LLM Usage in Debian: Three Proposals

General Resolution: LLM usage in Debian

• Time Line
• Proposal A Proposer
• Proposal A Seconds
• Proposal A
• Proposal B Proposer
• Proposal B Seconds
• Proposal B
• Proposal C Proposer
• Proposal C Seconds
• Proposal C
• Proposal D Proposer
• Proposal D Seconds
• Proposal D

| Discussion Period: | 2026-07-24 | |---|

Matthias Geiger [[email protected]] [text of proposal]

• Johannes Schauer Marin Rodrigues [[email protected]] [mail]
• Antoine Le Gonidec [[email protected]] [mail]
• Simon Richter [[email protected]] [mail]
• David Bremner [[email protected]] [mail]
• Pierre-Elliott Bécue [[email protected]] [mail]
• Ian Jackson [[email protected]] [mail]
• Amin Bandali [[email protected]] [mail]
• Thorsten Glaser [[email protected]] [mail]

Choice 1

Preamble

This proposal aims to expressly forbid any contributions to Debian written with the use or assistance of large language models (LLMs) or other generative AI tools.

The scope of this GR is (non-exhaustive):

• Debian source packages
• Official Debian project software, such as lintian
• Debian web resources
• Documentation and translations added by Debian contributors
• Official communication from Debian

It does not include:

• Upstream projects using LLMs for development
• AI-related software
• Upstream patches/security fixes etc.

Rationale

Debian has a well-earned reputation for stability. This stability is crucial to Debian's position in the free software ecosystem. It is our belief that widespread LLM usage comes from the "move fast, and break things" attitude that, while common in many parts of this industry, is contrary to what makes Debian Debian, and is inappropriate for Debian contributors.

In practical terms, LLM usage raises the following concerns:

1. Copyright

LLM output has very unclear legal status: it may be possible to copyright on its own merits, or not; it may be affected by all of the licenses and copyrights in the training data, or not. Debian Policy and the DFSG require absolute clarity for licensing and copyright[1][2]. Software and other contributions written conventionally by humans with unclear copyright or license status are not allowed in Debian; LLM output should not have a special exception to this.

2. Quality

LLM output has many well-known problems with accuracy.[3][4][5] A LLM can never "know" if its output is correct since it merely produces syntactically likely combinations of the training data. In some environments this is good enough. In Debian, it is not. For instance, in packaging, each Debian source package is unique. Since packaging syntax and best practices have changed over time, a LLM-produced package will have a mixture of contents spanning the age of the archive, with watch files that do not work, overrides out of context, imaginary copyright, and will generally be unfit for upload. A seasoned Debian contributor with packaging expertise may find some limited usefulness here, but a new contributor cannot, and would not know how to fix it. These same quality and accuracy concerns apply clearly to all of the areas listed in the scope of this proposal above. If Debian were a closed organization comprising only domain experts who never leave, this might not be an issue; however,

3. Community

Debian is a project that is more than just code: it is a community built on shared interests in free software and solving technical problems. Debian intentionally grows this community through many means, and new contributors are always encouraged to join. Allowing LLM contributions breaks this. New contributors submitting LLM output for review places an unnecessary strain on the reviewer, which can lead to burnout. Furthermore, LLM-dependent new contributors do not actually learn and understand the details of Debian packaging or processes, so they cannot come to replace a former burned out DD.

4. Ethics

LLM companies directly hurt the free software community as whole by scraping the whole web for training data without any regard for license, copyright, or even established conventions such as robots.txt.[6] This has had a major negative impact on Debian's public web resources, effectively a large scale and perpetual Denial of Service attack on sites that many users rely on. As a consequence parts of our infrastructure were not reachable at all, and JS-based checks had to be enabled. Many other projects were similarly affected. Furthermore, LLM training consumes a staggering amount of resources[7], and the user verification systems that we have been forced to implement as protection waste resources as well. This is blatant disregard for the internet as a public resource, wastes system administrator time, and although individual LLM sessions do not directly use massive resources or DoS the public web, the fact that they can be used at all is a direct result of these unethical behaviours by the LLM companies.

Debian has a Social Contract. [8] Our priorities are our users and free software. Debian is Stable. [9] Users and organizations choose Debian because it is reliable and secure.

Debian is not here to generate as much code as possible requiring manual review by a shrinking number of human volunteers, or to package every piece of software, or to rush new features, but these are what LLMs are used for.

In conclusion, allowing LLM contributions is contrary to the social contract and the common cause of creating a free operating system with a focus on quality and stability.

Proposal

In the interest of not eroding Debian's reputation or further damaging the community, LLM-assisted contributions should be prohibited from inclusion in Debian.

