LLM Usage in Debian: Three Proposals

Debian Voting Information / 2026 / General Resolution: LLM usage in Debian

Matthias Geiger [ werdahias@debian.org ] [ text of proposal ]

This proposal aims to expressly forbid any contributions to Debian written with the use or assistance of large language models (LLMs) or other generative AI tools.

The scope of this GR is (non-exhaustive): Debian source packages Official Debian project software, such as lintian Debian web resources Documentation and translations added by Debian contributors Official communication from Debian

It does not include: Upstream projects using LLMs for development AI-related software Upstream patches/security fixes etc.

Debian has a well-earned reputation for stability. This stability is crucial to Debian's position in the free software ecosystem. It is our belief that widespread LLM usage comes from the "move fast, and break things" attitude that, while common in many parts of this industry, is contrary to what makes Debian Debian, and is inappropriate for Debian contributors.

In practical terms, LLM usage raises the following concerns: 1. Copyright LLM output has very unclear legal status: it may be possible to copyright on its own merits, or not; it may be affected by all of the licenses and copyrights in the training data, or not. Debian Policy and the DFSG require absolute clarity for licensing and copyright[1][2]. Software and other contributions written conventionally by humans with unclear copyright or license status are not allowed in Debian; LLM output should not have a special exception to this.

LLM output has many well-known problems with accuracy.[3][4][5] A LLM can never "know" if its output is correct since it merely produces syntactically likely combinations of the training data. In some environments this is good enough. In Debian, it is not. For instance, in packaging, each Debian source package is unique. Since packaging syntax and best practices have changed over time, a LLM-produced package will have a mixture of contents spanning the age of the archive, with watch files that do not work, overrides out of context, imaginary copyright, and will generally be unfit for upload. A seasoned Debian contributor with packaging expertise may find some limited usefulness here, but a new contributor cannot, and would not know how to fix it. These same quality and accuracy concerns apply clearly to all of the areas listed in the scope of this proposal above. If Debian were a closed organization comprising only domain experts who never leave, this might not be an issue; however,

Debian is a project that is more than just code: it is a community built on shared interests in free software and solving technical problems. Debian intentionally grows this community through many means, and new contributors are always encouraged to join. Allowing LLM contributions breaks this. New contributors submitting LLM output for review places an unnecessary strain on the reviewer, which can lead to burnout. Furthermore, LLM-dependent new contributors do not actually learn and understand the details of Debian packaging or processes, so they cannot come to replace a former burned out DD.

LLM companies directly hurt the free software community as whole by scraping the whole web for training data without any regard for license, copyright, or even established conventions such as robots.txt.[6] This has had a major negative impact on Debian's public web resources, effectively a large scale and perpetual Denial of Service attack on sites that many users rely on. As a consequence parts of our infrastructure were not reachable at all, and JS-based checks had to be enabled. Many other projects were similarly affected. Furthermore, LLM training consumes a staggering amount of resources[7], and the user verification systems that we have been forced to implement as protection waste resources as well. This is blatant disregard for the internet as a public resource, wastes system administrator time, and although individual LLM sessions do not directly use massive resources or DoS the public web, the fact that they can be used at all is a direct result of these unethical behaviours by the LLM companies.

Debian has a Social Contract. [8] Our priorities are our users and free software. Debian is Stable. [9] Users and organizations choose Debian because it is reliable and secure.

Debian is not here to generate as much code as possible requiring manual review by a shrinking number of human volunteers, or to package every piece of software, or to rush new features, but these are what LLMs are used for.

In conclusion, allowing LLM contributions is contrary to the social contract and the common cause of creating a free operating system with a focus on quality and stability.

In the interest of not eroding Debian's reputation or further damaging the community, LLM-assisted contributions should be prohibited from inclusion in Debian.

Though our position is that LLM contributions are contrary to documents already ratified by Debian, in order to remove all doubt, we propose the following addition to the Social Contract:

6. Works Created through the use of Large Language Models (LLMs) We will not allow direct contributions to Debian written with the use or assistance of large language models (LLMs) or other generative AI tools. Direct contributions are defined as packaging, native Debian software like lintian, documentation and translations written by Debian contributors, and official Debian web resources, etc. Other categories such as upstream projects written with LLM assistance may be included at a later date. This ensures that Debian remains a stable, trusted, and reliable operating system, and protects the interests of the Debian volunteers who make it possible. Possible Issues Other projects exploring similar decisions have elicited a common reply: "How will you enforce a ban on LLM contributions?" While enforcement could be a challenge, this is a statement of intent by the Debian community, and we trust this community to adhere to it in good faith.

