On Thu, Jun 20, 2024 at 01:40:11PM +0800, Maytham Alsudany wrote:
> > Below is the relevant part of the updated patch, to save you from
> > downloading
> > the attachment:
> >
> > ``Static-Built-Using``
> > ~~~~~~~~~~~~~~~~~~~~~~
> >
> > This ``Static-Built-Using`` field must list source packages who's
> > contents (like source code or data) were incorporated into the binary
> > package during the build, including an "exactly equal" ("=") version
> > relation on the version that was used to build that version of the
> > incorporating binary package.
> >
> > Cases where this field may be used include (but are not limited to)
> > linking against static libraries in other packages, builds for
> > source-centered languages such as Go and Rust, usage of header-only
> > C/C++ libraries and injecting data blobs into code.
> >
> > This is useful to track whether the package might need to be rebuilt
> > when source packages listed here have been updated. This is important
> > to stay ahead of the package failing to build from source (FTBFS) with
> > the updated versions of the listed source packages, or security
> > updates in the listed source packages.
> >
> > Unlike Built-Using, the Debian archive will **not** retain the
> > versions of the source packages listed in the Static-Built-Using
> > field. This means that any package listed in Static-Built-Using who's
> > license requires its source code to be available must also
> > simultaneously be listed in the Built-Using field.
> >
> > A package that needs domain name suffix data from the publicsuffix
> > binary package would list it in the ``Static-Built-Using`` field like
> > so:
> >
> > ::
> >
> > Static-Built-Using: publicsuffix (= 20231001.0357-0.1)
> >
> > A package statically linked with a library from the
> > golang-github-mattn-go-xmpp-dev binary package would have this field
> > in its control file:
> >
> > ::
> >
> > Static-Built-Using: golang-github-mattn-go-xmpp (= 0.2.0-1)
> >
> > A package statically linked with the libraries contained in the
> > librust-gtk4-dev and librust-pulsectl-rs-dev binary packages, where
> > the latter is licensed under GPL-3+ (a license that requires full
> > source code to be available), would have these fields in its control
> > file:
> >
> > ::
> >
> > Built-Using: rust-pulsectl-rs (= 0.3.2-1+b1)
> > Static-Built-Using: rust-gtk4 (= 0.7.3-3), rust-pulsectl-rs (=
> > 0.3.2-1+b1)
Seconded.
Thanks!
Chris
