Are source packages required to be DFSG-free? (was: Re: New bugs filed regarding non-free IETF RFC/I-Ds)

[Simon Josefsson <jas@extundo.com>]

There is some discussion in one of the bug reports:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=390664

(please read it first)

The problem is essentially, if I understood it correctly, whether
Debian source packages [in main] must be DFSG-free or not, or whether
it is sufficient that Debian binary packages [in main] must be
DFSG-free and that the source package is "legally distributable".

I'm not sure what the policy is here.  I thought the Debian Policy was
that source packages must be DFSG-free too, but I can't find a precise
quotation in the Debian Policy Manual and point to it.

Help?

Thanks,
Simon