How Debian Prevents Embedded Libraries

The Debian operating system strictly regulates software packages to prevent the inclusion of embedded or "vendored" third-party libraries, a practice known in Debian terminology as including convenience copies of code. To ensure system-wide security, reduce memory footprints, and streamline vulnerability patching, Debian mandates that all software rely on shared, independently maintained system libraries. Debian enforces this compliance through formal policy requirements, upstream source sanitization, automated linting, manual archive screening, and build-system patching.

The Debian Policy Requirement

Debian Policy Section 4.13 explicitly dictates that packages must not contain embedded copies of software that is already available in the archive, or that can be packaged separately. When an upstream project bundles a third-party dependency directly within its source tree, Debian maintainers are required to decouple it. By linking against shared libraries, a single security patch applied to a base dependency automatically secures every application on the system that relies on it.

Source Sanitization via Repacking

Maintainers often neutralize embedded libraries at the source archive level before building begins. Using Debian's package tracking utilities—specifically uscan and mk-origtgz—maintainers declare directories and files to strip in the debian/copyright file under the Files-Excluded field. When new upstream source code is downloaded, the utility automatically removes bundled third-party directories and generates a sanitized tarball, frequently appending a +ds (Debian source) or +dfsg suffix to the upstream version string.

Build-System Patching and Unbundling

Once embedded code is removed from the source tree, maintainers patch the software’s build systems (such as CMake, Meson, or GNU Autotools) via Quilt patches stored in debian/patches/. These modifications reroute include paths and linker flags to reference system-wide headers and shared objects provided by other Debian packages. The maintainer then declares these external libraries in the Build-Depends control field, ensuring the package cannot compile unless the system versions are present.

Automated Static Analysis with Lintian

Enforcement is continuously monitored using Lintian, Debian's automated static analysis tool. Lintian inspects source and binary packages for patterns, embedded signatures, known header files, and shared code commonly associated with popular bundled libraries (such as zlib, libpng, or SQLite). If Lintian detects evidence of an embedded code copy during package builds or archive uploads, it issues warnings or errors that prevent smooth integration into the distribution.

FTP Master Inspection and the NEW Queue

Every new package, or existing package introducing a new binary name, must pass through Debian's "NEW" queue. This checkpoint involves manual inspection by the Debian FTP Master team. Reviewers check source structures and licensing to verify that upstream convenience copies have been either stripped or justified. If a package contains unauthorized embedded dependencies, the FTP Masters reject the upload, requiring the maintainer to resolve the bundling issue before admission into the archive.

Exceptions and Security Tracking

In rare circumstances where unbundling is technically infeasible—such as software requiring heavily modified internal forks or ecosystems with deep static dependency models like Rust or Go—exceptions require explicit documentation. When an embedded copy is granted an exception, it must be registered with the Debian Security Tracker. This ensures the Debian Security Team can track vulnerabilities affecting the embedded library and mandate coordinated updates whenever a Common Vulnerabilities and Exposures (CVE) identifier is assigned.