Though our position is that LLM contributions are contrary to documents already ratified by Debian, in order to remove all doubt, we propose the following addition to the Social Contract:

6. Works Created through the use of Large Language Models (LLMs) We will not allow direct contributions to Debian written with the use or assistance of large language models (LLMs) or other generative AI tools. Direct contributions are defined as packaging, native Debian software like lintian, documentation and translations written by Debian contributors, and official Debian web resources, etc. Other categories such as upstream projects written with LLM assistance may be included at a later date. This ensures that Debian remains a stable, trusted, and reliable operating system, and protects the interests of the Debian volunteers who make it possible.

Possible Issues

Other projects exploring similar decisions have elicited a common reply: "How will you enforce a ban on LLM contributions?" While enforcement could be a challenge, this is a statement of intent by the Debian community, and we trust this community to adhere to it in good faith.

Citations

[1] https://www.debian.org/doc/debian-policy/ch-archive.html#copyright-considerations

[2] https://www.debian.org/social_contract#guidelines

[3] https://web.archive.org/web/20240614004123/https://news.northeastern.edu/2023/11/10/ai-chatbot-hallucinations/

[4] https://web.archive.org/web/20250328154700/https://transformer-circuits.pub/2025/attribution-graphs/biology.html#dives-cot

[5] https://www.marketwatch.com/story/openais-sam-altman-tells-salesforces-marc-benioff-that-ai-hallucinations-are-more-feature-than-bug-1c035c52

[6] https://lwn.net/Articles/1008897/

[7] https://tech-insider.org/ai-data-center-power-crisis-2026/

[8] https://www.debian.org/social_contract

[9] https://www.debian.org/doc/manuals/debian-reference/pr01.en.html#_what_is_debian

Disclaimers

• Citations are for background information only and do not reflect an endorsement of specific websites.
• Some ideas and wording were derived from the sources below.

Sources

GNOME discussion: https://discourse.gnome.org/t/loupe-no-longer-allows-generative-ai-contributions/27327

(CC0) Gentoo AI policy: https://wiki.gentoo.org/wiki/Project:Council/AI_policy

Codeberg AI policy: https://codeberg.org/Codeberg/org/pulls/1253#issuecomment-19820434

This document was written by Matthias Geiger

Lucas Nussbaum [[email protected]] [text of proposal] [text of amendment] [text of amendment]

• Andrey Rahmatullin [[email protected]] [mail]
• Christian Kastner [[email protected]] [mail]
• Anton Gladky [[email protected]] [mail]
• Stefano Zacchiroli [[email protected]] [mail]
• Simon Quigley [[email protected]] [mail]
• Soren Stoutner [[email protected]] [mail]
• Julian Andres Klode [[email protected]] [mail]
• Andreas Tille [[email protected]] [mail]
• Philipp Kern [email protected]] [mail]

Choice 2

Allow AI-Assisted Contributions

Using its power under Constitution section 4.1 (5), the project issues the following statement describing its current position on AI-assisted contributions. This statement describes the position of the project at the time it is adopted. That position may evolve as time passes without the need to resort to future general resolutions. The GR process remains available if the project needs a decision and cannot come to a consensus.

The Debian project recognizes that AI-assisted contributions raise many concerns, e.g. about the technical quality and maintainability of such contributions, and their legal status. AI itself also raises additional concerns, about its impact on society at large, on the IT industry and on Free Software; about its environmental impact; and the aggressive or non-compliant practices of AI scrapers.

Nevertheless, many Debian contributors find AI tools helpful when contributing to Debian, and ultimately for improving Debian.

Given both the benefits and risks of AI assistance, and the controversial discussions within the community, the Debian project finds it necessary to clarify its position on AI-assisted contributions and establish clear guidelines.

The Debian project allows AI-assisted contributions (partially or fully generated by an LLM), provided the following conditions are met:

**Tooling Legal Compatibility:**Contributors should ensure that the terms and conditions of the generative AI tool do not impose contractual restrictions that conflict with the distribution, modification, or use of the output in the context of Debian.**Licensing and Attribution:**If any pre-existing copyrighted materials (including pre-existing code licensed as free software) authored or owned by third parties are included in the AI toolâs output, prior to contributing such output to the project, the contributor should verify they have the right to submit it under the relevant open source license.**Accountability:**Contributors assume full responsibility for their contributions, including vouching for the technical merit, security, license compliance, and utility of their submissions. The contributor remains solely accountable for the entirety of these contributions. Contributors should fully understand the proposed changes and be prepared to justify them.**Disclosure:**When a significant portion of a contribution is generated or substantially assisted by a tool, contributors should disclose the use of the tool, making it clearly visible to the intended audience. This covers all forms of contribution, including code, mailing list posts, and bug discussions. The form of the disclosure is left to the contributor; one convenient option for commits is a Git trailer such as Generated-By: or Assisted-By:.**Prior Discussion of Bulk or Automated Changes:**Similarly to the mass-bug filing process (Developers Reference section 7.1.1), contributors should discuss their intention before submitting bulk or autonomously generated contributions. Any such automated process should be overseen by a human who remains accountable for its behavior and output.**Confidentiality and Privacy:**Contributors must not use generative AI tools that transmit data to untrusted providers with non-public or sensitive project information (such as embargoed security reports or private communication), as this may lead to the unintended disclosure of confidential data.

