Debian only ships free software (in main, but that's a detail). This is actually enforced and there is processes in place to ensure that it stays that way. Th

Debian only ships free software (in main, but that's a detail). This is actually enforced and there is processes in place to ensure that it stays that way. This means that all new software that Debian packages is audited by a group of volunteers, the ftp-masters team, they check copyright, license and stuff like that. If all binaries in Debian would vendor all of their dependencies, this would cause a lot extra and duplicated work for the ftp-masters, a team that already have a lot to do. Same with security, if a popular go library needs to be patched to fix a security problem, then it's easier to do that in one place instead of patching it in N different binary packages.