dpkg-dev uses 0777 instead of the permissions in the orig tarball when extracting (after umask filtering), so the permission bits of files in the working copy are wrong; this can affect archives created at build time from these files
cmake has a tar subcommand which cannot normalise uid/gid or omit it from created (PKZIP format) archives (this may also apply to other cmake-built archives / formats)
Our notes about issues affecting packages are stored in notes.git and are targeted at packages in Debian in 'unstable/amd64' (unless they say otherwise).