Hi, On 2025-05-30 00:06, Michael Tokarev wrote: > On 29.05.2025 23:53, Aurelien Jarno wrote: > > Package: qemu-user > > Version: 1:9.1.0+ds-4 > > Severity: serious > > Justification: Policy 7.8 > > Hm. I especially asked a few times about this one, and the > consensus was to change initial Built-Using: tag which were > there, to Static-Built-Using. That happened in the version > you're filing this bug report against.
Yep, I looked at the version where the Built-Using: tag got removed. > > glibc is mostly is mostly licensed under the LGPL, which requires that > > the full source code of the incorporating binary package be made > > available. According to Debian Policy ยง7.8 [1] such a binary package > > MUST list the glibc source package (and possibly others) in the > > Built-Using: field. > > > > Please also note that Build-Using-Static is not (yet?) part of the > > Static-Built-Using it is, I think. Ok. Indeed you are correct. > > Debian Policy, and more importantly that DAK does not know about this > > field, so can't use it to retain the older versions in the archive in > > order to satisfy the licenses. > > Yes, I've got lintian warning about this one, and asked about it too, > with the answer was that lintian just doesn't know this tag yet, but > DAK does. dpkg and dak support it, in the sense that they accept and follow it properly up to the Packages files in the archive. But it doesn't use it to etain the older versions in the archive in order to satisfy the licenses. > So I'm really confused, why multiple people told me Static-Built-Using > is the right tag to use here. > > The initial question wasn't come from nowhere: we were hitting migration > issues again and again, due to some libs (including glibc) being of an > unknown version to DAK, and constantly needing attention. While this > versions aren't actually needed for runtime. Looking at the current content of Static-Built-Using, it seems that the following indeed needs to be in Built-Using are they are licensed under (L)GPL: glib2.0 (= 2.84.1-2) glibc (= 2.41-7) sysprof (= 48.0-2) OTOH the following one are just fine in Static-Built-Using: capstone (= 5.0.6-1) gcc-14 (= 14.2.0-19) # due to the library exception zlib (= 1:1.3.dfsg+really1.3.1-1) Regards Aurelien -- Aurelien Jarno GPG: 4096R/1DDD8C9B [email protected] http://aurel32.net
