Looking for where to send a patch upstream, I cannot find an upstream URL,
either in debian/copyright or debian/control.  The debian/copyright dates
also don't fill much of the picture.

There are many fakeroot.git on the net, but at least Arch seems to take as its
upstream the salsa repo for the deb packaging.  From there it really looks like
*that* is the upstream, but mentioning it would help :)