Re: [DRAFT] Policy: allow packages with bundled dependencies subject to mandatory labelling

On Mon, Feb 09, 2026 at 10:09:33AM +0300, Dmitry E. Oboukhov wrote:
>Marc Haber писал(а) 2026-02-08 17:17:
>>I use bottles to run business applications for
>>Windows on Debian, at least a bit containered away and also isolated 
>>from each other.
>>
>>And it is not always easy to correctly judged whether
>>a missing security fix in a library will render an
>>application vulnerable without having intimate knowledge
>>on said app. With unvendored dependencies, we shrug it
>>away and just fix the library.
>
>I see a contradiction here. Currently bottles is not in
>Debian, meaning you're using flatpak (bottles is not
>distributed otherwise). So currently embedding suits
>you, but you would like it not to be in Debian. Why?

First, having quickly moving targets is usually not a good idea to have 
in Debian. Second, bottles is just an example of software that has a 
truckload of dependencies vendored in. We're talking about the generic 
case here.

>Further, Bottles simply downloads zip files with
>libraries to your disk. How can the presence or
>absence of embedding affect security? The security
>of code running under wine, for which bottles is
>just a delivery mechanism.

That is just not how Debian works.

Greetings
Marc