Bug#1069256: debian-policy: clarify requirement for use of Static-Built-Using

[Julian Gilbey <jdg@debian.org>]

On Mon, Aug 04, 2025 at 03:55:56PM +0200, Chris Hofstaedtler wrote:
> On Mon, Aug 04, 2025 at 02:40:07PM +0100, Julian Gilbey wrote:
> > Hi!
> > > +::
> > > +
> > > +    Built-Using: rust-pulsectl-rs (= 0.3.2-1+b1)
> > > +    Static-Built-Using: rust-gtk4 (= 0.7.3-3), rust-pulsectl-rs (= 0.3.2-1+b1)
> > > +
> [..]
> > I would therefore propose changing the Static-Built-Using field to use
> > *binary* packages and versions rather than *source* packages and
> > versions to fix this.
> 
> Thanks for noticing. At least I've overlooked this in the past, but 
> I always understood S-B-U to list binary package names and binary 
> package versions.
> 
> Let's see what everyone else thinks, but I think dealing here with source 
> package names is not a good idea.

Hi Chris!

I'm glad I'm not going mad ;-)

To quote the current deb-control(5):

       Static-Built-Using: package-list
           This  dependency  field  lists  extra source packages that were used
           during the  build  of  this  binary  package,  for  static  building
           purposes  [...]
           This field must  be  a  comma-separated  list  of
           source  package names with strict ‘=’ version relationships enclosed
           within parenthesis.

So that would need changing too.

I don't know whether any tools are yet using this field, but if they
are, they would need to be updated similarly.

Best wishes,

   Julian