Debian puts LLM provenance on the ballot, and downstream maintainers inherit the paperwork

Debian has tabled proposals both for and against LLM-assisted contributions in a general resolution, including one attributed to Matthias Geiger which states that "we will not allow direct contributions to Debian written with the use or assistance of large language models (LLMs) or other generative AI tools" ^[1][3]. Whichever text wins, the consequence for everyone downstream is the same: a rule about where code came from stops being a team habit and becomes something you can be measured against.

The prohibition case is built on stability, not copyright. The Geiger proposal grounds itself in Debian's "reputation for stability" and argues that widespread LLM usage is an artefact of a "move fast and break things" attitude that is "contrary to what makes Debian Debian" ^[2][3].

The scope, if approved, is wide in a specific direction. According to The New Stack, the ban would cover Debian source packages and other software developed by Debian, official Debian web resources, direct code contributions defined as packaging, native Debian software such as the lintian package checker, and documentation and translations written by Debian contributors ^[6]. It is still only a set of proposed limitations ^[7].

The exemptions are where operators should look. The prohibition would not apply to upstream projects that use generative AI, and would not block patches or security fixes coming from upstream that may or may not have used AI services; Debian developers could still package third-party AI-coded tools, they just could not use those tools for new direct project work ^[8]. That draws the line at authorship inside Debian rather than at AI anywhere in the supply chain, which is the only version of the rule that is enforceable at all.

It is not a two-way fight. Seven counterproposals are on the table, including allowing AI-assisted contributions with conditions, rejecting LLMs as far as practical while updating the code of conduct, accepting AI contributions for Debian-specific work, guidelines on responsible use, a statement under the pledge "Debian is created by humans", and one titled "avoid the use of LLM: climate destruction is a deal breaker" ^[4]. Counting the prohibition itself, that is eight options on the ballot ^[5], and The New Stack describes it as an eight-way vote [c5b].

Joe Phillips, author of the Hybrid Workforce Standard, told The New Stack that the debate shows Debian already agrees provenance must be declared, and that the vote is really an argument about "how big the sticker should be" on code origins: "That is not a war over principle - that is a formatting dispute with a manifesto attached" ^[9]. He points to the community section of the argument, which holds that contributors who lean on a model never learn packaging and so can never replace the maintainer who burns out, as the one harm that compounds ^[10]; his prescription is apprenticeship rather than prohibition, with new contributors working in shadow mode and reviewed like juniors ^[11].

Justin Beals, CEO and founder of Strike Graph, calls it the wrong fix for the actual problem, and reads the ban as an admission that nobody has built a reliable way to verify what an AI agent actually produced before it lands in a codebase this many systems depend on, including infrastructure running in orbit ^[12]. Debian, named after founder Ian Murdock and his then-wife Deborah, is said to have replaced Windows on the International Space Station in 2013 ^[13].

Watch which of the eight texts wins, and then read the definition of "assistance" in it, because that single word decides whether a maintainer has to attest to tool use or only to intent. Watch whether the upstream exemption survives amendment. And if you maintain anything that packages Debian output, write your own provenance line now rather than adopting whichever one the vote hands you.