Inconsistent handling of sourceless packages in main

[Goswin von Brederlow <brederlo@informatik.uni-tuebingen.de>]

Hi,

there are a number of packages in main that contain the actual source
code for their binaries in the package itself. Instead those packages
rely on other packages to supply source or prebuild binaries. The
handling of those packages is inconsisten across the various packages
and, every now and then, even violates the GPL (sources are missing).

One package (debian-installer) gets away without source while another
(ia32-libs) has to carry a huge bloat around for GPL compliance. The
handling of them is incosistent and unsatisfactory.


Namely I know about the following cases: (probably incomplete)

package          | handling                     
-----------------+------------------------------
kernel-image*    | Build-Depends kernel-source* 
linux-kernel-di* | downloads kernel-image debs   
kernel-modules   | Build-Depends on kernel-headers
ia32-libs        | include prebuild debs and source
debian-installer | downloads udebs and uses installed binaries

And all have problems:

package          | danger
-----------------+------------------------------
kernel-image*    | kernel-source* update replaces source
                 | rebuild differs
                 | but old version is retrievable through included patches
                 |
linux-kernel-di* | kernel-source* update replaces source (see above),
                 | kernel-image updates make rebuilds differ
                 |
kernel-modules   | kernel-image* updates replaces source (arch patches)
                 | rebuild differs
                 | GPL VIOLATION
                 |
ia32-libs        | huge bloat of the source. 215MB source, 12MB deb
                 |
debian-installer | source updates replace source, rebuilds differ
                 | GPL VIOLATIONS



IMHO debian-installer in unacceptable as it causes GPL violations.
Interlocking the debian-installer builds with the exact source
versions used during build is impractical at best and would stop many
base debs from entering testing.

The ia32-libs way is not practical as it causes way too much
waste. Debian installer would have to grow beyond 500Mb (guess) and
an OOo for ia64 beyond 300Mb for their source packages.

The kernel-image* packages are the most practical ones since
kernel-sources* takes care of preserving past sources. But the same
can't be sanely used for ia32-libs or debian-installer.


But what can be done about it?

I thought about making wraper packages (for ia32-libs) that download
(copy from cd) the respective i386 debs and mangle them on the
fly. But that feels too hackish.

Any ideas? Comments? Solutions?

MfG
        Goswin