Matthew Palmer wrote:
AFAIK, we don't notify for every new piece of software in the archive, just those which would fall foul of the export restrictions.
That's mistaken -- we automatically notify for all NEW packages, so that we don't have to examine every upload of every package in order to send a notification when crypto is added to an already existing package. Basically our notifications say "this package may contain crypto, now or at some future date".
NEW processing for new binary packages is manual so that the name choice can be reviewed, and for general sanity checking purposes. It might be nice to do some sanity checking for changes to the copyright file in packages that aren't NEW too, but that's not really feasible at the moment, and "new binary package" is a fairly good indicator of significant changes that warrant double checking, anyway.
Cheers, aj