A report from Debian's new DFSG team

The DFSG, Licensing & New Packages Team (usually shortened to "DFSG team") was created in October 2025 as part of the ftpmaster team split. Its job is to review packages in the new queue for compliance with the Debian Free Software Guidelines (DFSG), among other things, before the packages are allowed to enter the Debian archive. The change was long in coming, and some questions remained after the split whether it was the right move. Andrew McMillan provided an overview of the team's activities and its current status during DebConf26. While it may be too early to say with certainty, his report suggests that the new division of duties is working out well.

I did not attend DebConf26, but I did watch the recording of McMillan's talk, which is available in WebM format (HD quality, low-resolution video). Slides from the presentation have not yet been made available.

Ftpmaster split

For more than two decades, Debian's ftpmaster team was responsible for allowing new packages to enter Debian, removing old packages, and otherwise maintaining Debian's archive. At times, packages languished in the new queue longer than Debian developers thought that they should, and the team was seen by some as a bottleneck that was in need of attention.

The idea of refactoring the team was brought up in the "meet the ftpteam" BoF (notes) at DebConf24. On October 3, 2025, Debian Project Leader (DPL) Andreas Tille announced his plan to split the ftpmaster team into two parts: the Archive Operations Team, which handles the infrastructure supporting the Debian archives, and the DFSG team. Tille pulled the trigger on the change on October 26, 2025; he created delegations for the new teams and revoked the delegation for the ftpmaster team, thereby dissolving it.

The first delegation for the DFSG team was composed entirely of former members of the ftpmaster team: Thorsten Alteholz, Ansgar Burchardt, Joerg Jaspert, and Luke Faraone, all of whom were also appointed to the new Archive team. On January 19, 2026, Tille appointed a new delegation to the DFSG team consisting of McMillan, Emmanuel Arias, Nicolas Mora, Mechtilde Stehmann, and Reinhard Tartler.

Team introduction

McMillan said that the talk was supposed to be delivered jointly with Arias and Tartler; however, Tartler had needed to fly back to New York, and Arias was in attendance but not presenting as he is "famously a very shy person", though he would be happy to field questions in Spanish if there were any. "In English, I'll do the talking, I guess." Mora and Stehmann were going to join remotely, he said later, but the network-connectivity problems in the presentation room made that impossible.

The team name was quite a mouthful, he acknowledged, but while "DFSG team" is easier to say it also misses some of the team's responsibilities. He thought it was important to point out that the team reviews packages for compliance with packaging standards and so forth, in addition to ensuring that the packaged software meets the Debian Free Software Guidelines.

The DFSG team does not replace the ftpmaster team, he said: "We just do a very specific task, which was largely done by Thorsten Alteholz in the past." Alteholz had done a great job, "but it was more than one person can handle". The DFSG team does things much more in parallel, and tries not to get blocked on any particular package. "And if somebody's not available, then we can work around that." McMillan also talked about what the DFSG team does not do: it does not fully replace the ftpmaster team. Processing of packages into Debian's stable release, the security and backports repositories, and other archives are handled by the Archive team.

He displayed a slide with the text: "Thesis: a package isn't free until someone checks". McMillan said that the DFSG team has to check that a package is free software before it can enter the archive; the team also reviews packages headed for Debian's contrib and non-free repositories. "We review those as well with less-stringent requirements, as is appropriate for non-free."

There are two types of packages that pass through the hands of the DFSG team: genuinely new source packages that have never been or are not currently in Debian. There are also "binary new" packages which, he explained, which have new names due to a version increment or similar changes. "We tend to review the binary new packages much more leniently, but we still find packages that have been around in Debian for 15 years that have issues with their licensing".

In those cases, the team often accepts the package with a note asking the packager to make the needed changes. "We would rather accept a package which has some minor changes needed, and we'll just ask you to make the minor changes after it's entered the archive." That saves a lot of round-tripping, he added.

