• The pre-scan listed no files to account for: it ran only an author check, which reported that every copyright holder it found is named in debian/copyright. I re-checked this by grepping the tree for Copyright, (C), SPDX-License-Identifier, GNU, Apache License, Mozilla Public, public domain, All rights reserved: the only hits are LICENSE and debian/copyright{,.debcargo.hint}.
• LICENSE is the MIT text with Copyright (c) 2022-2025 Frank Denis; it matches the Files: * stanza (holder and years) and the stand-alone License: MIT paragraph in debian/copyright, and matches Cargo.toml's license = "MIT" / authors = ["Frank Denis <github@pureftpd.org>"] (Cargo.toml.orig identical).
• Whole upstream tree enumerated (9 non-debian files): .cargo_vcs_info.json, .gitignore, Cargo.lock, Cargo.toml, Cargo.toml.orig, LICENSE, README.md, .github/workflows/ci.yml, src/lib.rs. Cargo.toml and Cargo.lock are cargo-registry generated files whose input (Cargo.toml.orig) is present; .cargo_vcs_info.json just records the upstream git sha1.
• .github/workflows/ci.yml is a GitHub CI recipe (MIT-covered by Files: *, no separate terms); it only names third-party actions, no code from them is vendored.
• src/lib.rs has no licence header and its #[cfg(test)] module uses nothing outside the crate; the crate declares no dependencies or dev-dependencies, so nothing is vendored and no external licence is involved.
• No binary or non-preferred-form files in the tree: no .so/.o/.a/.jar/.class/.pyc/.dll/.exe, no minified JS/CSS, no images, fonts or firmware.
• No debian/patches directory and an empty quilt series (.pc/.quilt_patches names debian/patches, .quilt_series is empty), so no patch or DEP-3 concerns.
• Standards-Version 4.7.4: current Policy is 4.7.4.1 per the policy tool, so the first two components match - not an issue.
• Build-Depends: debhelper-compat (= 13), dh-sequence-cargo; apt-cache shows dh-cargo 34 (Provides: dh-sequence-cargo, Depends: cargo, debhelper, python3), so dh-sequence-cargo resolves. Build-Depends-Arch cargo:native <!nocheck>, rustc:native <!nocheck>, libstd-rust-dev <!nocheck> is right: at compat 13 dh skips the dh_auto_test override under nocheck, and in dh-cargo's buildsystem only the test step runs the compiler (/usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm: build only copies sources, test runs cargo), so a nocheck build needs no Rust toolchain.
• debian/rules is the standard two-line override; override_dh_auto_test: dh_auto_test -- test --all reaches cargo.pm's test sub, which runs cargo test, i.e. dh-cargo's compile check. Depends: ${misc:Depends} is present; the package ships no shared library, so no ${shlibs:Depends} is owed. No maintainer scripts exist.
• debian/tests/control uses /usr/share/cargo/bin/cargo-auto-test, which exists in this system's /usr/share/cargo/bin (alongside cargo and dh-cargo-built-using); dh-cargo (>= 33~) is a sufficient dependency for it.
• debian/changelog: rust-binstring (0.1.8-1), unstable, urgency=medium, Closes: #1151620, dated Sun, 25 Oct 2026 (which is indeed a Sunday); source format 3.0 (quilt); debian/upstream/metadata names the crates.io archive and repository.
• debian/copyright.debcargo.hint is debcargo's own leftover template (contains FIXME (overlay) UNKNOWN-YEARS); it is matched by the Files: debian/* MIT stanza and is not installed into the binary package (cargo.pm's get_sources excludes debian from the crate registry copy). Its FIXMEs were resolved in debian/copyright, which records the real holder and years.
• uscan found the packaged version as the newest upstream release (upstream 0.1.8, packaged 0.1.8).

• No build or autopkgtest run was possible in this read-only review; nothing in the package itself indicates a build or test failure (no missing file named by debian/rules, no Build-Depends that cannot be satisfied).

None.