control: tag -1 + patch
Hi,
On 2025-05-29 22:53, Aurelien Jarno wrote:
> Package: gpgv-static
> Version: 2.1.15-9
> Severity: serious
> Justification: Policy 7.8
>
> Dear maintainer,
>
> The gpgv-static package provides /usr/bin/gpgv-static which is
> statically linked against glibc.
>
> glibc is mostly is mostly licensed under the LGPL, which requires that
> the full source code of the incorporating binary package be made
> available. According to Debian Policy ยง7.8 [1] such a binary package
> MUST list the glibc source package (and possibly others) in the
> Built-Using: field.
Please find attached a patch to fix that.
Regards
Aurelien
--
Aurelien Jarno GPG: 4096R/1DDD8C9B
[email protected] http://aurel32.net
--- gnupg2-2.4.7/debian/control
+++ gnupg2-2.4.7/debian/control
@@ -420,6 +420,7 @@
Architecture: any
Multi-Arch: foreign
Build-Profiles: <!pkg.gnupg2.gpgvonly>
+Built-Using: ${misc:Built-Using}
Depends:
${misc:Depends},
${shlibs:Depends},
--- gnupg2-2.4.7/debian/rules
+++ gnupg2-2.4.7/debian/rules
@@ -135,3 +135,6 @@
# visualizations of package dependencies:
debian/%.png: debian/%.dot
dot -T png -o $@ $<
+
+override_dh_gencontrol:
+ dh_gencontrol -- -Vmisc:Built-Using="$(shell dpkg-query -f '$${source:Package} (= $${source:Version})' -W libc-dev-bin)"
