The Debian Free Software Guidelines (DFSG) state in item 2 that for Debian packages, The program must include source code and the FTP-masters interpret this as requiring source for all packages.

When auto-generated prebuilt files are present, this could lead to them being used directly instead of built from source, which could lead to the source not getting used often, which could lead to the prebuilt files diverging significantly from the rebuilt ones, the build process silently no longer working, or the source silently getting deleted.

So upstream should remove auto-generated prebuilt files from their VCS and source tarballs. Upstream might want to only add prebuilt files to binary packages or bundle the prebuilt files into a single but separate source tarball. Once upstream has fixed the issues, the Debian package can then be updated to the fixed version. If upstream refuse to remove the prebuilt files, then Debian should either remove the files in debian/rules clean and very early in debian/rules build, or repack the upstream tarball using Files-Excluded (but only if there is a DFSG or size issue), so that they are always built from source and there is no chance of the prebuilt versions being used by the build process. Using Files-Excluded should be avoided if possible, so that the Debian tarball is identical to the upstream tarball and any detached signatures are still valid.

There may be some exceptions to this:

Even if you can show that the prebuilt files can be reproduced from their original source just with packages from Debian main, it is still strongly recommended to regenerate them from source during the build. The advantages of doing so are:

There is not yet any manual tracking of packages that embed prebuilt files (including unused ones).

No wiki pages mention lists of prebuilt files yet.

There are several tools for detecting prebuilt files:

The Debian Sources website collects hashes and ctags of all Debian source code and allows searching for specific hashes and ctags, which may be useful for detecting specific prebuilt files in multiple source packages.

If you have a prebuilt file with some unique string you can likely find other copies using the Debian code search site or external code search engines such as searchcode and GitHub.

If a prebuilt file has a fairly unique name or extension, you can often find copies of that file by searching the contents of Debian source packages using apt-file:

apt-file search -I dsc somefile
apt-file search -I dsc -x '\.o$'

Some Debian folks keep track of prebuilt files they found via usertags:

Fonts team

See also