Bug#392362: [PROPOSAL] Add should not embed code from other packages

[Luk Claes <luk@debian.org>]

Bill Allombert wrote:
> On Tue, Jun 26, 2007 at 01:59:58PM +0100, Neil McGovern wrote:
>> On Mon, Jun 25, 2007 at 05:33:53PM +0200, Bill Allombert wrote:

> Two comments:
> 
> 1) "this library is already packaged in Debian":
> If it is not packaged, it should be packaged instead of using the
> convenience copy. Otherwise three problems can appear:
> 1.1) if the library is packaged separately afterward.
> 1.2) if two packages include independently a convenience copy of the 
> same library.
> 1.3) the security team might miss security issues in a library if
> it is not packaged but only used through a convenience copy.
> 
> The keyword is "convenience" here: it does not apply to copy
> shipped as part of a larger tarball as the main distribution medium.

A convenience copy is AFAIK always part of the upstream tarball. The main
reason for not using convenience copies is security related IMHO and not
package size or having (a possibly other version of) the same library
(package) available at some point.

Cheers

Luk