• Read all of debian/ in full: changelog, control, copyright, rules, gbp.conf, lrc.config, salsa-ci.yml, source/format, source/lintian-overrides, upstream/metadata, patches/series and the patch. debian/watch left alone as instructed.
• Covered the whole upstream tree (45-odd files: Go sources, test fixtures, YAML configs, README, LICENSE) by grepping every file for Licence/Copyright/(C)/©/SPDX/GNU/Apache/MPL/BSD/MIT/ISC/zlib/Artistic/CC-BY/'All rights reserved'. Besides LICENSE and pkg/ndb/ndb.go, no file carries licence wording; all of it is MIT/Expat, which matches debian/copyright.
• pkg/testdata/blob.bin (5.1 KB, binary; not opened, judged from its use): a single RPM header blob. pkg/rpmdb_test.go:1028 (TestNevra) reads it with os.ReadFile and parses it through headerImport/getNEVRA. Test data, deliberately kept and named in debian/copyright's header Comment, covered by Files: *; it is not a built file whose source is missing, and it carries no licence of its own to declare.
• The three holders the pre-scan flagged are not copyright holders: pkg/rpmdb_testcase_test.go:257, :566 and :1260 are rows of a table of expected RPM fields, where the strings are the License/Packages/PGP values of CentOS packages, e.g. "Copyright 1999-2010 the CentOS Project. All rights reserved." and "RSA/SHA1, Thu Aug 16 13:08:48 2012, Key ID 0946fca2c105b9de". debian/copyright's second stanza and its Comment state exactly this, and debian/lrc.config tells licensecheck the same.
• Same for pkg/rpmdb_test.go: the only licence-like words are further table values of the same kind (:749 "MIT and ASL 2.0 and ISC and BSD", :849, :944).
• Files-Excluded is accurate: the 17 pkg/testdata/*/ directories exist but are empty, pkg/testdata/.gitignore is absent, and no excluded path is still present. The shipped golang-github-anchore-go-rpmdb_0.2.0+ds.orig.tar.xz is 172544 bytes, consistent with the excluded databases being gone; nothing undeclared was found in the tree.
• Files: * (Teppei Fukuda, Anchore, Inc.), Files: pkg/rpmdb_test.go pkg/rpmdb_testcase_test.go, Files: pkg/ndb/ndb.go (SUSE LLC) and Files: debian/* (Maytham Alsudany) are ordered so the later stanzas override the catch-all, and each matches the evidence in the file it names; the stand-alone License: Expat text is the same MIT text as LICENSE and pkg/ndb/ndb.go.
• debian/lrc.config is a real file with a real effect: the lrc manual page, under EXCLUSIONS, says 'False positives may suppressed by creating a file debian/lrc.config'.
• The licence names in .bouncer.yaml are an allow-list for dependencies, not code in this tree; .binny.yaml, .chronicle.yaml, .golangci.yaml, .make/* and .github/* are Anchore's own tool configuration, all covered by Files: *.
• Dependencies resolve: dh-go 1.69, golang-modernc-sqlite-dev 1.40.0+dfsg-2 and golang-github-stretchr-testify-dev 1.11.1-2 are all in the archive; grep of every import in the tree shows the only external imports are github.com/stretchr/testify/* (tests) and modernc.org/sqlite (cmd/rpmdb, pkg/rpmdb_test.go), and .make/main.go's import of github.com/anchore/go-make is never built because Go's ./... skips dot-directories.
• Depends: ${misc:Depends} alone is fine at compat 13: the substvar is named, and dpkg strips the field's trailing comma after substitution (Dpkg/Control/HashCore.pm apply_substvars).
• Uploaders in debian/control ends with a stray comma; dpkg accepts a trailing comma in an address list (Dpkg/Email/AddressList.pm's regex ends 'Required address followed by an optional trailing comma'), and the signed .dsc beside the package carries the field without it.
• The skipped tests are the only ones needing the removed data: TestPackageList iterates packageTests (testdata/*/Packages) and TestRpmDB_Package opens testdata/libuuid/Packages; the other seven tests build index entries in memory or read blob.bin. dh-golang's test step passes the extra arguments before the targets, so go test -vet=off -v -p N -skip 'TestPackageList|TestRpmDB_Package' <targets> is well formed, and -skip is supported by the Go in the archive.
• autopkgtest-pkg-go is workable: /usr/bin/dh_golang_autopkgtest copies the source and calls make -f debian/rules build, so the same override_dh_auto_test (and its skip) applies and the missing databases cannot fail the test run.
• The patch's headers (From, Date, Subject, Forwarded: not-needed) and its reasoning check out: only cmd/rpmdb and pkg/rpmdb_test.go blank-import the driver, both drivers register the name 'sqlite', and the build runs in GOPATH mode (GO111MODULE=off in the golang buildsystem), so go.sum is not consulted.
• Changelog: golang-github-anchore-go-rpmdb (0.2.0+ds-1) unstable; urgency=medium, closing #1135321, correctly dated (2026-09-26 was a Saturday). Standards-Version 4.7.4 against Policy 4.7.4.1 is current enough.
• No build, test or command was run (read-only review); no maintainer scripts, install files or autopkgtest control files exist to check.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.2.2, packaged 0.2.0+ds), which is not a fault of the package.

• pkg/ndb/syscall.go and pkg/ndb/syscall_linux.go carry no copyright header, so Files: * attributes them to 2019 Teppei Fukuda / 2025-2026 Anchore, Inc. Whether they came with the SUSE LLC contribution that pkg/ndb/ndb.go declares could not be determined from the package (no VCS history available); if they did, the SUSE Files: stanza should cover the whole pkg/ndb/ directory.
• The contents of pkg/testdata/blob.bin were not inspected byte by byte (binary file); it is described, and used, as a single RPM header blob.
• Whether #1135321 is the correct ITP number could not be checked (no network access).

None.