McMillan detailed some of the things that the DFSG team looks for during a review; licensing in the debian/copyright file that differs from the headers in the package's source files, non-free assets bundled into the package, or other problems. Sometimes, he said, "people put something into the Debian copyright [file] that seems to be a license, but it actually is just verbiage about the license that's put on a web page or something". In those cases, the team has to ask the packager to include the actual license in debian/copyright.

Most packages come through using the copyright format 1.0 specification, which defines a standard, machine-interpretable format for the debian/copyright file. The format is better known as DEP-5, as it was proposed as a Debian Enhancement Proposal (DEP) in 2007: "DEP-5: Machine-readable debian/copyright". It was published as an optional format in 2012. McMillan hoped that everyone in the audience was familiar with the DEP-5 format; after the audience seemed to indicate that it was, he said, "good, we want to make it mandatory for new packages to be DEP-5".

He said that the DEP-5 requirement was likely to be introduced before the end of this year. "We might actually make it actually apply retroactively that it is a bug for a package not to have the copyright in DEP-5 format." That would help people who are managing large sets of computers who want to know the licensing that's being used in an organization. "Software bill of materials people, and that sort of thing." It's unclear how many packages are not using DEP-5 format or might not be fully compliant.

Dashboard

Developers who are interested in the progress of their packages, or everyone's packages, through the new queue can follow along using the DFSG team's Dashboard. McMillan said that the dashboard is a simple web presentation of the queue with an iceberg's worth of complexity underneath it.

The Archive team uses the Debian Archive Kit (dak) collection of scripts to manage the archive. The DFSG team discussed using those tools as well, he said, but decided that it would be better to have its own software with a separate interface. "So we interact with dak, our software interacts with dak, but we don't have to learn how dak works. That can be somebody else's problem."

Instead of using the dak tools, he said that the DFSG team uses software that is focused on its process. He displayed a slide with some example uses of dnq, the command-line client the team has developed to process new packages. For instance dnq list displays packages that are ready to be reviewed, dnq fetch is used to grab the package, dnq assign packagename will assign a package to the reviewer, etc. The dnq complete accept command finalizes the review and turns it over to dak, which sends out the final email to the packager. "Or, now and again, somebody might get a reject [email]. Hopefully nobody in this room."

The team is still learning from one another, he said: "We kind of all have slightly different workflows because we're a new team and we're evolving." Members of the team have different kinds of skills, he said: Stehmann, for example, has a strong legal background and is good at reading through licenses to assess what is, or is not, compatible with the DFSG.

Priorities and results

Each team member chooses which packages to look at, McMillan said: "The ones that come to the top of my list tend to be languages that I'm more familiar with, like Go. And the ones that go to the bottom of my list tend to be languages that I'm less familiar with, like Python." Conversely, Arias is more familiar with Python, so he is more likely to review those packages. A package can also be designated for team review if it happens to be tricky in some way, such as big package that has been around since the 1990s with "a very hairy set of authors and copyrights".

There were more than 750 packages in the queue when the new DFSG team took over, he said; now there are normally fewer than 30. The team started by prioritizing the oldest packages first, "but also with a balance to get important packages". New binary packages, for example, are given a higher priority than new source packages. Packages with high popularity contest (popcon) scores are also prioritized.

The team normally processes packages within two or three days, McMillan said, "if it takes more than a week for your package to get through, you've hopefully had some communication with the reviewer in that process". He encouraged packagers to email the team if it seemed that a review was taking too long.

Even though the team is processing the new queue more quickly, McMillan said that the team could use more hands and invited people to talk to the team if they were interested in joining. He said he would ultimately like to have a system that put more of the workload of accepting new packages onto Debian developers in general. He envisioned "some kind of quorum sort of structure" that would allow anyone with upload rights to the Debian archive to endorse a package as being good. If it received enough votes, it would just be accepted.

There was a lot of discussion last year at DebConf, McMillan said, "about the difficulty with getting [new] packages accepted into Debian, and I think this year we're not talking about that". He opened the floor for questions, but the audience did not offer any, so he ended the session a bit early.

Note: you can avoid this step in the future by logging into your LWN account.