>Also, src/bin/lz4 looks like an embedded code copy. Please ensure that
>the package uses the system version of the lz4 library and that
>src/bin/lz4 is removed in debian/rules build before ./configure is
>run, so that the code copy is never used. For bonus points, convince
>upstream to remove this directory from their VCS and tarballs. Please
>note that lz4 recently had some security issues, so terminology might
>be affected by them, depending on on how it uses lz4.