It is common for there to be material that is not known to be DFSG-free
in the git commit history of Debian packages. This is true for alioth
repositories, and dgit repositories.
However, for packages in main, commits with a debian/x.y.z release tag
should not contain any DFSG-non-free material. This can be relied upon
to the same extent that one can rely on there being only DFSG-free
material in source packages retrieved from main with `apt-get source`.
Essentially, the git history of a package in main has a very similar
status as the contrib/non-free sections of the archive: you have to
check what you are allowed to do with the material for yourself.
These facts about both tagged and untagged commits in dgit-repos should
be documented somewhere. I'm not sure where. Some possibilities:
- in Policy, alongside the explanation of contrib & non-free (in that
case, this bug should be reassigned)
- in dgit(1), despite the fact that this is Debian-specific information.