Policy: Clarify whose signature should go in debian/changelog (4.4)

[debian/debian-policy.git] / policy.sgml

diff --git a/policy.sgml b/policy.sgml
index fa0a390cf08308c5ed2c57886845ec64e9a66d18..fbbe4a307c08cf0ee810a0b8ceb9f111723b8582 100644 (file)
--- a/policy.sgml
+++ b/policy.sgml
@@ -1746,11 +1746,14 @@ zope.
 
        <p>
          The maintainer name and email address used in the changelog
-         should be the details of the person uploading <em>this</em>
-         version.  They are <em>not</em> necessarily those of the
-         usual package maintainer.<footnote>
-           If the developer uploading the package is not one of the usual
-           maintainers of the package (as listed in
+         should be the details of the person who prepared this release of
+         the package.  They are <em>not</em> necessarily those of the
+         uploader or usual package maintainer.<footnote>
+           In the case of a sponsored upload, the uploader signs the
+           files, but the changelog maintainer name and address are those
+           of the person who prepared this release.  If the preparer of
+           the release is not one of the usual maintainers of the package
+           (as listed in
            the <qref id="f-Maintainer"><tt>Maintainer</tt></qref>
            or <qref id="f-Uploaders"><tt>Uploaders</tt></qref> control
            fields of the package), the first line of the changelog is
@@ -3673,7 +3676,7 @@ Files:
          <p>
            The special value <tt>byhand</tt> for the section in a
            <tt>.changes</tt> file indicates that the file in question
-           is not an ordinary package file and must by installed by
+           is not an ordinary package file and must be installed by
            hand by the distribution maintainers.  If the section is
            <tt>byhand</tt> the priority should be <tt>-</tt>.
          </p>
@@ -6972,8 +6975,7 @@ Built-Using: grub2 (= 1.99-9), loadlin (= 1.6e-1)
                   <footnote>
                     This is necessary in order to reserve the directories for
                     use in cross-installation of library packages from other
-                    architectures, as part of the planned deployment of
-                    <tt>multiarch</tt>.
+                    architectures, as part of <tt>multiarch</tt>.
                   </footnote>
                 </p>
                 <p>
@@ -8466,7 +8468,17 @@ fi
          renamed.  If a consensus cannot be reached, <em>both</em>
          programs must be renamed.
        </p>
-
+       <p>
+          Binary executables must not be statically linked with the GNU C
+          library, since this prevents the binary from benefiting from
+          fixes and improvements to the C library without being rebuilt
+          and complicates security updates.  This requirement may be
+          relaxed for binary executables whose intended purpose is to
+          diagnose and fix the system in situations where the GNU C
+          library may not be usable (such as system recovery shells or
+          utilities like ldconfig) or for binary executables where the
+          security benefits of static linking outweigh the drawbacks.
+       </p>
        <p>
          By default, when a package is being built, any binaries
          created should include debugging information, as well as