integrity hashes); they contain no third-party code and are not shipped in the binary, so they raise no licensing question and Files: * covers them as data.
• Files-Excluded lists mvnw*, .mvn/wrapper, src/changelog/* and src/site/*; none of them is still present in the unpacked tree (.mvn/ holds only jvm.config, src/ is empty), so the field is consistent with what was unpacked rather than describing files that remain.
• The pre-scan flagged no file for follow-up: its loose author check found every copyright holder in the tree named in debian/copyright (only The Apache Software Foundation appears).
• NOTICE.txt is installed by debian/libapache-logging-parent-java.docs, satisfying the attribution requirement of Apache-2.0 section 4(d); the licence text itself is reachable through the /usr/share/common-licenses/Apache-2.0 pointer in debian/copyright, as Policy 12.5 sanctions for Apache-2.0.
• debian/maven.rules ('org.apache apache pom s/.*/debian/ * *') resolves in the archive: /usr/share/maven-repo/org/apache/apache/{18,33,debian}/ exist and apache-debian.pom is provided by libapache-pom-java (apache-pom 33-2 per apt-cache), so the parent of the installed POM and the package's Depends: libapache-pom-java are consistent.
• The maven_repo_helper sequence only inserts mh_install after dh_install (/usr/share/perl5/Debian/Debhelper/Sequence/maven_repo_helper.pm); mh_cleanpom runs POMCleaner under java, which maven-repo-helper Depends on, so the Build-Depends set (debhelper-compat, default-jdk, libapache-pom-java, maven-repo-helper) covers the work done.
• Patch 01-disable-error-prone.patch has DEP-3 headers (Description, Author, Forwarded: not-needed) and applies to the shipped pom.xml; after it, pom.xml keeps only the now-unused property <error-prone.version> at line 239 and no -Xplugin:ErrorProne, --should-stop or -XDcompilePolicy argument.
• Standards-Version 4.7.4 against Policy 4.7.4.1 on this system (same first two components, so not an issue) and debhelper-compat 13; changelog is an initial release to unstable closing #1151552, dated Mon, 09 Nov 2026, which is a Monday.
• Binary package libapache-logging-parent-java, Architecture: all, Section: java, Depends: libapache-pom-java, ${misc:Depends}; source format 3.0 (quilt); Homepage and Vcs-* are present and consistent with the upstream URL in pom.xml.
• uscan found the packaged version as the newest upstream release (upstream 12.1.1, packaged 12.1.1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

• pom.xml declares ${revision} with 12.1.1 (upstream's unflattened CI-friendly version). I could not run mh_cleanpom to see whether the installed POM's own and the versioned repository path are resolved to 12.1.1 or left as the literal ${revision}; the --has-package-version copy would still be installed under 12.1.1, so only an extra bogus directory could result.

None.