More to the point-- what's Debian policy on applying local patches in their packages? For example-- if you do it today on a core app/lib without consulting ups

More to the point-- what's Debian policy on applying local patches in their packages? For example-- if you do it today on a core app/lib without consulting upstream is that enough to get your credentials revoked? I ask because Debian famously patched a library to quiet a valgrind memory error which resulted in their userbase generating predictable key material for a few years[1]. I trust them not to do that again (at least with libs that are obviously security related). But is there explicit policy in this regard? [1] https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number...