> The scope of this GR is (non-exhaustive):
> - Debian source packages
> - Official Debian project software, such as lintian
> - Debian web resources
> - Documentation and translations added by Debian contributors
> - Official communication from Debian
>
> It does not include:
> - Upstream projects using LLMs for development
> - AI-related software
What if there is a security fix which is applied upstream, which is
then cherry-picked into the Debian sources to fix a high-criticality
CVE? In that case, the patch is in the debian source package (for
example, in debian/patches/...).
Suppose a Debian developer uses an LLM to fix a high-criticality bug,
and sends the fix upstream, but in the meantime it's in the Debian
sources.
Or suppose a Debian developer uses an LLM to fix bug which is causing
the Debian web site to be dead. Does this GR disallow all of these
scenarios?
- Ted
