Hi! On Wed, 2017-07-12 at 23:00:44 +0100, Chris Lamb wrote: > > It would be nice if lintian could error out when finding an orig > > tarball signature on source format 1.0 packages. > > > > The pattern for the signature is «<basename>.orig.tar.gz.asc». > > Where are these files stored? Am I confusing this with > debian/upstream-signing-key.asc … ?
They are part of the source package, referenced by the .dsc. You can see existing instances of this in the archive, such as: $ apt-cache showsrc libbsd | grep '\.asc$' But at this point I'm not sure if the report makes sense anymore, as I might as well enable signatures for format 1.0, given that stable supports unpacking those now. Thanks for the "accidental" reminder. :) The report would still make sense for anything targetting a stable release though, so it perhaps still has some merit? Otherwise it can be closed. Thanks, Guillem