I agree that this law seems ill-advised, but it seems like a package repository like, say, Debian’s could be made compliant with a new policy that they will not distribute any software that meets the definition of communication software as defined here, and thus the question of who is making the request becomes irrelevant.

Of course that does then leave the question of what does and does not meet that definition. A web browser is the most obvious edge case: it isn’t itself a program for human communication but it provides access to software that is. In that case it’s unclear whether the browser itself is in this category or whether it’s the providers of web applications that afford communication that then become culpable.

Regardless though, it does seem like this law is very ambiguous in what it covers.