Hello everyone, As a member of the DFSG team, I want to step in and take ownership of the current situation regarding the automated LLM summaries in the NEW queue.
First, I want to emphasize that this tool was introduced as a good-faith initiative from within our team, aimed at increasing transparency and sharing the heuristics we see during reviews. However, we regret that it was deployed without the broader coordination, discussion, or community input that a change of this visibility clearly warranted. I want to acknowledge the confusion and hurt this lack of prior communication has caused within the project. Internally, some of us have found these summaries to be a helpful supplementary signal when parsing complex copyright files. But I want to make one thing absolutely clear: these AI-generated outputs are never taken as a final verdict. Every single package in the NEW queue continues to be thoroughly and individually vetted by a human team member. We know that real-world licensing edge cases demand nuanced human judgment, and our standard for manual review has not changed. We hear the frustration regarding the noise and inaccuracies the tool has produced. An opt-out has already been added, and we are actively evaluating how to adjust our tooling and prompts based on the feedback in this thread. Thank you to everyone who contributes to Debian. We are committed to improving our processes and communicating more openly moving forward. Best regards, Reinhard On Mon, Oct 26, 2026 at 9:43 AM Johannes Schauer Marin Rodrigues < [email protected]> wrote: > Hello fellow DDs, > > I have been shown by others that, without an announcement, NEW queue > processing > now seems to throw my upload at an LLM. From the review results: > > > This is an LLM based review using a Debian Inference based workflow. It > was > > not written by a member of the DFSG team and has not been checked by > one. It > > is not a decision on the package: it may be wrong, and it may have missed > > things. > > Right, so I have two options: > > a) spend my valuable developer time (this is my free time) on reading > machine > output which indeed might be completely wrong and get angry and upset for > reasons which have been listed in great detail by those opposed to > LLM-use in > Debian on debian-vote > > b) not read the machine-generate review and have the resources that were > required to generate it not only be wasted, but let my upload become > another > item in a statistic which shows how many tokens Debian is using up > because the > more tokens we use the better our software, right? > > I'm not going to read the machine-generated output. I argue that this > waste of > resources is not "responsible use" as by what was decided with the last > GR. The > GR text also says: > > > Debian neither endorses nor prohibits the use of generative AI > > If a team as central as the DFSG team now uses an LLM to process *all* > uploads > to NEW, how is this not "Debian endorses the use of generative AI"? > > The GR text also says: > > > The use of generative AI does not alter Debian's established expectations > > regarding large-scale or automated project actions. Contributors > intending to > > perform actions with broad project impact, such as mass bug filing or > patch > > submission, large-scale code modifications, or other automated changes or > > requests affecting many packages or contributors, should seek prior > > discussion and consensus through the appropriate project channels before > > proceeding > > The DFSG team using an LLM to process all uploads to NEW is what I consider > "large-scale or automated project actions". The GR text recommends to seek > "prior discussion and consensus" before this is done. Where was this done? > > I *am* grateful for the (mostly thankless) work done by the DFSG team but I > rather wait a year before my package makes it through NEW (yes, that > happened) > than have my strong opposition to LLMs be ignored and all my uploads being > automatically screened without my consent. I think seeking prior > discussion for > this is especially warranted because (I hope) we learned in the GR > discussion > on debian-vote that there are developers with strong opinions in either > direction. Why not talk about it first? > > I will not upload anything to NEW unless there is a way for me to opt out > of > this. I would prefer if the default was "no LLM review" and that developers > have to explicitly opt-in to receive an auto-generated review. > > I would also prefer if the time that was spent on integrating proprietary > software into our core-workflows was instead spent in making actually free > software like Lintian better. If the LLM has a bug, I cannot fix it. The > model > is a binary blob. The LLM cannot be 100% correct and neither can Lintian. > But > Lintian will give me an answer *reproducibly* and I can then either fix > Lintian > or add an override to my source package. I cannot tell anybody where to > spend > their free-time but I would hope that working together on a free software > project means that we make our DFSG-free tools better instead of > increasing our > reliance on tools and workflows involving proprietary software with > non-deterministic output. > > I'm not leaving the project but if one of my packages needs NEW processing, > then I will leave it to somebody else who is fine with the consequences to > do > the upload. I'll not be a part of this. > > Thanks! I'm now offline doing something fun. Good luck with discussing this > topic in case that's what you end up doing. > > cheers, josch -- regards, Reinhard
