• Coverage: all 235 files of the source tree (everything except .pc/) were searched, by grep for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Apache/MPL/public domain/All rights reserved, and by reading debian/copyright, LICENSE and extern/robin_hood/robin_hood.h in full.
• The prescan's author check reports that every holder it found is named in debian/copyright; it listed no individual file, and the only holders in the tree are Martin Ankerl (extern/robin_hood/robin_hood.h, Copyright (c) 2018-2021 Martin Ankerl, SPDX-License-Identifier: MIT) and the unnamed Copyright (c) 2026 in LICENSE, both represented.
• extern/robin_hood/robin_hood.h is a vendored, header-only robin-hood hashtable under MIT; Debian ships no robin-hood package (apt-cache finds none), so the copy is not a duplicate of an existing library, and its own Files stanza plus the shared MIT text cover it.
• extern/zstd, extern/fse, extern/pybind11 and extern/cuCollections are empty submodule directories listed in .gitmodules; no third-party source is vendored there. The build uses the system libzstd (default GFAZ_USE_SYSTEM_ZSTD=ON, libzstd-dev) and the system pybind11 (patch 0001), so Files: * des not leave any file misdescribed.
• No built artefacts or opaque files: glob for .o/.so/.a/.pyc/pycache/CMakeCache.txt/CMakeFiles/compile_commands.json/install_manifest.txt and for images, PDFs, fonts and archives returned nothing; example.gfa, tests/fixtures/.gfa|.bed and tests/golden/* are small hand-made or tool-generated test data, not third-party material with its own terms.
• No non-free wording anywhere (non-commercial, research/academic-only, no-modification, field-of-use, CC-*-NC/-ND, 'All rights reserved'): no matches in the tree.
• debian/copyright uses the correct DEP-5 Format URL; its three stanzas (*, extern/robin_hood/*, debian/*) and the single stand-alone MIT paragraph are valid for copyright-format 1.0, and MIT is not in /usr/share/common-licenses so reproducing it is required and done.
• Upstream names no copyright holder anywhere (LICENSE line 3 is only Copyright (c) 2026); debian/copyright's 'The GFAz authors (see LICENSE)' is therefore as specific as the upstream evidence allows, rather than a wrong or omitted entity.
• Packaging checks read in full: control, rules, changelog, copyright, source/format, all .install/.examples/.docs files, README.test, tests/control and tests/run-unit-test, upstream/metadata, salsa-ci.yml, libgfaz0.lintian-overrides, and the three patches with their series.
• Build inputs exist: pybind11-dev 3.1.0-2, libzstd-dev 1.5.7, pkgconf, cmake, python3-dev, debhelper-compat (= 14), and dh-sequence-python3 (provided by dh-python 7); debhelper passes CMAKE_INSTALL_PREFIX=/usr and CMAKE_INSTALL_LIBDIR=lib/ itself, so libgfaz0.install/libgfaz-dev.install's usr/lib/*/ patterns match what is installed.
• Package split matches the installed paths: the patched CMakeLists installs only /usr/bin/gfaz, the three libgfaz_*.so.0/.so.0.0.0 and .so links, the three .a archives, /usr/include/gfaz (including robin_hood.h) and, from rules, the python extension in dist-packages; each is matched by exactly one of gfaz.install, libgfaz0.install, libgfaz-dev.install or python3-gfaz.install, so dh_missing has nothing left and dh_python3 processes the module.
• Dependencies follow that split: dh_makeshlibs generates the libgfaz0 shlibs entries and dh_shlibdeps turns them into a versioned libgfaz0 dependency of gfaz and python3-gfaz; libgfaz-dev depends libgfaz0 (= ${binary:Version}) and libzstd-dev (headers use zstd and robin_hood.h); gfaz-examples depends on gfaz and python3-gfaz, the two things its runner needs.
• Patches 0001-0003 all carry Description/Origin/Last-Update/Forwarded DEP-3 headers, their content matches the applied tree, and 0003 is what makes tests/regression/regression_utils.py honour GFAZ_BIN, so debian/tests/run-unit-test (which exports GFAZ_BIN=/usr/bin/gfaz) exercises the installed binary; the autopkgtest also finds the installed gfa_compression module through sys.executable, so the binding suite is not skipped.
• The examples install ships example.gfa and the whole tests/ tree (fixtures and goldens) that the harness needs, and the suite is also registered as a CTest test, so it runs in the build; no test or CMake code reaches the network (no urllib/requests/curl/wget/FetchContent/ExternalProject).
• policy 8.1 permits merging several shared libraries into one package 'provided that all of their SONAMEs will always change together'; the three gfaz libraries are built with one SOVERSION and one version and the lintian override documents that, so the libgfaz0 name is justified.
• Standards-Version 4.7.4 is current (policy is 4.7.4.1); compat 14 and the override targets (dh_auto_configure, dh_auto_install, dh_installexamples) are used correctly, and since compat 13 dh skips dh_auto_test under nocheck by itself, which this package does not need to handle.
• Changelog is sane: unstable, version 0.0~git20260915.f1c1b7f-2 following the -1 initial upload, weekday/date pairs correct, #1151944 closed in the initial entry, and the -2 entry describes the new shared/static library split.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20260915.f1c1b7f, packaged 0.0~git20260915.f1c1b7f).

• File permissions could not be inspected with the available tools (debian/rules and debian/tests/run-unit-test must be executable); a build or autopkgtest run would show any missing bit.
• libgfaz-dev also installs the CUDA-only headers under include/compress/gpu/ although the libraries are configured with ENABLE_CUDA=OFF, so those declarations have no implementation in the shipped binaries; this is unused surface rather than a packaging rule violation, and a consumer would only notice by trying to link against them.

None.