To: ?
Subject: Debian encourages derivatives to distribute source

Debian's social contract makes it imperative that we distribute all the source code that composes the Debian project. Through our work on the derivatives census, it has come to our attention that some of our derivatives may not be distributing source packages and thus may not be in compliance with copyleft licenses such as the GNU General Public License. This is especially a problem with distributions focussed on producing live images for users to try out without installing.

Debian encourages users to avoid using or contributing to distributions without proper source code distribution practices.

Debian strongly encourages our derivatives to ensure that they are in compliance with all software licenses, including copyleft ones.

Debian has notified our contacts at the potentially affected distributions.

Debian encourages distros to distribute the source, even for non-copyleft code and data where possible.

The Debian project ensures our license compliance and distribution of source code with several strategies:

    audit licensing and copyright before packages reach the archive
    developing machine-readable copyright and license information formats to automate detection of license incompatibility
    build all binary packages from source packages
    debian-cd handles producing ISO images containing source packages for the binary packages used by our installer images
    live-build handles producing tarballs/images containing source packages for all binary packages and configuration used by our live images

In addition some Debian members do regular rebuild testing to ensure that the source that we distribute is useful to those users who want to modify it.

Some solutions used by Debian derivatives for automated source code copies include:

Finnix: http://blog.finnix.org/2011/08/21/finnix-and-gpl-compliance/
Grml: http://git.grml.org/?p=grml-infrastructure.git;a=tree;f=source-report;hb=HEAD
Ubuntu: rebuilds all binary packages from source packages
Progress: always build source tarballs too when building binary images with live-build

Solutions used outside the Debian packaging world: