• debian/copyright is DEP-5 with the exact 1.0 Format URL; its three stanzas (Files: , Files: debian/, stand-alone License: Expat) agree with the tree, and the Expat text is complete.
• A tree-wide grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public, GNU Lesser, Apache License, Mozilla Public, public domain and All rights reserved returns only LICENSE and debian/copyright; a second grep for MIT/BSD/Apache/GPL/MPL/ISC/Creative Commons/CC0 hits only LICENSE's own title. The prescan's author check over 486 files also found every holder already named.
• The prescan listed no built files, minified code, PDFs or unusual licence wording for this package, and a glob for png/jpg/gif/pdf/zip/tar/gz/so/a/wasm/bin/o/exe/jar/class/font files found none: the tree is Go sources, Markdown, YAML, shell/perl scripts and one test key.
• The _gen.go files (formatkind_string_gen.go, jwa/_gen.go, jwe/_gen.go, jwk/_gen.go, jws/_gen.go, jwt/_gen.go, jwt/openid/*_gen.go) are generated Go sources whose generator is present at internal/jwxcodegen/cmd/jwxcodegen (driven by scripts/jwxcodegen.sh) and whose inputs are present at jwa|jwe|jwk|jws|jwt/objects.yml and */options.yaml; formatkind_string_gen.go is produced by the golang.org/x/tools/cmd/stringer tool declared in go.mod.
• docs/*.md and README.md carry their Go examples inline between <!-- INCLUDE(examples/...) --> / <!-- END INCLUDE --> markers; the examples live in the separate jwx-go/examples repository and are linked, not needed, so the shipped documentation is complete rather than built from absent files.
• jwk/testdata/rs256.jwk is a single test key (data, covered by Files: *), not code or a built artefact.
• No patches: debian/patches does not exist, so there is no series or DEP-3 question; the .pc/ directory (quilt bookkeeping) was not examined.
• Go 1.27 is what unstable has (golang-go 2:1.27~1), and /usr/lib/go-1.27/src/encoding/json/v2 and /usr/lib/go-1.27/src/crypto/mldsa exist with the mldsa.Parameters/MLDSA44() API jws/mldsa.go and jwk use, so the GOEXPERIMENT=jsonv2 that upstream's AGENTS.md requires only on Go 1.26 need not be set in debian/rules and go.mod's go 1.26.10 is satisfied.
• dh-golang builds in GOPATH mode with GO111MODULE=off (golang.pm _set_go111module), so the nested module cmd/jwx/go.mod is irrelevant and the jwx binary is built from github.com/lestrrat-go/jwx/v4/...; DH_GOLANG_EXCLUDES := internal/jwxcodegen keeps the generator, which imports unpackaged goccy/go-yaml and lestrrat-go/codegen, out of both build and install.
• dedebhelper compat 14: dh_gencontrol adds relationship substvars itself, so no ${misc:Depends}/${shlibs:Depends} in the binary stanzas is correct, and Policy (A10.3, 4.7.3) says Priority should not be given when it is optional. Standards-Version 4.7.4 is current against Policy 4.7.4.1.
• The man page is generated into debian/tmp/usr/share/man/man1/jwx.1 by execute_before_dh_installman-arch (only when the nodoc profile is off, and help2man is <!nodoc> in Build-Depends) and picked up by jwx.manpages usr/share/man/man1/*.1; under nodoc dh_installman silently ignores the unmatched glob (/usr/bin/dh_installman sets glob_expand_error_handler_silently_ignore when the nodoc profile or build option is active), so no build fails either way.
• Testsuite: autopkgtest-pkg-go is served by autodep8's go template, which runs dh_golang_autopkgtest with Depends: @, @builddeps@, so cmd/jwx's golang.org/x/{crypto,term} and urfave/cli dependencies are installed for the test build even though they are not in the -dev Depends.
• uscan found the packaged version as the newest upstream release (upstream 4.6.0, packaged 4.6.0).

• golang-github-lestrrat-go-option-v3-dev (go.mod requires github.com/lestrrat-go/option/v3 v3.0.0-alpha1) is not in the review system's package lists and was not found among the NEW uploads as of 2026-11-12T19:04Z; only golang-github-lestrrat-go-option-dev 2.0.0-3 exists. If the v3 package has not been accepted, both Build-Depends and the -dev Depends are unsatisfiable and nothing builds.
• The lists have golang-github-lestrrat-go-dsig-dev 1.0.0-2 only; whether dsig 1.4.0 has been uploaded since could not be checked, which is why the missing version constraint is reported as a dependency defect rather than as a certain build failure.
• help2man is not installed on the reviewing system, so the generated jwx.1 could not be inspected; the archive has help2man 1.49.3, which honours SOURCE_DATE_EPOCH.

None.