Greetings. Charles Plessy - 27.10.26, 09:12:51 CET: > Thanks a lot to the DFSG team and to you Lucas for making it possible. > > I wonder if it would not be even better to have the report, in full or > brief, generated by a tool (debgpt?) before we upload to NEW...
This brings another aspect for me. It seems to me the Debian Inference service uses a cloud service¹ ². A European one called ScaleWay. Given as a generous sponsoring contribution. Thanks for that! But nowhere it is stated exactly on which terms or conditions? Or are these somewhere I did not look yet? Is this just the regular terms of ScaleWay or has there been a special agreement? From a glimpse at their website I would not even easily know where those terms would be described. Packaging is public information. And in the end any AI company can scrape the packaging data and Salsa for example may already suffer from such scraping requests. As well as the bug tracker. I noticed protective measures against that. So privacy is not really much of an issue here, I'd say, if at all. But I am not even sure and I do not know to what extent the GDPR would apply, if at all. If at one point a maintainer reaction to an automated review would be processed by an LLM, it may very well apply (see below for another piece about maintainer reaction). But I wonder: What does it even mean? Are LLMs trained on the data from the automatic review process for example? Do we even know? How transparent is all of this? I would feel much better if this was self-hosted and administrated by Debian people. Also regarding the announcement from Lucas³: From self-service access to we do it for in the review process for every package upload and send the review to the package maintainer is quite a way, if you ask me! Also about the model being used: Is it a model that is even under a free software license? qwen3.8-27 would be under Apache 2.0[4] but glm-5.2 does not appear to be under a DFSG compliant license[5]. Which model is even used? Now I looked at an assistant report more closely and I did not see a hint on which model was used for the review[6]. But what has really taken me aback was this: "Uploader's response to the LLM review The uploader was given 24 hours to respond to the serious issues the review found, and did not." I am not kidding you. That is really written out on the public assistant report webpage like that. The uploader is presented with a wall of text and then they were given 24 hours to respond to it? Honestly I am without words about this. This is not okay. Simple as that. My plea would be: Please slow down a bit. Dial back a bit. And really consider what is actually happening here at the moment. Who is even in control here anymore? [1] New service: Debian Inference Portal — shared LLM inference for Debian contributors https://lists.debian.org/debian-devel-announce/2026/09/msg00001.html [2] https://inference.debian.net/ [3] "I'm happy to announce the Debian Inference Portal, a new service that gives Debian contributors self-service access to shared large language model (LLM) inference, thanks to sponsorship by Scaleway." see ¹. [4] According to the following long article I am not even sure a LLM can easily be licensed as that: Copyrightability of LLM-generated code: Can we license “vibe code” into Free Software? https://fsfe.org/news/2026/news-20260825-01.en.html [5] https://ollama.com/library/glm-5.2 [6] DFSG, Licensing & New Packages Team: kate 4:26.08.2-2 https://dfsg-new-queue.debian.org/reviews/kate#assistant-report Best, -- Martin
