• LICENSE: full Apache License 2.0 text, unmodified; the appendix is unfilled (Copyright [yyyy] [name of copyright owner]), which the Files: * Comment in debian/copyright records. This is the only licence text in the tree.
• Grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU ..., Apache License, Mozilla Public, public domain over the tree (excluding .pc/) returns hits only inside LICENSE's own Apache wording plus the reformatted licence paragraph in debian/copyright; no file carries its own copyright or licence notice, so there is no holder for debian/copyright to omit. The pre-scan's author check agrees.
• version.go, constraint.go, version_collection.go, *_test.go are original Go code; comments merely link to the RubyGems version.rb/requirement.rb sources, and nothing is copied from them, so no RubyGems attribution is needed.
• Other upstream files — .gitignore, README.md, go.mod, go.sum, .github/workflows/test.yml, examples/{comparison,constraint,sort}/main.go — are ordinary configuration/documentation/code under the same Apache-2.0; they are matched by Files: *.
• debian/* is covered by the Files: debian/* stanza (2026 Juan Manuel Méndez Rey, Apache-2.0); debian/salsa-ci.yml is the five-line Salsa CI include template with no separate authorship.
• No binary, generated, minified or vendored content anywhere in the tree; no vendor/ directory. The orig tarball (go-gem-version/: .github/, .gitignore, constraint.go, constraint_test.go, examples/, go.mod, go.sum, LICENSE, README.md, version.go, version_collection.go, *_test.go) matches the reviewed tree, and the debian tarball contains only the files present under debian/ — no debian/patches and no .pc/ in either tarball.
• Build dependencies checked with apt-cache: dh-go 1.69 (provides dh-sequence-golang), golang-github-aquasecurity-go-version-dev 0.0~git20210121.637058c-2 (the rewritten module that carries pkg/part, which version.go imports), golang-github-stretchr-testify-dev 1.11.1-2, golang-golang-x-xerrors-dev, and dpkg-dev 1.23.11 providing dpkg-build-api (= 1). All are in the archive and satisfiable.
• dpkg-build-api (= 1) makes Rules-Requires-Root default to no (man dpkg-build-api: "dpkg-buildpackage defaults to Rules-Requires-Root value no"), so its absence from debian/control is not a fault.
• --with=golang is redundant because dh-go provides dh-sequence-golang, but harmless; the golang buildsystem and dh_golang both exist at the declared dependency (/usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm, /usr/bin/dh_golang).
• The test step needs testify: dh_auto_test runs go test -v on the build targets, the <!nocheck> marking is right at compat 14.
• The package declares Testsuite: autopkgtest-pkg-go with no debian/tests/control, which is the pkg-go convention; autopkgtest is not installed on the reviewing system, so I did not verify how that suite is resolved (see unconfirmed).
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20201115.8eed6fe, packaged 0.0~git20201115.8eed6fe).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

• Whether anyone other than Teppei Fukuda appears in the upstream commit history cannot be checked from the package; debian/copyright's holder and its Comment rest on the maintainer's statement about the upstream history.
• The ITP number #1152492 in the changelog and the two Vcs-* URLs were not verified (no network access).
• How autopkgtest handles Testsuite: autopkgtest-pkg-go without debian/tests/control could not be checked here; the autopkgtest document shipped with Policy lists implicit control files only for Ruby and Perl, but autopkgtest itself is not installed.

None.