Bug#1021390: nvda2speechd: downloads source from the network during build

[Philipp Kern]

On 10.10.22 22:02, Samuel Thibault wrote:
>> I think in its current state the package is anyway non-free since it
>> does not fulfill the DFSG for the contents it ships in its binary
>> packages.
> Ok, let's move it to non-free then.

I admit that I'm surprised that policy 4.9 actually provides a carve-out 
for this - only targeting network access restrictions to "main":

> For packages in the main archive, required targets must not attempt network access, except, via the loopback interface, to services on the build host that have been started by the build.

Pulling external code during the build from a package in the archive is 
still super surprising to me. Do we have other precedents? I can see how 
it's a pragmatic solution but [1] together with [2] kinda scares me. ;-)

At that point, couldn't we ship the cross-build target compiler prebuilt 
in non-free? That being said, that would unfortunately still not help 
with buildds, given that we still don't support build-dependencies on 
non-free packages unfortunately. :(

Kind regards
Philipp Kern

[1] https://sources.debian.org/src/nvda2speechd/0.1-5/debian/rules/#L29
[2] https://github.com/rust-lang/rustup/issues/2028