[1] https://www.debian.org/doc/debian-policy/ch-archive.html#copyright-considerations [2] https://www.debian.org/social_contract#guidelines [3] https://web.archive.org/web/20240614004123/https://news.northeastern.edu/2023/11/10/ai-chatbot-hallucinations/ [4] https://web.archive.org/web/20250328154700/https://transformer-circuits.pub/2025/attribution-graphs/biology.html#dives-cot [5] https://www.marketwatch.com/story/openais-sam-altman-tells-salesforces-marc-benioff-that-ai-hallucinations-are-more-feature-than-bug-1c035c52 [6] https://lwn.net/Articles/1008897/ [7] https://tech-insider.org/ai-data-center-power-crisis-2026/ [8] https://www.debian.org/social_contract [9] https://www.debian.org/doc/manuals/debian-reference/pr01.en.html#_what_is_debian

Citations are for background information only and do not reflect an endorsement of specific websites. Some ideas and wording were derived from the sources below.

GNOME discussion: https://discourse.gnome.org/t/loupe-no-longer-allows-generative-ai-contributions/27327 (CC0) Gentoo AI policy: https://wiki.gentoo.org/wiki/Project:Council/AI_policy Codeberg AI policy: https://codeberg.org/Codeberg/org/pulls/1253#issuecomment-19820434

This document was written by Matthias Geiger and Jesse Rhodes with input from Sledge and josch, organically and without language model assistance.

Lucas Nussbaum [ lucas@debian.org ] [ text of proposal ] [ text of amendment ] [ text of amendment ]

Using its power under Constitution section 4.1 (5), the project issues the following statement describing its current position on AI-assisted contributions. This statement describes the position of the project at the time it is adopted. That position may evolve as time passes without the need to resort to future general resolutions. The GR process remains available if the project needs a decision and cannot come to a consensus.

The Debian project recognizes that AI-assisted contributions raise many concerns, e.g. about the technical quality and maintainability of such contributions, and their legal status. AI itself also raises additional concerns, about its impact on society at large, on the IT industry and on Free Software; about its environmental impact; and the aggressive or non-compliant practices of AI scrapers.

Nevertheless, many Debian contributors find AI tools helpful when contributing to Debian, and ultimately for improving Debian.

Given both the benefits and risks of AI assistance, and the controversial discussions within the community, the Debian project finds it necessary to clarify its position on AI-assisted contributions and establish clear guidelines.

The Debian project allows AI-assisted contributions (partially or fully generated by an LLM), provided the following conditions are met: Tooling Legal Compatibility: Contributors should ensure that the terms and conditions of the generative AI tool do not impose contractual restrictions that conflict with the distribution, modification, or use of the output in the context of Debian. Licensing and Attribution: If any pre-existing copyrighted materials (including pre-existing code licensed as free software) authored or owned by third parties are included in the AI tool’s output, prior to contributing such output to the project, the contributor should verify they have the right to submit it under the relevant open source license. Accountability: Contributors assume full responsibility for their contributions, including vouching for the technical merit, security, license compliance, and utility of their submissions. The contributor remains solely accountable for the entirety of these contributions. Contributors should fully understand the proposed changes and be prepared to justify them. Disclosure: When a significant portion of a contribution is generated or substantially assisted by a tool, contributors should disclose the use of the tool, making it clearly visible to the intended audience. This covers all forms of contribution, including code, mailing list posts, and bug discussions. The form of the disclosure is left to the contributor; one convenient option for commits is a Git trailer such as Generated-By: or Assisted-By:. Prior Discussion of Bulk or Automated Changes: Similarly to the mass-bug filing process (Developers Reference section 7.1.1), contributors should discuss their intention before submitting bulk or autonomously generated contributions. Any such automated process should be overseen by a human who remains accountable for its behavior and output. Confidentiality and Privacy: Contributors must not use generative AI tools that transmit data to untrusted providers with non-public or sensitive project information (such as embargoed security reports or private communication), as this may lead to the unintended disclosure of confidential data.

Ian Jackson [ iwj@debian.org ] [ text of proposal ]

LLMs have many serious problems, including: undermining the mechanisms of free software community building; environmental damage; exploitation of authors; disruption to open web hosting by aggressive scraping; generation and promulgation of bullshit; polluting the information commons; hazards to users' mental health; economic bubbles; distortion of the computer hardware market; fraud; ownership by horrible people and companies; and so on. Ethical and safe use of this technology is almost impossible.

Ideally, LLM output should not form any part of software that we rely on, nor should LLM output ever take the place of human-written prose.

Unfortunately some of the wider software world, including many of our upstreams, take a different view. Therefore a complete ban on LLM output as part of Debian is currently impractical.

1. We request that all contributors to Debian avoid the use of LLMs in their Debian work.

2. We request that all decisionmakers within Debian discourage LLM use as much as practical. Practicality is a