First of all, I don't want to blame individual persons. This is just a note of how disappointed I'm about some parts of Debian that are not complying to licenses when it comes to distributing software.
debian-cd embedds copy of syslinux without source
A couple of years ago, I took over the maintenance of the syslinux package since its previous maintainer was MIA. The takeover was motivated by to the fact, that having started to take care about live systems, I also started to use syslinux on a daily basis and that the syslinux package in Debian was horribly outdated.
At that time, I found out that debian-cd, the toolkit to build the official Debian Installer images, doesn't take syslinux out of the archive at build-time of the image, but rather embedds a copy of the required binaries inside the package itself. So I asked Steve to update the binary what he did. Before the etch release, I needed to ask the debian-cd team to sync again their embedded syslinux copy to match the one I had uploaded to the archive, as it was again outdated.
On the other hand, live-helper, the toolkit to build the official Debian Live images, was always using the package out of the archive and did never had that problem.
After we have released the Debian Lenny Live Beta 1 images last week, we got reports from people trying them on Apple MacBooks and failed because syslinux, taken out of the archive (version 3.71), is broken on that hardware. Some people stated that Debian Installer images do work. That is because debian-cd has an embedded copy of syslinux (version 3.63) which doesn't have that regressions.
Since syslinux version 3.71 is present in testing/lenny as well as unstable/sid, and stable/etch has version 3.31, that means... if debian-cd is embedding a syslinux binary with a different version, it must contain the sources for it (it also needs to contain the sources for it anyway, even if it would embedd binaries of the current version, however, it would be a tiny bit less arguable if its sources would be at least present in the Debian archive). So I checked debian-cd, and surprise, it doesn't contain syslinux sources.
Syslinux is licensed under the GNU General Public License, version 2 or later. That means, that if you distribute the binaries and sources together, you can remove both at the same time if you decide to no longer distribute the binary (that is what Debian uses to do). This let me to bug #497270. The option to distribute the binary with a note on how to get the sources, valid for three years, could theoretically be done, but isn't used so far (since it has pretty bad practical implications of keeping sources arround even after having stopped to distribute the binaries).
Debian sarge release has incomplete source images
Checking fo the consequences for embedding bootloader binaries in debian-cd, I just saw that the Debian sarge release does ship syslinux version 2.04 in its images, but is shipping syslinux 2.11 in its source images. This is another violation of the GPL and I've filled this as bug #497471.
...and syslinux is just one bootloader, only used for i386 and amd64. Someone still needs to check for all the other bootloaders for the other architectures we support (and those also for the etch release).
cdimage.debian.org distributes images without sources
While browsing arround on cdimage.debian.org, I also found the kde4beta livecds made by the Debian KDE team back in November 2007. Although these images are nice, there is no source available for them at all. They use packages that are not available anymore in Debian since a long time. This time, this doesn't only violate the GPL as in the previous two cases, but almost any copyleft license under which we distribute software in main and that is included on these images. I've filled this as bug #497462.
Again, this is not about blaming individual persons. But I'm pretty disappointed by these things. In Debian, we spend a big chunk of time checking licenses of packages before we start distributing them. We have our beloved NEW queue where, after the Debian Developer who has initial uploaded a package and has checked the sources, also ftp-masters are re-checking each and every package to ensure that our archive is kept legal. The NEW queue is a mesurement that consumes a big deal of our time, making uploading packages new packages slow, but this is the prize we pay for ensuring our freedom. And we do also make a big fuss about cluebating upstreams that don't respect licenses (be it intentionally or by accident). However, it appears that as good as our package checks are, we spend little to no time to check our resulting products made from these packages.
Update: kde4beta livecds have been removed now from cdimage.debian.org, see #497462.
Update 2: debimg does the same crap.
Update 3: After beeing forced to write again about debimg violating GPL, the offending binaries got finally removed now.
Update 4: debian-cd seems to be fixed in SVN by this commit.