I've updated my demo repository with your patch. https://salsa.debian.org/helmutg/bootstrap-usrmerge-demo/-/commit/6425c8cde53596199cd37bb1625d1dfb2a4b74d0
Great. I'll take a look.
I'm happy to call it guest upload while I find team upload slightly misleading. I avoid patching changelogs in the demo to avoid the need for unnecessary rebasing. It's a functional demo. For util-linux, I think Chris will send me an encrypted version of a signed .changes file such that I only perform the upload not even the signing. Please let me know if you prefer that approach.
I'd like to use that approach too. At least until I make the package reproducible-from-git (which currently it's not). BTW: There is a minor glitch in postinst which I introduced a long time ago: /var/run and /var/lock are created as real directories, but then, at debootstrap time, the function migrate_directory() function converts them to symlinks. (I do not remember why it's done that way, maybe shipping a real symlink would confuse dpkg?) Do you think I should try to do this in a more orthodox way? Or maybe it does not worth the effort? (I ask because, as in the usr-merge patch, this is also about "avoiding dpkg to follow symlinks") Thanks.