Andreas Tille writes ("Bug#969093: Patch: Newer upstream version of
its-playback-time"):
> I have cloned your dgit repository and migrated it to Salsa in
> Debian team:
>
> https://salsa.debian.org/debian/its-playback-time
Hi. Thanks for trying to help with this package. However:
> As usual you want dgit / tag2upload uploads, right? I'd happily do so
> if you confirm that this is OK. Since I'm used to pristine-tar which
> was needed to let Salsa CI run with new upstream version please let me
> know if this is possible with tag2upload meanwhile.
Please do not use pristine-tar. I'm surprised that you haen't noticed
that I am strongly opposed to the use of upstream tarballs. See rant
below.
I have rewound the salsa main branch back to the last upload. I put
your work on a branch tarballs-based-rejected. While I was there, I
renamed the main branch to `main`, for the usual reasons.
Since Simon's git hosting server is difficult to reach because it is
being DoS'd by the "AI"/LLM/slop crowd, I have pushed a copy of what I
managed to fetch to Salsa as "upstream".
Also I'm not sure I like the change of git workflow from
dgit-maint-merge(7) to in-tree quilt patches. After all, Simon takes
my changes and therefore there is in fact no delta when we merge.
I think we could sensibly change the source format to "3.0 (native)".
I looked at your git branch and I think I *would* like to take many of
those changes. However, there are some that I think we need to talk
about further. I don't think this bug report is a good forum for
that. Perhaps the best way would be Salsa Merge Requests.
Please let me know how you'd like to proceed.
Regards,
Ian.
Rant about upstream tarballs follows:
In my opinion, using upstream tarballs is a serious antipattern in
Debian. Have you been following the "debates" in debian-devel? Have
you read my blog posts? Have you read Joey Hess's old blog posts?
(References available on request.)
Where upstream is using git, it is git that is the source code.
The upstream tarballs are an intermediate build product.
The use of an intermediate build product as if it were the source code
exposes Debian to many practical and ethical difficulties. It even
helped enable the xz attack!
That opinion of mine applies just as well here (where the tarball was
created by someone known personallly to me, and is even hosted on my
own server!) as it does anywhere use.
Simon is using git. We should be basing our work on his git.
Note that this not just my opinion. It is also the opinion of the
author of pristine-tar! And of course of Sean, my collaborator in
Debian's git transition. This opinion applies to the vast majority of
packages.
FTAOD despite the fact that Sean and I are amongst the foremost
experts on Debian source handling with git, I do not claim any special
authority with respect to git and tarball practices Debian-wide.
However, this is a package of which I am the maintainer. As the
maintainer of this package I hereby insist that we base our work on
upstream git, not any tarballs.
I very strongly recommend that you do that in all of your salvaging
work. Upstream tarballs are even more of a risk with undermaintained
packages.
I believe the Salsa CI pipeline can be made to work simply by writing
an appropriate gbp.conf (to specify the use of the upstream tag, if
there is one) and/or by making a suitable upstream/NNNN tag oneself,
if there isn't a suitable upstream tag already. I believe
gbp-import-ref can do the latter.
Ian.
--
Ian Jackson <[email protected]> These opinions are my own.
Pronouns: they/he. If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.
