• Tree inventory: LICENSE, NOTICE, four Contraband inputs in internal/compiler-interface/src/main/contraband/ (definition.json, type.json, other.json, incremental.contra), 71 hand-written sources under internal/compiler-interface/src/main/java/xsbti/** (22 in xsbti/, 4 in api/, 39 in compile/, 6 in compile/analysis/) and 68 generated ones under internal/compiler-interface/src/main/contraband-java/xsbti/ (53 in api/, 15 in compile/). No binaries, images, PDFs, archives or build output (target/ absent).
• All 71 hand-written .java files (a full-tree grep, 71 files matched, so every one of them) carry the same header Copyright Scala Center, Lightbend, and Mark Harrah / Licensed under Apache License 2.0 / SPDX-License-Identifier: Apache-2.0, matching Files: * in debian/copyright; a grep of internal/ for Copyright, (C), ©, SPDX, BSD, MIT, LGPL, GPL, MPL, public domain, All rights reserved and Permission is hereby finds nothing else, so debian/copyright misses no holder and no second licence.
• The 68 contraband-java files carry only This code is generated using [[https://www.scala-sbt.org/contraband]] / DO NOT EDIT MANUALLY and no copyright line; their generator inputs are shipped under src/main/contraband/, which is the preferred form for modification, and the generated code is a derivative of those Apache-2.0 inputs, so the Comment in debian/copyright describing them is accurate.
• debian/copyright is DEP-5: exact Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/, a header stanza with Upstream-Name, Upstream-Contact, Source, Comment and Files-Excluded (all of which are header fields under copyright-format 5.1), Files: * for the upstream sources and a later Files: debian/* for the packaging, and one stand-alone License: Apache-2.0 paragraph pointing to /usr/share/common-licenses/Apache-2.0, which exists on this system.
• Every path listed in Files-Excluded (.git-blame-ignore-revs, .github, .gitignore, .java-version, .jvmopts, .scala-steward.conf, .scalafmt.conf, CONTRIBUTING.md, MIGRATION.md, README.md, bin, build.sbt, project, sbt-allsources.sh, test-data, zinc, internal/compiler-bridge, internal/compiler-bridge-test, internal/zinc-*) is absent from the unpacked tree.
• The third-party components named in NOTICE (ZipFileSystem, ScalaJSON, sjson-new, Protocol Buffers, FastParse, SourceCode, LMAX Disruptor, the file tree views, ScalaPB, JLine, JNA under LGPL-2.1+/Apache-2.0, Apache Log4j 2, the Scala compiler, Jawn; also searched for Google, Oracle, EPFL, LMAX and Typesafe) do not appear anywhere in internal/, so no LGPL/BSD/MIT code is combined with the Apache-2.0 code and the debian/copyright Comment that they belong to the removed zinc modules is correct.
• The pre-scan's author check reported only every holder found is named in debian/copyright (4 declared holders, 144 files scanned) and listed no files, and it raised no non-free wording or built-file hits; there was therefore no scan finding left to account for.
• Build and install: debian/rules compiles the two source roots with javac -cp /usr/share/java/sbt-util-interface.jar --release 8 and jars target/classes; debian/libsbt-compiler-interface-java.poms lists debian/poms/compiler-interface.pom --java-lib --usj-name=sbt-compiler-interface --artifact=target/sbt-compiler-interface.jar, and maven-repo-helper's own reference.html (lines 238-239, 389-399) says --java-lib installs the jar into /usr/share/java and --usj-name sets its name there, while mh_install(1) installs the POM and artifact into /usr/share/maven-repo; the maven_repo_helper dh sequence inserts mh_install after dh_install. The .poms filename matches the binary package name.
• Build-Depends are all satisfiable from the archive: libsbt-util-interface-java is in unstable at 2.0.12-1 (satisfies >= 2.0, and its description says it is the dependency of this compiler-interface), javahelper 0.82 (Provides: dh-sequence-javahelper), maven-repo-helper 1.13, debhelper-compat (= 14), default-jdk-headless.
• Debhelper compat 14: no ${shlibs:Depends}/${misc:Depends}-style omission is possible, and ${java:Depends} named after a relationship field is filled in by dh_gencontrol itself at this level.
• Standards-Version: 4.7.4 is current: Policy on this system is 4.7.4.1, whose first two components are the same 4.7.
• debian/changelog: sbt-compiler-interface (2.0.5+ds-1) unstable; urgency=medium, "Initial release", closes the ITP #1139639; +ds is the right version scheme for the uscan repack described in debian/README.source, and the date (Wed, 28 Oct 2026) is a Wednesday.
• debian/source/format is 3.0 (quilt); there is no debian/patches directory and no patch is applied, so no DEP-3 headers are owed. debian/clean removes target/, so the build directory does not leak into the source diff.
• NOTICE is installed as documentation through debian/libsbt-compiler-interface-java.docs (Apache-2.0 section 4(d)); a copy of LICENSE in the binary is not required because Apache-2.0 is in /usr/share/common-licenses and debian/copyright says so.
• debian/control also carries Vcs-Git/Vcs-Browser, a Homepage, a Section: java, a team Maintainer plus an Uploader, and debian/upstream/metadata has Bug-Database, Bug-Submit, Repository and Repository-Browse.
• The repacked tarball contains no test sources and override_dh_auto_test: is empty, so no upstream test is being skipped; there is no debian/tests/ autopkgtest either. maintainer scripts and *.maintscript files do not exist, and none are needed for a jar-only package.
• Read in full: every file of debian/ (16 entries), LICENSE, NOTICE, all four Contraband inputs and a sample of Java file bodies; the remaining Java bodies were covered by the whole-tree licence and holder greps, not read line by line. The .pc/ directory and debian/cargo-checksum.json were left aside as instructed.
• uscan found the packaged version as the newest upstream release (upstream 2.0.5, packaged 2.0.5+ds).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

• The jar name /usr/share/java/sbt-util-interface.jar hardcoded in debian/rules could not be checked against the contents of libsbt-util-interface-java 2.0.12-1 (only its control fields are available here); the build was assumed to succeed, so nothing is reported from it.

None.