Re: Bug#1106796: busybox-static: statically linked against glibc without a Built-Using: field

[Aurelien Jarno <aurel32@debian.org>]

control: tag -1 + patch


Hi,

On 2025-05-29 22:53, Aurelien Jarno wrote:
> Package: busybox-static
> Version: 1:1.37.0-4
> Severity: serious
> Justification: Policy 7.8
> 
> Dear maintainer,
> 
> The busybox-static package provides /usr/bin/busybox which is statically
> linked against glibc.
> 
> glibc is mostly is mostly licensed under the LGPL, which requires that
> the full source code of the incorporating binary package be made
> available. According to Debian Policy §7.8 [1] such a binary package
> MUST list the glibc source package (and possibly others) in the
> Built-Using: field.
> 
> Please also note that Build-Using-Static is not (yet?) part of the
> Debian Policy, and more importantly that DAK does not know about this
> field, so can't use it to retain the older versions in the archive in
> order to satisfy the licenses.

I think in that case the patch is obvious, but I have nevertheless 
attached it to this mail.

Regards
Aurelien

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                     http://aurel32.net

--- busybox-1.37.0/debian/control
+++ busybox-1.37.0/debian/control
@@ -35,7 +35,7 @@
 
 Package: busybox-static
 Architecture: any
-Static-Built-Using: ${built-using}
+Built-Using: ${built-using}
 Depends: ${misc:Depends}
 Conflicts: busybox
 Replaces: busybox