• debian/copyright read in full: DEP-5, Files: * (Expat), a dronecan/dsdl_specs/* stanza and a debian/* stanza; the Expat text is given in full since it is not in /usr/share/common-licenses.
• Files: * holders (2014-2015 Pavel Kirienko; 2014-2016, 2019 UAVCAN Development Team; 2014-2018, 2023 DroneCAN Development Team; 2022 DroneCAN Development Team <uavcan.org>) cover every per-file header found in the tree, including dronecan/version.py (2014-2018 DroneCAN Development Team) and dronecan/driver/mavcan.py (2022 DroneCAN Development Team <uavcan.org>).
• Every Python file in dronecan/, dronecan/app, dronecan/driver, dronecan/dsdl, test/ and setup.py begins with the header This software is distributed under the terms of the MIT License; tools/dronecan_bridge.py has no header and is covered by Files: * and the root LICENSE (Expat, Pavel Kirienko 2014-2015).
• dronecan/dsdl_specs/: ~170 .uavcan files in the uavcan, dronecan, ardupilot, com, cuav and mppt namespaces, verified to come from the orig tarball (e.g. python-dronecan_1.0.27+ds1.orig.tar.xz:dronecan-1.0.27/dronecan/dsdl_specs/uavcan/Timestamp.uavcan), not added by the packager. They carry no per-file notices, so the dsdl_specs stanza (Pavel Kirienko, Expat) is not contradicted by anything in the tree.
• Grep across the whole tree for copyright, (C), ©, SPDX-License-Identifier, GNU, Apache, MPL, public domain, all rights reserved, non-commercial, no-modification, patent and field-of-use wording found only the Expat notices and the copyright file's own text; no second licence anywhere.
• The prescan's author check (every holder found is named in debian/copyright, 184 files scanned) was confirmed against my own read of all 31 copyright headers; the scan listed no individual file for me to account for.
• No built, minified, archived, PDF or bytecode files are present: the only non-source files in the tree are the upstream sdist's PKG-INFO, setup.cfg, pyproject.toml, MANIFEST.in and README.md, all text from the orig tarball. No vendored third-party library.
• The orig tarball contains no dronecan.egg-info directory (member lookup failed), so Files-Excluded: dronecan.egg-info/* and README.source's account of the +ds1 repack agree with what was shipped.
• Patch self-contained-source-metadata.patch: DEP-3 headers present, context matches the orig tarball (MANIFEST.in is 36 bytes = recursive-include ../DSDL/ *.uavcan, pyproject readme is README.txt), and both edits are necessary for the unpatched sdist to build (README.txt does not exist; README.md does).
• debian/rules: execute_after_ hooks are supported by dh (Dh_Lib/SequencerUtil.pm runs them after the command); dh_python3 is inserted before dh_installinit by the python3 sequence, so the rename in execute_after_dh_auto_install precedes shebang rewriting, and the chmod in execute_after_dh_fixperms lands after dh_fixperms and before dh_md5sums.
• Runtime imports read module by module: only stdlib at module import, with pymavlink, python-can and pyserial imported inside try/except (driver/init.py, python_can.py, slcan.py, mavcan.py), so Recommends: python3-serial and Suggests: python3-can, python3-pymavlink are correct and not missing dependencies.
• debian/tests: installed changes to $AUTOPKGTEST_TMP before running the suite and check-installed.py, so import dronecan resolves to the installed package rather than the source tree; check-installed.py's assertions on the six namespaces and on TYPENAMES match files present. allow-stderr is needed because unittest writes to stderr.
• Packaging files read: control, rules, changelog (1.0.27+ds1-1, unstable, closes #1153037), source/format (3.0 quilt), source/options, patches/series and the patch, tests/control and both test files, gbp.conf, README.source, python3-dronecan.docs/.manpages, upstream/metadata, salsa-ci.yml, dronecan-bridge.1 (installs as man1/dronecan-bridge.1, matching the renamed /usr/bin/dronecan-bridge).
• Standards-Version 4.7.4 is current: the installed Policy is 4.7.4.1 (/usr/share/doc/debian-policy/policy.html/index.html).
• uscan found the packaged version as the newest upstream release (upstream 1.0.27, packaged 1.0.27+ds1).

• The salsa repository's branch layout (gbp.conf debian-branch = main, Vcs-Git/Vcs-Browser) and the ITP bug number in the changelog cannot be checked without network access.
• The upstream DroneCAN DSDL repository's LICENSE, cited in the dsdl_specs Comment, was not fetched; the conclusion on those files rests on their having no notices in the tree and on the parent project's LICENSE.
• The exact file modes of the .uavcan data in the tarball (which would explain the chmod in debian/rules) could not be inspected, as file permissions are not exposed by the read tools.

None.