• The prescan's only output was the dfsg-author-check, which found every copyright holder it matched named in debian/copyright; it listed no built files, minified code, PDFs, non-free wording or other files to account for.
• All 52 upstream files were inventoried: src/ (including src/bin/bulkloader.rs, src/repo/, src/payment/), tests/, docs/*.md, proto/nauthz.proto, contrib/nostr-rs-relay.service, .github/workflows/ci.yml, .cargo/config.toml, build.rs, Cargo.toml, Cargo.toml.orig, Cargo.lock, config.toml, Dockerfile, README.md, LICENSE, rustfmt.toml, .pre-commit-config.yaml, .build.yml, .cargo_vcs_info.json, .gitignore.
• No file under src/, tests/, docs/, proto/, contrib/, .github/ or .cargo/ carries a copyright, SPDX or licence notice, so the single Files: * MIT stanza is right; LICENSE is the same MIT text as the stand-alone License: MIT paragraph in debian/copyright, and Cargo.toml says license = "MIT".
• debian/copyright is DEP-5 with Format, Upstream-Name, Upstream-Contact, Source, a Files: * stanza, a Files: debian/* stanza naming the Debian Rust Maintainers and Ying-Chun Liu (PaulLiu), and a full MIT licence paragraph; the debian/* man pages carry the same MIT notice and the same holder.
• src/nauthz.rs is not generated code: it pulls in tonic::include_proto!("nauthz"), generated at build time from proto/nauthz.proto by build.rs, which is present.
• Cargo.lock and .cargo_vcs_info.json are crates.io tarball artifacts and are not installed; dh-cargo's cargo buildsystem removes Cargo.lock in its configure step (cargo.pm).
• The nine quilt patches in debian/patches/series all have DEP-3 headers (Description, Author, Last-Update, Forwarded, sometimes Origin); they only touch Cargo.toml, src/, build.rs and tests/, and the test hunks are API adjustments, not disabled assertions.
• Build-time protoc is available transitively: librust-prost-build-dev Depends on protobuf-compiler and libprotobuf-dev, and librust-tonic-prost-build-0.14+default-dev is provided by librust-tonic-build-dev.
• Other Build-Depends spot-checked with apt-cache and found: librust-tonic-0.14+default-dev and librust-tonic-prost-0.14+default-dev (librust-tonic-dev), librust-hyper-util+client-legacy-dev, librust-nonzero-ext-0.3+default-dev, librust-parse-duration-2+default-dev, librust-sqlx+tls-rustls-dev, librust-qrcode+svg-dev, librust-bitcoin-hashes+serde-dev, librust-console-subscriber+default-dev, librust-tikv-jemallocator+default-dev.
• The autopkgtest Depends resolve: @ is the librust-nostr-rs-relay-dev binary package, whose Depends include the build-time crate librust-tonic-prost-build-0.14+default-dev and therefore protobuf-compiler, so cargo-auto-test can rebuild build.rs.
• /etc/nostr-rs-relay/config.toml is installed by dh_install into /etc, so dh_installdeb marks it a conffile automatically; debian/nostr-rs-relay.install uses dh-exec's => rename and dh-exec is in Build-Depends.
• The preset is honoured: deb-systemd-helper enables a unit on first installation through systemctl --preset-mode=enable-only preset, so disable nostr-rs-relay.service leaves it unenabled for boot.
• Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1; the changelog is 0.8.12-1, distribution unstable; src/format is 3.0 (quilt).
• uscan found the packaged version as the newest upstream release (upstream 0.8.12, packaged 0.8.12).

• Build-Depends librust-nostr+nip04-dev, librust-nostr+os-rng-dev and librust-nostr+std-dev (>= 0.18.0) are provided by no package in the reviewing system's archive lists or in the NEW-queue snapshot of 2026-11-11T00:04Z. A build would show whether librust-nostr has been accepted since those lists were taken; if it has not, the package cannot build.
• No build was attempted, so the debcargo version-relaxation patches (0001) and the source forward ports (0002-0009) were not compiled against the archive's crate versions.
• Whether debian/nostr-rs-relay.install is executable (which dh-exec requires for its => syntax) could not be checked without file modes; the build is assumed to work.

None.