Hi Betty, For the record, though I am a Debian Developer, I am replying to this email in my capacity as a Federal employee. Nothing in this e-mail shall be considered authorization for vendors to incur cost or perform work outside of the scope of their contract. If there is a question as to whether any statement in this e-mail will result in the aforementioned, it is the vendor's responsibility to obtain direction or authorization from a certified Contracting Officer.
The Debian Project is not a cloud services organization, nor does it provide software under contract. In fact, the Debian Project itself doesn't even exist as a legal entity that could be bound to a contract. If you're referring to DFARS 252.204–7012, for example, that doesn't really make sense. The best way to think about it is that Debian is a collection of software that's freely available to the general public to be used however they see fit. It comes with no warranty of fitness for any purpose, one way or the other. I recommend reading OMB Circular M-16-12 and the DoD CIO memo http://dodcio.defense.gov/Portals/0/Documents/FOSS/2009OSS.pdf for more information. Sincerely, -- Harlan Lieberman-Berg Defense Digital Service
