Bug#392362: [PROPOSAL] Add should not embed code from other packages

[Colin Watson <cjwatson@debian.org>]

On Thu, Nov 29, 2007 at 09:02:43PM -0800, Russ Allbery wrote:
> Okay, here's yet another try at the wording for this that tries to exclude
> Autotools and friends without making the wording too awkward.
> Word-smithing welcome (as are any other comments).
> 
> --- orig/policy.sgml
> +++ mod/policy.sgml
> @@ -2077,6 +2077,32 @@
>  	  the file to the list in <file>debian/files</file>.</p>
>        </sect>
>  
> +      <sect id="embeddedfiles">
> +	<heading>Convenience copies of code</heading>
> +
> +	<p>
> +	  Some software packages include in their distribution convenience
> +	  copies of code from other software packages, generally so that
> +	  users compiling from source don't have to download multiple
> +	  packages.  Debian packages should not make use of these
> +	  convenience copies unless they are used only during the package
> +	  build and are not included or linked into generated binary
> +	  packages.

This has the unfortunate property of excluding Gnulib, which is a
library of code explicitly designed by the GNU build system folks to
live alongside the Autotools and be copied into packages to provide
replacements for missing functions. Perhaps something like this would
work?

  Debian packages should not make use of these convenience copies unless
  the intent of the other package is explicitly to be copied in this
  way<footnote>For example, parts of the GNU Build System work like
  this.</footnote>, and the other package provides a straightforward
  mechanism for keeping the copy up to date.

Alternatively, maybe we might want to explicitly sign off on exceptions
somehow. I can see that the security team might not be terribly happy
about supporting libinsecure by Inexperienced Developer
<newbie@example.org> who thinks everyone should copy his library into
their own programs ...

-- 
Colin Watson                                       [cjwatson@debian.org]