Scale · founder · 8 min read

Debian Voted to Allow AI-Written Code — and Put the Whole Risk on the Human

The biggest community-run Linux project settled its AI policy on August 28. It refused to answer the copyright question and handed it to the contributor.

Published August 29, 2026 ·

open source copyright governance vibe coding risk founders

Debian spent three weeks arguing and two weeks voting about whether contributors may use AI to write code. The results were posted to the project’s vote mailing list on the evening of August 28, and the winner was Choice 5: “Responsible Use of Generative AI,” proposed by Marc Haber.

The headline is that Debian said yes. The interesting part is the sentence where it says it will not tell you who owns the output.

What Debian actually decided

The winning text does three things at once.

It permits AI: “Debian neither endorses nor prohibits the use of generative AI tools in the development, maintenance, or documentation of software.”

It sets one hard condition — the human has to have actually looked at it. Contributors must “understand, review, test, and, where appropriate, modify AI-assisted output” before it goes in. Blindly uploading AI-generated material is “inconsistent with Debian’s established development practices.”

And it declines to mandate disclosure. Contributors are encouraged to say when AI helped. They are not required to.

The margin was not comfortable. The winning option beat the next-most-popular one — a conditional framework that would have required disclosure — by 203 votes to 148. The hardline proposal to amend Debian’s Social Contract to ban LLM-assisted contributions failed to reach quorum. Lucas Nussbaum, who proposed the losing option and then seconded the winner, put the split at roughly 64/36 and wrote that “we have a lot of work ahead of us to act as a community and understand how we can continue to accommodate the very large minority that would have preferred to ban or discourage AI.”

Haber, whose proposal won, sounded less than triumphant: “It is just too early to take a final decision on the matter. Let’s revisit this in two years or so.”

The clause almost nobody is quoting

Buried in the middle of the resolution is the part founders should read twice:

Debian acknowledges that the legal status of material produced by generative AI systems remains the subject of ongoing discussion in many jurisdictions… The Project does not seek to resolve these unsettled legal questions through this General Resolution, nor does it adopt a position on whether AI-generated output is, in whole or in part, copyrightable or derived from copyrighted works.

Instead, Debian “continues to rely on the judgment and responsibility of its individual contributors,” who must “avoid introducing content whose legal status they cannot reasonably justify.”

Read that as a founder, not a Debian developer. The largest community-run distribution in the world, with thirty-three years of institutional caution behind it, looked directly at the copyright question and said: we are not answering this, and the person who pressed submit owns the consequences.

That is exactly the posture an acquirer, an enterprise customer, or a security reviewer will take with you. Nobody upstream is going to indemnify the provenance of your code.

Open source has split, and the split is now mapped

Debian’s vote is the loudest data point in a picture that has been filling in all year. Published policies now fall on a clear spectrum:

• Outright ban. QEMU declines any contribution believed to contain AI-generated content. Gentoo’s Council voted unanimously in 2024 to forbid it. Many GNOME projects ban it across code, docs, issues, and artwork. Codeberg’s members voted about 70% to ban primarily-AI-generated projects in July — covered here.
• Allowed but made expensive. LLVM permits AI tools but treats unreviewed AI submissions as “extractive contributions” and bans AI from good first issue tickets entirely.
• Allowed with required disclosure. The largest cluster: Fedora, Rocky Linux, the Apache Software Foundation, OpenInfra, OpenTelemetry, and the Linux kernel itself.
• Allowed with encouraged disclosure. Debian, as of August 28.

If you were waiting for the ecosystem to converge on an answer, it hasn’t. It has converged on a format.

Assisted-by: is the standard, and your tools are emitting the wrong one

Here is the practical finding, and it’s the one thing in this article you can act on today.

The projects that allow AI with rules have quietly standardized on a git commit trailer: Assisted-by:. The Linux kernel’s official policy prescribes the format Assisted-by: AGENT_NAME:MODEL_VERSION. Fedora, Rocky Linux, LLVM, OpenInfra, and OpenTelemetry all recommend the same trailer. Apache uses Generated-by: for the narrower case where a tool produced essentially all of the content.

The kernel adds one rule that explains the whole design: an AI may never add a Signed-off-by: line. That signature certifies the Developer Certificate of Origin, and only a human can certify anything. The tool assisted. The human signs.

Now the problem. GitHub Copilot, Cursor, and Claude all default to emitting Co-authored-by: — the trailer designed for human collaborators. That’s not a cosmetic mismatch. It names an entity that cannot sign a contributor agreement, cannot hold copyright, and cannot be held responsible, and it does so inside the metadata your chain of title depends on. If you are building a company whose main asset is a codebase, you do not want your commit history quietly asserting that a model co-authored it.

What this means if you don’t run an open-source project

Most readers here are building a private SaaS product, not maintaining a distro. Two things carry over anyway.

“A human reviewed this” is hardening into the actual dividing line. Codeberg banned unreviewed AI, not AI. Debian permitted AI on the explicit condition that a person understands and stands behind the result. Different verdicts, identical test — and that test will show up in enterprise procurement questionnaires and technical diligence long before it shows up in law.

Provenance is something you’re expected to have, not something you reconstruct later. You cannot retroactively work out which of forty thousand lines came out of a model eighteen months ago. You can, starting now, keep a machine-readable record. That’s the whole appeal of a git trailer: git log --grep="Assisted-by:" is a real answer to a question you will eventually be asked.

One more clause in Debian’s resolution is worth stealing verbatim: contributors must ensure that credentials, cryptographic keys, private communications, and embargoed security information “are not disclosed to third-party AI services unless such disclosure has been explicitly authorized.” That is a better-written version of the AI policy most startups don’t have.

What to do this week

1. Fix your trailer. Configure your tools to emit Assisted-by: rather than Co-authored-by:, and put one paragraph in CONTRIBUTING.md or an AGENTS.md at the repo root.
2. Write the data rule. No credentials, keys, customer data, or embargoed security information into third-party AI services without explicit sign-off. Debian’s wording is right there.
3. Name a human per change. Not a process — just the person who understands what shipped and would answer for it.

The bottom line

Debian did not endorse AI coding. It declined to police it, kept every existing quality and licensing standard intact, refused to touch copyright, and made the individual contributor carry all of it. Roughly a third of the project wanted a ban and lost.

The takeaway isn’t which way the vote went. It’s that the most process-heavy, legally cautious community in open source looked at the provenance question, decided it was unanswerable for now, and pushed responsibility down to whoever hit submit. That’s where it’s going to sit for you too. The cheapest hedge available is a one-line commit trailer and a person who can honestly say they read it.