[Foo2zjs-maintainer] Bug#449497: Policy on Binary Firmware Fetching in Main (e.g. foo2zjs)

[Michael Gilbert]

i recently submitted a serious bug against foo2zjs because the package
provides a non-free firmware fetching script (called getweb) in main.
i believe this to be a serious bug for two reasons:

the first is that packages in main should not have any dependencies on
non-free software.  however, debian policy is not entirely clear on
the issue.  section 2.2.1 says "... the packages in main must not
require a package outside of main for compilation or execution (thus,
the package must not declare a 'Depends', 'Recommends', or
'Build-Depends' relationship on a non-main package)."  this makes the
policy clear about dependencies on "packages," but it does not address
dependencies on other external non-free files.

the second reason is that the upstream author recently modified his
directory naming scheme, which broke that same firmware fetching stuff
(the script now links to the wrong locations).  so, not only is the
version of foo2zjs in unstable broken, but the version in stable is
broken as well because of this.  this would never happen if the
package did not have external dependencies.

the maintainer does not believe this to be an issue [1] because the
firmware fetching stuff is a small part of the total package.  i
suggested that he could split out the firmware fetching stuff into a
contrib package instead, but he didn't seem to think that was a good
idea.  and even so, that still doesn't solve the second problem.  the
correct solution would be to put the firmwares into a non-free
package.

at the maintainer's discretion, the bug is currently tagged "wishlist"
and "wont-fix."  i completely disagree, but i will defer to
debian-legal's take on the matter.

mike

[1] http://bugs.debian.org/449497