• debian/copyright is DEP-5 (exact 1.0 Format URL), two stanzas: Files: * MIT 2021 Greg Heartsfield scsibug@imap.cc, debian/* MIT 2026 Debian Rust Maintainers and Ying-Chun Liu, with the complete MIT text matching LICENSE verbatim; Upstream-Name/Contact/Source fields present.
• Tree-wide grep (case-insensitive) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU (L)GPL, Apache License, Mozilla Public, public domain, All rights reserved, plus adapted from/based on/taken from/copied from/dual/third-party: matches only LICENSE, debian/copyright, debian/copyright.debcargo.hint (uninstalled debcargo template with a FIXME line), and the two debian/man/*.md, whose PaulLiu MIT notice is covered by Files: debian/*. No other holder, no other licence, no non-free term.
• Full inventory of the upstream tree (~55 files: Cargo.toml, Cargo.toml.orig, Cargo.lock, build.rs, .cargo_vcs_info.json, .cargo/config.toml, .build.yml, .gitignore, .pre-commit-config.yaml, Dockerfile, README.md, config.toml, rustfmt.toml, LICENSE, .github/workflows/ci.yml, contrib/, docs/ (5 .md), proto/nauthz.proto, src/ (23 .rs), tests/ (4 .rs)): no images, fonts, sounds, PDFs, archives, minified code or prebuilt binaries; no include_str!/include_bytes! embedding external data.
• No vendored third-party code: every dependency is a crates.io crate packaged separately in Debian (Cargo.toml has no path dependencies, no vendor/ directory).
• The prescan's copyright-holder check reported "every holder found is named in debian/copyright"; my own grep corroborates it (only Greg Heartsfield in LICENSE, PaulLiu in debian/man/*.md).
• Generated files: nostr-rs-relay.1 and bulkloader.1 are produced at build time by pandoc from debian/man/*.md (execute_after_dh_auto_build in debian/rules) and listed in debian/clean; the .1 files are not in the source tree. proto/nauthz.proto is shipped alongside build.rs, so the generated tonic code has its input.
• debian/rules: dh $@ --buildsystem cargo, compat 13; debhelper 14.5 confirms dh_installsysusers is not in the default sequence at 13, which debian/debcargo.toml's [source] build_depends covers with dh-sequence-installsysusers; pandoc (build-time man pages) and dh-exec (rename in the .install file) are in Build-Depends, where an arch build needs them.
• Conffile handling: debian/nostr-rs-relay.install places debian/nostr-rs-relay.config.toml at /etc/nostr-rs-relay/config.toml via dh-exec; dh_installdeb(1) enriches the conffiles list with files under /etc automatically, so README.Debian's "dpkg conffile" claim holds.
• All nine patches read at header level and their content spot-checked (0001 Cargo.toml adaptation, 0002 bech32, 0004 tonic/tonic-prost-build, 0006 nostr, 0008 sqlx, 0009 tungstenite): each has Description, Author, Last-Update and Forwarded: not-needed (plus Origin where taken from upstream), series lists all nine, and none is obsolete (upstream 0.8.12 still uses the old APIs).
• Dependency names checked with apt-cache: dh-sequence-installsysusers provided by debhelper 14.5; librust-tonic-prost-build-0.14+default-dev and librust-tonic-prost-0.14+default-dev provided by librust-tonic-build-dev 0.14.5; librust-hyper-util+server-auto-dev provided by librust-hyper-util-dev 0.1.19.
• autopkgtest: three cargo-auto-test stanzas (all-targets with and without default features, and --all-features), only dev-dependency anyhow in Depends, Restrictions allow-stderr and isolation-container matching the loopback-websocket tests; dh-cargo's test step runs cargo build at build time, so the missing dev-dependencies in Build-Depends are not a fault.
• Service/user layout cross-checked against the code: src/cli.rs defines -c/--config and -d/--db, src/main.rs applies the -d override to settings.database.data_directory, and Settings::new merges the file over built-in defaults, so the unit's --config /etc/nostr-rs-relay/config.toml and the short default config work as README.Debian and the man page describe; the sysusers entry and StateDirectory agree on /var/lib/nostr-rs-relay.
• Changelog and control are consistent: 0.8.12-1, unstable, urgency=medium, X-Cargo-Crate/X-Cargo-Crate-Version 0.8.12, Standards-Version 4.7.4 (first two components current with the reviewing system's Policy), Vcs-Git/Vcs-Browser pointing at debcargo-conf with the right subdirectory.
• uscan found the packaged version as the newest upstream release (upstream 0.8.12, packaged 0.8.12).

• The nostr-rs-relay stanza's Depends/Recommends/Suggests/Provides name ${cargo:Depends}, ${cargo:Recommends}, ${cargo:Suggests} and ${cargo:Provides}. dh-cargo 34's dh-cargo-built-using (/usr/share/cargo/bin/dh-cargo-built-using:162-166) writes only cargo:Built-Using and cargo:Static-Built-Using; if debcargo 2.8.4 likewise provides no helper for these, dpkg-gencontrol would warn "substitution variable ${cargo:Depends} used, but is not defined" (Dpkg/Substvars.pm) and leave Depends ending in a comma, while the three feature fields become empty. A build log would show whether this is the case; I could not run debcargo to see what it emits.
• librust-nostr+default-dev, librust-nostr+nip04-dev, librust-nostr+os-rng-dev and librust-nostr+std-dev are in neither the package lists nor the NEW queue as of 2026-11-11. The lists can be days old, so this is not proof; the build needs the nostr crate to be accepted.
• I did not compare the unpacked tree with rust-nostr-rs-relay_0.8.12.orig.tar.gz or the .dsc, and I did not read the .pc/ directory or debian/cargo-checksum.json.

None.