All copyright-protected files must be licensed in compliance with the Debian guidelines.
NB! This may imply compliance with FSF guidelines too, but not in all cases.
We (PureOS developers) should locate or forward bugeports upstream to Debian and usertag them to be in sync with corresponding bugs in Debian:
bts user email@example.com . usertag 123456 nonfree-license