Policy: Discourage statically linked binaries

Wording: Russ Allbery <rra@debian.org>
Seconded: Bill Allombert <ballombe@debian.org>
Seconded: Jonathan Nieder <jrnieder@gmail.com>
Closes: #555980

diff --git a/debian/changelog b/debian/changelog
index c1b4ef53af0bdacd718cc52001dcf8d7b9a33e58..579b8c7f712e478b2643ad421cb99084a03abb6a 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -28,10 +28,15 @@ debian-policy (3.9.6.0) unstable; urgency=low
     Seconded: Damyan Ivanov <dmn@debian.org>
     Closes: #748479
   * Policy: Grant an FHS exception for the multiarch headers directories
-    Wording Bill Allombert <ballombe@debian.org>
+    Wording: Bill Allombert <ballombe@debian.org>
     Seconded: Jonathan Nieder <jrnieder@gmail.com>
     Seconded: Russ Allbery <rra@debian.org>
     Closes: #742756
+  * Policy: Discourage statically linked binaries
+    Wording: Russ Allbery <rra@debian.org>
+    Seconded: Bill Allombert <ballombe@debian.org>
+    Seconded: Jonathan Nieder <jrnieder@gmail.com>
+    Closes: #555980
   * Packaging: refreshed the names of the Policy Editors.
 
   [ Jonathan Nieder ]

diff --git a/policy.sgml b/policy.sgml
index fa0a390cf08308c5ed2c57886845ec64e9a66d18..c5fd30586c505a1805f90e2d9b833ae2cf4a1c2e 100644 (file)
--- a/policy.sgml
+++ b/policy.sgml
@@ -8466,7 +8466,17 @@ fi
          renamed.  If a consensus cannot be reached, <em>both</em>
          programs must be renamed.
        </p>
-
+       <p>
+          Binary executables must not be statically linked with the GNU C
+          library, since this prevents the binary from benefiting from
+          fixes and improvements to the C library without being rebuilt
+          and complicates security updates.  This requirement may be
+          relaxed for binary executables whose intended purpose is to
+          diagnose and fix the system in situations where the GNU C
+          library may not be usable (such as system recovery shells or
+          utilities like ldconfig) or for binary executables where the
+          security benefits of static linking outweigh the drawbacks.
+       </p>
        <p>
          By default, when a package is being built, any binaries
          created should include debugging information, as well as

diff --git a/upgrading-checklist.sgml b/upgrading-checklist.sgml
index 592dad8cd86882fa21060eb34b09d4b80d26139e..9c7db6c48f2cb8bb9abe9ad7985d2856a9268b94 100644 (file)
--- a/upgrading-checklist.sgml
+++ b/upgrading-checklist.sgml
@@ -50,11 +50,15 @@ Released xxx, 2014.
   <item>The FHS requirement for <file>/usr/local/lib64</file> to exist
   if <file>/lib64</file> or <file>/usr/lib64</file> exists is removed.
   </item>
-<tag>9.1.1</tag>
+<tag>9.1</tag>
   <item> An FHS exception has been granted for multiarch include files,
   permitting header files to instead be installed to
   <file>/usr/include/triplet</file>.
   </item>
+<tag>10.1</tag>
+  <item> Binaries must not be statically linked with the GNU C library,
+  see policy for exceptions.
+  </item>
 </taglist></p>
 
 <sect id="3.9.5.0"> Version 3.9.5.0