• Prescan: the author check reports "every holder found is named in debian/copyright" and lists no files, so there is nothing from the scan left unaccounted for.
• Complete tree inventory by glob with gitignore off (excluding .pc/ and debian/cargo-checksum.json): 13 top-level upstream files, .cargo/config.toml, .github/workflows/ci.yml, contrib/nostr-rs-relay.service, docs/ (6 markdown files), proto/nauthz.proto, src/ (23 files), tests/ (4 files), debian/ (28 files). All read or listed.
• Licence evidence: the only notices in the tree are LICENSE (The MIT License (MIT) / Copyright (c) 2021 Greg Heartsfield), Cargo.toml and Cargo.toml.orig (license = "MIT") and README.md:162 (This project is MIT licensed.). Greps for Copyright, (C), ©, SPDX-License-Identifier, "Permission is hereby granted", GNU/LGPL/Apache/MPL, public domain, All rights reserved found nothing else; greps for non-commercial, no-modification, field-of-use, CC-BY-NC/ND and patent terms found nothing.
• No images, fonts, PDFs, archives, minified JavaScript or wasm anywhere in the tree (glob over those extensions returns nothing), so no asset of unclear provenance needed judging.
• debian/copyright is DEP-5 with the canonical Format URL, Files stanzas in the right order (Files: * then Files: debian/*), © holders (Greg Heartsfield 2021; Debian Rust Maintainers and PaulLiu 2026) that match LICENSE and debian/man/*.md (Copyright © 2026 Ying-Chun Liu (PaulLiu)), and the standalone MIT text matching LICENSE.
• proto/nauthz.proto carries no separate notice and is the project's own gRPC schema (described in docs/grpc-extensions.md, compiled by build.rs and used from src/nauthz.rs), so the Files: * MIT stanza covers it correctly.
• debian/copyright.debcargo.hint is debcargo's generation template (it still carries debcargo's FIXME (overlay) UNKNOWN-YEARS / UNKNOWN-LICENSE; FIXME (overlay) placeholders); it is not installed in any binary package — only debian/copyright is — and the reviewed debian/copyright is the accurate one.
• Build wiring: dh $@ --buildsystem cargo at compat 13; dh_installsysusers is only in the default sequence from compat 14 (debhelper tool), so the explicit dh-sequence-installsysusers is required and correct; dh_missing defaults to --fail-missing at compat 13, and reading /usr/share/perl5/Debian/Debhelper/Buildsystem/cargo.pm shows install() writing the registry copy into debian/librust-nostr-rs-relay-dev/usr/share/cargo/registry/nostr-rs-relay-0.8.12 and the binaries into debian/nostr-rs-relay, so nothing is left in debian/tmp.
• dh_installsysusers adds systemd | systemd-standalone-sysusers | systemd-sysusers to misc:Depends (/usr/bin/dh_installsysusers), and nostr-rs-relay has ${misc:Depends}; dh_installdeb auto-detects /etc files as conffiles, so the dh-exec line in nostr-rs-relay.install really makes /etc/nostr-rs-relay/config.toml a conffile as README.Debian and the man page say; dh_installdocs installs debian/.README.Debian automatically.
• Patches: all nine have DEP-3 Description/Author/Forwarded/Last-Update headers, only 0001 touches Cargo.toml (checked by grep), and the forward ports match the crate versions in the archive (secp256k1 0.33.1, bech32 0.11.0, rusqlite 0.40.2, sqlx 0.9.0, tungstenite 0.28.0, hyper 1.11.1, tonic 0.14.5, prost-build 0.14.4), all checked with apt-cache; librust-prost-build-dev Depends on protobuf-compiler, so build.rs gets protoc transitively and the missing explicit Build-Depends is not a fault.
• Test/automation equipment: dh-cargo 34 provides dh-sequence-cargo and /usr/share/cargo/bin/cargo-auto-test, satisfying the documented dh-cargo (>= 33~); librust-anyhow-1+default-dev is the crate's only dev-dependency and is in the autopkgtest Depends rather than Build-Depends, which is right because the cargo buildsystem's test step runs cargo build.
• Control metadata: Standards-Version 4.7.4 against Policy 4.7.4.1 (current), correct Section/homepage/Vcs-*/X-Cargo-Crate fields, changelog version 0.8.12-1 for orig 0.8.12 on unstable signed by the Uploader, and the man pages and README.Debian agree with src/cli.rs (--config/--db), src/main.rs (config errors exit 1, default config.toml missing falls back with a warning), src/config.rs (section and default names) and the unit (User=nostr-rs-relay, StateDirectory matching the conffile's data_directory, installed with --no-start --no-enable).
• uscan found the packaged version as the newest upstream release (upstream 0.8.12, packaged 0.8.12).

• Build-Depends names librust-nostr+nip04-dev, +std-dev and +os-rng-dev (>= 0.18.0), but nothing in the archive lists or in the NEW queues provides them, nor is there a librust-nostr-dev or librust-nostr-0.45-dev; if rust-nostr has not been accepted since the lists were downloaded, a clean-chroot build cannot start.
• autopkgtest is not installed on the reviewing system, so I could not check that Architecture: !riscv64 in the third debian/tests/control stanza is a field the tester accepts; the autopkgtest specification shipped with Policy does not list an Architecture field and says unknown fields make the tester skip the stanza, while the same document is old enough to say there are no defined Features although Features: test-name= is standard.
• I could not build the package or run its tests, so the forward-port patches were judged from their text and from the crate versions in the archive, not from a compile.

None.