• debian/copyright read in full: DEP-5 with the canonical Format: URL, Files: * (CC0-1.0, Steven Roose), Files: debian/* (CC0-1.0, Debian Rust Maintainers and Ying-Chun Liu), and a License: CC0-1.0 paragraph pointing at /usr/share/common-licenses/CC0-1.0; that file exists in /usr/share/common-licenses.
• The only licence text in the tree is the upstream LICENSE, which is the CC0 1.0 Universal legal code; crate metadata agrees (license = "CC0-1.0" in both Cargo.toml and Cargo.toml.orig).
• The only per-file copyright notice is src/lib.rs:1-12 ("Written in 2020 by Steven Roose", CC0 dedication); src/pbkdf2.rs, src/language/*.rs, benches/bench.rs, README.md, CHANGELOG.md, contrib/test.sh, .github/workflows/*.yml and the dotfiles carry none and fall under Files: *. The ten src/language/*.rs files are bare pub const WORDS: [&str; 2048] arrays without comments or notices.
• Tree-wide grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public/Lesser, Apache License, Mozilla Public, public domain, All rights reserved, non-commercial, no modification, not evil, field of use: only the CC0 wording in src/lib.rs; no LICENSE/COPYING/NOTICE/AUTHORS anywhere but the top-level LICENSE.
• debian/ and the .dsc agree (rust-bip39 3.0.0-1, Maintainer/Uploaders, Vcs-*, Homepage); debian/control and debian/rules are unmodified debcargo output apart from the overlay uploader, and debian/source/format is 3.0 (quilt).
• Dependencies checked with apt-cache show: librust-bitcoin-hashes-dev 1.0.0-1 (satisfies >= 0.12, and provides +default/+hex), librust-rand-dev 0.10.3+ds-1 (provides librust-rand+default-dev, satisfies >= 0.7.0), librust-rand-core-dev 0.10.1-1 (satisfies >= 0.4.0), librust-serde-dev 1.0.229-1 (provides +alloc/+std), librust-unicode-normalization-dev 0.1.26-1 (satisfies >= 0.1.22), librust-zeroize-dev 1.9.0-2 (provides +zeroize-derive, satisfies >= 1.5), librust-serde-test-dev 1.0.177-1 for the autopkgtests, and dh-cargo 34 (provides dh-sequence-cargo, satisfies >= 33~).
• The Build-Depends-Arch <!nocheck> restrictions are correct for this build system: cargo.pm's build only copies sources and the compilation happens in its test step (cargo build), which at compat 13 is skipped under nocheck; compat 13 also means ${misc:Depends} must be written out, and it is.
• debian/tests/control holds 19 configurations; the all-languages and unicode-normalization ones, which debian/debcargo.toml documents as upstream breakage (Mnemonic::to_entropy/Cow need alloc), are the two given Restrictions: flaky, while the @ configuration runs --all-features with default features on, so alloc/std are present.
• Patches 0001-relax-dependencies, 0002-port-to-bitcoin-hashes-1.0, 0003-port-to-rand-0.10 are listed in patches/series in order, each has Description/Forwarded/Author/Last-Update, and the tree matches them (Cargo.toml relaxed bounds, as_byte_array/HmacEngine<sha256::HashEngine>/SysRng/TryCryptoRng present in src/).
• debian/changelog: unstable, version 3.0.0-1, dated Sun, 01 Nov 2026 (a Sunday), signed-off by the Uploader in debian/control; Standards-Version: 4.7.4 matches Policy 4.7.4.1 in its first two components.
• debian/copyright.debcargo.hint read: it is debcargo's overlay template (still containing the FIXME (overlay) UNKNOWN-YEARS placeholder and explaining that upstream years came from git), it is not installed into the binary package, and the actual debian/copyright fills the year in.
• No built files, minified code, PDFs, archives or vendored third-party trees are present; Cargo.lock/Cargo-minimal.lock reference only crates.io registry sources, are regenerable lock files rather than build products, and Cargo.lock is deleted by the cargo buildsystem's configure step. The prescan's author check found every holder it spotted named in debian/copyright, which matches my own reading of the tree.
• uscan found the packaged version as the newest upstream release (upstream 3.0.0, packaged 3.0.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC0-1.0).

• No build or test run was possible, so the API ports in the patches (bitcoin_hashes 1.0's as_byte_array/HmacEngine<sha256::HashEngine>/HmacEngine::finalize, rand 0.10's SysRng/TryCryptoRng) are taken to compile from their patch descriptions and the archive's library versions only.
• The origin of the ten BIP-39 word lists beyond the crate's single CC0 LICENSE (they are the word lists of BIP-0039) could not be checked offline; no file in the tree carries a notice that debian/copyright would have to reproduce.

None.