Hi, On 11/8/26 13:04, Charles Plessy wrote:
our archive is full of packages where debian/copyright is not accurate.
That is a quality issue, and the package is not being maintained properly if that is the case.
However, generating a copyright file with an LLM is not proper maintenance, it just pretends to be at a surface level, and erases metadata that could be used to determine whether a package is properly maintained, like the timestamp on the copyright file.
In my field, there has been a mass trend of relicensing from GPL to MIT. I have already fixed dozens of our packages that have indicated GPL wrongly for years. Who is "taking responsibility" there?
If maintainers are that disinterested in a package that they do not even notice upstream changing the licence terms, then I doubt giving them a tool to simulate activity is going to help.
During the big push for team maintenance, the loss of "personal responsibility for a package" was one of the more frequently voiced concerns. It is up to teams to compensate for that.
I understand that in the deep-dependency-tree ecosystems, packages are less "pets" and more "cattle", but especially the kind of building-block packages that are first packaged because they are a dependency require very involved maintainers.
I understand that people object to LLMs for ethical and environmental reasons, but the claim that the quality of the LLM-generated reviews is too low, sorry, I do not agree with that.
It is one thing if the DFSG team use LLM reviews internally. I have strong opinions about that because of ethical and environmental reasons, which I believe take priority over "creation of more software", but that is not something I have much control over, beyond "avoiding uploading NEW packages if I can, even if it would make technical sense."
Exposing these "reviews" is a different issue: I have to justify not acting on them if they are available, because I am causing additional work for the DFSG team if they have to manually go through the LLM review output and see if the flagged items are accurate, and at this point LLMs have been inserted into my workflow despite my objection.
It also creates an incentive to just apply any changes requested without checking, as this makes the report come back clean, and therefore minimizes the impact of the license compliance speedbump on my true goal, which is to get a package shipped with minimum effort, so I can use the extra time to ship more packages.
That is not the right way forward. Simon
OpenPGP_signature.asc
Description: OpenPGP digital signature