Ian Jackson [[email protected]] [text of proposal]

• Matthias Geiger [[email protected]] [mail]
• Andrea Pappacoda [[email protected]] [mail]
• Simon Richter [[email protected]] [mail]
• Antoine Le Gonidec [[email protected]] [mail]
• Amin Bandali [[email protected]] [mail]
• Bill Blough [[email protected]] [mail]
• Enrico Zini [[email protected]] [mail]
• Sean Whitton [[email protected]] [mail]

Choice 3

Summary: Reject LLMs (generative "AI") as far as practical

BACKGROUND

LLMs have many serious problems, including: undermining the mechanisms of free software community building; environmental damage; exploitation of authors; disruption to open web hosting by aggressive scraping; generation and promulgation of bullshit; polluting the information commons; hazards to users' mental health; economic bubbles; distortion of the computer hardware market; fraud; ownership by horrible people and companies; and so on. Ethical and safe use of this technology is almost impossible.

Ideally, LLM output should not form any part of software that we rely on, nor should LLM output ever take the place of human-written prose.

Unfortunately some of the wider software world, including many of our upstreams, take a different view. Therefore a complete ban on LLM output as part of Debian is currently impractical.

REQUESTS

1. We request that all contributors to Debian avoid the use of LLMs in their Debian work.

2. We request that all decisionmakers within Debian discourage LLM use as much as practical. Practicality is a judgement call and we recognise that it will involve uncomfortable compromises.

3. We request that everyone, even outside Debian, should refrain from using this technology. In particular, the Free Software and Open Source communities should reject LLMs. We recognise that not everyone will heed this call.

REQUIREMENTS (SUPPLEMENT TO THE CODE OF CONDUCT)

4. Within Debian, messages to humans (including for example bug reports, mailing list messages, discussions on Salsa, and blog posts on Planet Debian) must be drafted solely by humans without LLM assistance.

5. Any use of LLMs for Debian work must be disclosed.

6. Individual projects and maintainers may ban LLM contributions completely. Such bans (including by upstream projects) must be respected.

7. Violations of these requirements should be treated as violations of the Code of Conduct and should result in swift but proportionate disciplinary action.

8. Any contributor who feels they cannot write in English without assistance, may write in their native language, and expect readers to use translation tools of their choice. In that case a human-written English summary would be very welcome but is not required. In any case we promise not to shame anyone for any linguistic mistakes.

Pierre-Elliott Bécue [[email protected]] [text of proposal]

• Russ Allbery [[email protected]] [mail]
• Johannes Schauer Marin Rodrigues [[email protected]] [mail]
• Jonathan Carter [[email protected]] [mail]
• Gunnar Wolf [[email protected]] [mail]
• Tiago Bortoletto Vaz [[email protected]] [mail]
• Jeremy Sowden [[email protected]] [mail]

Choice 4

Accept AI contributions for Debian specific work

Debian as a project does not endorse or recommend the use of generative AI assistants for software development, as it raises multiple concerns about ethics, legality, copyright, etc.

Nevertheless, Debian acknowledges that these practices are already in use and here to stay. Rather than banning their use, which seems counter-productive and unenforceable, the project chooses to place responsibility on contributors and therefore defines the following guidelines.

These apply exclusively to code and work done specifically for the Debian project (Debian websites, applications, resources, packages, etc.). They do not apply to any upstream work. In what follows, "work" refers to the contributions done specifically for the Debian project.

• All code and work assisted by a generative AI agent or tool must comply with the DFSG.

• The submitter is solely responsible for the submitted work and:

• they sufficiently evaluated and properly understand the work they intend to submit, and are able to explain and defend it;

• they put any potential Signed-off-by tag and GPG signatures on the contributions they send to the Debian infrastructure (package, commit, mail, â¦) themselves;

• any content uploaded that would end up in production on Debian infrastructure (main git branch, package upload) has been submitted by them explicitely.

• Work assisted by a generative AI agent or tool should be marked as such in the adapted place (commit message, changelog, â¦). Some lightweight generative tools, such as tab-completion in Copilot, may be used without the contributor realising they rely on generative AI models; we therefore trust submitters to assess when this rule applies. When in doubt, add such marking;

• No cloud-based AI shall be used when the data transmitted could either be sensitive to the project (personal data, information under embargo, â¦) or not public (debian-private discussions, â¦).

Debian Project Secretary