Package: qemu-user Version: 1:9.1.0+ds-4 Severity: serious Justification: Policy 7.8
Dear maintainer, The qemu-user package provides the following files which are statically linked against glibc: /usr/bin/qemu-aarch64 /usr/bin/qemu-aarch64_be /usr/bin/qemu-alpha /usr/bin/qemu-arm /usr/bin/qemu-armeb /usr/bin/qemu-hexagon /usr/bin/qemu-hppa /usr/bin/qemu-i386 /usr/bin/qemu-loongarch64 /usr/bin/qemu-m68k /usr/bin/qemu-microblaze /usr/bin/qemu-microblazeel /usr/bin/qemu-mips /usr/bin/qemu-mips64 /usr/bin/qemu-mips64el /usr/bin/qemu-mipsel /usr/bin/qemu-mipsn32 /usr/bin/qemu-mipsn32el /usr/bin/qemu-or1k /usr/bin/qemu-ppc /usr/bin/qemu-ppc64 /usr/bin/qemu-ppc64le /usr/bin/qemu-riscv32 /usr/bin/qemu-riscv64 /usr/bin/qemu-s390x /usr/bin/qemu-sh4 /usr/bin/qemu-sh4eb /usr/bin/qemu-sparc /usr/bin/qemu-sparc32plus /usr/bin/qemu-sparc64 /usr/bin/qemu-x86_64 /usr/bin/qemu-xtensa /usr/bin/qemu-xtensaeb glibc is mostly is mostly licensed under the LGPL, which requires that the full source code of the incorporating binary package be made available. According to Debian Policy ยง7.8 [1] such a binary package MUST list the glibc source package (and possibly others) in the Built-Using: field. Please also note that Build-Using-Static is not (yet?) part of the Debian Policy, and more importantly that DAK does not know about this field, so can't use it to retain the older versions in the archive in order to satisfy the licenses. Regards Aurelien [1] https://www.debian.org/doc/debian-policy/ch-relationships.html#additional-source-packages-used-to-build-the-binary-built-using
