• The prescan listed no file for follow-up; its holder check reported that every copyright holder it found is named in debian/copyright, which matches my own reading of LICENSE, NOTICE and the file headers.
• Full inventory of upstream files read (src/ 14 files, tests/ 48 files, build.rs, Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, LICENSE, NOTICE, README.md). Every src/*.rs file and the test sources carry the Licensed to the Apache Software Foundation header; a grep for Copyright/(C)/©/SPDX/GNU/Lesser/Mozilla/public domain/All rights reserved/MIT over src/ and tests/ found no other licence or holder.
• LICENSE is the unmodified Apache 2.0 text (202 lines) and is in /usr/share/common-licenses, so the License: Apache-2.0 pointer in debian/copyright is sufficient; NOTICE (ASF 2010-2025, Flavien Raynaud donation) is shipped in the source package and copied into the installed registry by dh-cargo.
• src/case.rs (Code copied from serde <.../serde_derive/src/internals/case.rs>) and src/utils.rs (Copied from serde, originally written by David Tolnay) are covered by the Files: src/case.rs src/utils.rs stanza, which names both Serde Developers and David Tolnay; choosing Apache-2.0 from Serde's MIT/Apache-2.0 dual licence is compatible with the surrounding Apache-2.0 code, so no MIT text is required.
• tests/expanded/*.expanded.rs are macrotest cargo expand snapshots whose generator inputs (the adjacent .rs files, run through tests/expand.rs) are in the package; tests/ui/.stderr are rustc error output for the trybuild cases; tests/derive.proptest-regressions is proptest seed data; Cargo.lock and .cargo_vcs_info.json are cargo metadata. None of these is a build artifact whose source is absent, and none carries licence terms of its own.
• debian/copyright is DEP-5 with the exact copyright-format 1.0 URL; its stanzas are disjoint (Files: *, src/case.rs src/utils.rs, src/lib.rs, debian/*), so ordering does not matter. The Steffen Moeller attribution for the debian_syn3_tests module added by debian/patches/darling-0.24-syn-3.patch is correct and present.
• debian/control: compat 13 (debhelper-compat (= 13)), dh-sequence-cargo, Architecture: any, Multi-Arch: same, Breaks: rustc (<< 1.88.0~) and the versioned Provides are right for a proc-macro crate; the binary Depends list matches the crate's dependencies and features exactly (darling without features, proc-macro2, quote, serde_json +std, syn +full +fold, uuid +serde +std, plus the rustversion build-dependency).
• Every dependency exists at a satisfying version: librust-syn-dev 3.0.9-1 provides librust-syn-3+fold-dev and librust-syn-3+full-dev, librust-darling-dev 0.24.1-1, librust-proc-macro2-dev 1.0.107-1, librust-quote-dev 1.0.47-1, librust-rustversion-dev 1.0.23-1, librust-serde-json-dev 1.0.154-1, librust-uuid-dev 1.29.0-1, librust-serde-dev 1.0.229-1, librust-macrotest-dev 1.2.1-2, librust-proptest-dev 1.11.0-2, librust-pretty-assertions-dev 1.4.1-1+b1, librust-trybuild-dev 1.0.121-1.
• The < !nocheck> markers on the whole Build-Depends-Arch block are correct, not a defect: /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm sub build only copies the sources (compilation happens in sub test, which dh skips under the nocheck profile), so a nocheck build genuinely needs none of them.
• debian/patches: all three patches have DEP-3 headers with Description, Author (Steffen Moeller), Forwarded and Last-Update; the darling/syn 3 port is complete in the sources patched (grep for into_value/Punctuated/parse_terminated in src/ finds nothing left), and the Cargo.toml and Cargo.toml.orig hunks agree. debian/README.source explains why each patch exists, and why no test is removed to break the apache-avro cycle.
• debian/changelog: 0.22.0-1, unstable, urgency medium, ITP closure Closes: #1152656, dated Sat, 31 Oct 2026 (a Saturday). Standards-Version 4.7.4 has the same first two components as the reviewing system's Policy 4.7.4.1, so it is current.
• debian/tests/control: three cargo-auto-test stanzas (--all-targets --all-features, --all-targets, --all-targets --no-default-features) pull the dev-dependencies the tests need (apache-avro +derive, macrotest, proptest, pretty-assertions, serde +derive +std, trybuild, rustversion) plus dh-cargo (>= 33~) (which Depends cargo) and @ for the built package; the nightly-only snapshot tests are ignored on stable by #[rustversion::attr(not(nightly), ignore)] in tests/expand.rs and tests/ui.rs, as README.source states.
• debian/copyright.debcargo.hint is debcargo's generated template, superseded by the hand-written debian/copyright; it is not installed in any binary package and raises no licensing question (debian/* is covered by its own stanza).
• uscan found the packaged version as the newest upstream release (upstream 0.22.0, packaged 0.22.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

• librust-apache-avro-0.22+derive-dev, which all three autopkgtest stanzas depend on, is not in the reviewing system's package lists nor among the uploads in the NEW queue as of 2026-10-31. debian/README.source says the parent apache-avro library is prepared alongside this crate, so it is probably another package of the same stack, but I could not confirm that it exists.
• I could not build the package or run its suite; README.source's report of 99 passing all-target tests could not be rechecked.

None.