• Inventory: read the whole upstream tree (169 files per the prescan) and all of debian/ except debian/watch; no binary, font, image, minified or archive files are present.
• debian/copyright is DEP-5 with the exact 1.0 Format URL; Files: * (Shopify 2025-2026, Expat) and debian/* (Simon Quigley, Expat) match LICENSE.txt and the absence of any other copyright headers; the Expat text is complete.
• THIRD_PARTY_LICENSES.html: generated by cargo-about from rust/Cargo.lock, rust/about.toml and rust/about_templates/about.hbs (all shipped); it lists the licences of the Rust crate dependencies (Apache-2.0, Unicode-3.0, MIT, BSD-2/3-clause, BSL-1.0, ISC) and the MinGW runtime. The holders the prescan names in it are those crates' authors, not authors of files in this source package.
• rust/about_templates/mingw_licenses.hbs: licence-notice template for the MinGW-w64 runtime and GCC used only for Windows precompiled builds; the GPL-3/LGPL-2.1 text and the FSF, Lucent, Sun, NetBSD, David Gay, Rich Felker, etc. notices in it are quoted licence texts, not code compiled or shipped here.
• lib/rubydex/rules/*.rb are generated by rust/rubydex/src/bin/generate_ruby_rules.rs, which is present.
• No DFSG problem found: no non-commercial, no-modification, field-of-use or other non-free terms; only permissive licences appear in the tree and in the generated third-party listing.
• Build-Depends checked with apt-cache: dh-cargo 34 (>= 32~), gem2deb 2.2.10 (>= 2.2.8~), libclang-dev, librust-bindgen-0.72, librust-cbindgen-0.29, bitflags, bytecount, cc, clap+derive, crossbeam-*, glob, libc, line-index, serde+derive, toml-1, url-2, xxhash-rust+xxh3 all exist; librust-ruby-prism-2+default-dev is built by rust-ruby-prism 2.1.0-1 and ruby-rbs 4.2.0-1 is in NEW.
• Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 in its first two components.
• Built-Using/Static-Built-Using are valid binary fields (deb-control(5) documents Static-Built-Using), and dh-cargo-built-using writes both from the deps/*.d files under debian/cargo-target, consistent with debian/rules and debian/dh_ruby.rake.
• Patches: all four have DEP-3 headers (Description/Author/Origin/Forwarded/Last-Update) and are listed in series; the dev-dependency removal is safe because the removed crates (tempfile, tikv-jemalloc*) are used only under cfg(test), cfg(feature = "test_utils") or in benches, and jemalloc is feature-gated.
• debian/ruby-tests.rb, Testsuite: autopkgtest-pkg-ruby, the rdx.1 manpage and debian/ruby-rubydex.manpages are consistent; changelog version 0.4.4-1 matches upstream.
• uscan found the packaged version as the newest upstream release (upstream 0.4.4, packaged 0.4.4).

• The apt-cache NEW list is a snapshot of 2026-11-09T00:06:05Z; if rust-cypher-parser and rust-ruby-rbs were uploaded after that, the two missing Build-Depends would become satisfiable and the issue above would disappear.
• Whether debian/dh_ruby.rake is picked up in the exact install-stage order assumed by gem2deb could not be checked because gem2deb is not installed on the reviewing system; if it is not, ${cargo:Built-Using} would stay unset.
• Could not run a build, so the cargo/dh-cargo output paths (debian/cargo-target/release/librubydex_sys.so) and the ruby extension directory find pattern in execute_after_dh_auto_install were only reasoned about.

None.