Bug#1106796: busybox-static: statically linked against glibc without a Built-Using: field
Package: busybox-static
Version: 1:1.37.0-4
Severity: serious
Justification: Policy 7.8
Dear maintainer,
The busybox-static package provides /usr/bin/busybox which is statically
linked against glibc.
glibc is mostly is mostly licensed under the LGPL, which requires that
the full source code of the incorporating binary package be made
available. According to Debian Policy §7.8 [1] such a binary package
MUST list the glibc source package (and possibly others) in the
Built-Using: field.
Please also note that Build-Using-Static is not (yet?) part of the
Debian Policy, and more importantly that DAK does not know about this
field, so can't use it to retain the older versions in the archive in
order to satisfy the licenses.
Regards
Aurelien
[1] https://www.debian.org/doc/debian-policy/ch-relationships.html#additional-source-packages-used-to-build-the-binary-built-using
Reply to: