Hi! Some days ago I noticed that uscan is generating bogus upstream tarball signature files when converting them from the ones fetched from upstream. There are several problems, but the main ones are that it will rearmor some of the ASCII armored signatures based on the extension, and that it will not properly convert the trailing OpenPGP Armor Header Line.
This is now fixed in a proposed MR: <https://salsa.debian.org/debian/devscripts/merge_requests/120> But the archive contains multiple instances of this. :`( I've checked all of unstable and these are the current numbers: ,--- fetch-asc --- #!/bin/sh suite="$1" /usr/lib/apt/apt-helper cat-file \ $(apt-get indextargets --format '$(FILENAME)' 'Identifier: Sources') | \ grep '\.asc$' | \ cut -d\ -f4 | \ cut -d_ -f1 | \ uniq | \ xargs -n10 apt-get source -t "$suite" --print-uris | \ sed -rne "s/^'([^']+)'.*$/\1/p" | \ grep '\.asc$' | \ xargs -n10 wget -q -c `--- ,--- $ fetch-asc unstable # Bogus OpenPGP Armor Header Line $ grep -l ARMORED *.asc | wc -l 424 # Rearmored ASCII signature $ grep -l ^LS0tLS1CRUd *.asc | wc -l 347 `--- I'm attaching the list of affected source packages for each (skipping dd-list to avoid size limits). This is particularly nasty, because fixing this requires to wait for a new upstream release, or the equivalent of a "tarball" repack, as in, you'd need to bump the upstream version number so that the fixed .asc can be modified. The fix would be something like: ,--- fix-asc --- #!/bin/sh asc=$1 if grep -q ^LS0tLS1CRUd "$asc"; then gpg --dearmor <"$asc" | sponge "$asc" fi sed -e 's/ARMORED FILE/SIGNATURE/g' \ -e '/^Version:/d' \ -e '/^Comment:/d' \ -i "$asc" `--- For dpkg 1.20.x, I'm going to validate all .asc at source build and extraction time, and barf at build time in case of signature errors or bogus data. I'll probably add a lax mode that might dearmor the doubly armored files and emit warnings, but meh. I'll also be filing some lintian bugs. And sorry about this, I feel most of the blame is on me for dpkg-source, as I should *never* *ever* pass w/o exception on the “always validate everything, otherwise you are guaranteed to get bogus data”. :/ Thanks, Guillem
akonadi akonadi-calendar akonadi-calendar-tools akonadi-contacts akonadi-import-wizard akonadi-mime akonadi-notes akonadi-search akonadiconsole akregator analitza ark artikulate aspell-en attica-kf5 audiocd-kio autoconf-archive autorevision baloo-kf5 baloo-widgets blogilo bluedevil bluez-qt bomber bovo breeze breeze-gtk breeze-icons breeze-plymouth buildbot cantor cervisia cflow clazy corsix-th cups datamash dbuskit dmidecode dolphin dolphin-plugins dragon drkonqi dynare emms extra-cmake-modules ffcall ffmpegthumbs filelight fontypython frameworkintegration freetype gawk-doc gcompris-qt gdb gdbm geany global glpk gnome-chemistry-utils gnucobol gnupg1 gnupg2 gnustep-sqlclient gnutls28 gpa granatier grantlee-editor groff guile-lib gwenview htmldoc kaccounts-integration kaccounts-providers kactivities-kf5 kactivities-stats kactivitymanagerd kaddressbook kajongg kalarm kalarmcal kalgebra kalzium kamera kanagram kapidox kapman kapptemplate karchive kate katomic kbackup kblackbox kblocks kblog kbookmarks kbounce kbreakout kbruch kcachegrind kcalc kcalcore kcalutils kcharselect kcmutils kcodecs kcolorchooser kcompletion kconfig kconfigwidgets kcontacts kcoreaddons kcrash kcron kdav kdbusaddons kde-cli-tools kde-dev-scripts kde-dev-utils kde-gtk-config kde-spectacle kdebugsettings kdeclarative kdecoration kded kdeedu-data kdegraphics-mobipocket kdegraphics-thumbnailers kdelibs4support kdenetwork-filesharing kdenlive kdepim-addons kdepim-runtime kdeplasma-addons kdesdk-kioslaves kdesdk-thumbnailers kdesignerplugin kdesu kdewebkit kdf kdialog kdiamond kdnssd-kf5 keditbookmarks kemoticons kf5-kdepim-apps-libs kf5-messagelib kfilemetadata-kf5 kfind kfloppy kfourinline kgamma5 kgeography kget kglobalaccel kgoldrunner kgpg kguiaddons khangman khelpcenter kholidays khotkeys khtml ki18n kiconthemes kidentitymanagement kidletime kig kigo killbots kimageformats kimagemapeditor kimap kinfocenter kinit kio kio-extras kirigami2 kiriki kitemmodels kitemviews kiten kitinerary kjobwidgets kjs kjsembed kjumpingcube kldap kleopatra klettres klickety klines kmag kmahjongg kmail kmail-account-wizard kmailtransport kmbox kmediaplayer kmenuedit kmime kmines kmousetool kmplot knavalbattle knetwalk knewstuff knights knotes knotifications knotifyconfig kolf kollision kolourpaint kompare konqueror konquest konsole kontact kontactinterface korganizer kpackage kparts kpat kpeople kphotoalbum kpimtextedit kpkpass kplotting kpty kqtquickcharts krdc kreversi krfb kronometer kross kruler krunner kscreen kscreenlocker kservice kshisen ksirk ksmtp ksnakeduel kspaceduel ksquares ksshaskpass kstars ksudoku ksyntax-highlighting ksysguard ksystemlog kteatime ktexteditor ktextwidgets ktimer ktouch ktuberling kturtle kubrick kunitconversion kwallet-kf5 kwallet-pam kwalletmanager kwayland kwayland-integration kwidgetsaddons kwin kwindowsystem kwordquiz kwrited kxmlgui kxmlrpcclient latte-dock libassuan libdmx libgcrypt20 libgpg-error libinfinity libinput libkcddb libkcompactdisc libkdegames libkeduvocdocument libkf5calendarsupport libkf5eventviews libkf5grantleetheme libkf5gravatar libkf5incidenceeditor libkf5kdcraw libkf5kexiv2 libkf5kgeomap libkf5kipi libkf5kmahjongg libkf5ksieve libkf5libkdepim libkf5libkleo libkf5mailcommon libkf5mailimporter libkf5pimcommon libkf5sane libkgapi libkomparediff2 libkscreen libksysguard libmicrohttpd libmpdclient libnftnl libprelude libpreludedb libsigsegv libtasn1-6 libtool libu2f-server libunistring libx11 libxss lokalize lskat lyx mailutils marble mbox-importer memtool microcom milou minuet modemmanager-qt mongodb mpc mpd mutt-vc-query ncmpc nettle network-manager-l2tp networkmanager-qt octave okteta oxygen oxygen-icons5 p11-kit palapeli pam-u2f paperkey parley partitionmanager phonon phonon-backend-vlc picmi pim-data-exporter pim-sieve-editor plasma-browser-integration plasma-desktop plasma-discover plasma-framework plasma-integration plasma-nm plasma-pa plasma-sdk plasma-vault plasma-workspace plasma-workspace-wallpapers plymouth-kcm polkit-kde-agent-1 powerdevil poxml prelude-correlator prelude-lml prelude-lml-rules prelude-manager prewikka prison-kf5 purpose qqc2-desktop-style qtcurve quodlibet rancid ranger ratpoison recutils rhythmbox-plugin-alternative-toolbar rocs rolo schleuder screen sddm-kcm signon-kwallet-extension solid sonnet startpar step surfraw svgpart swapspace swayidle swaylock sweeper syndication systemsettings sysvinit threadweaver twm ucspi-unix ulogd2 umbrello user-manager wacomtablet wayland-protocols wikidiff2 xdg-desktop-portal-kde xorgproto xserver-xorg-input-evdev xserver-xorg-input-mouse xserver-xorg-input-synaptics xserver-xorg-video-amdgpu xserver-xorg-video-fbdev xserver-xorg-video-nouveau xserver-xorg-video-vmware xz-utils youtube-dl zile
akonadi akonadi-calendar akonadi-calendar-tools akonadi-contacts akonadi-import-wizard akonadi-mime akonadi-notes akonadi-search akonadiconsole akregator analitza ark artikulate attica-kf5 audiocd-kio autoconf-archive autorevision baloo-kf5 baloo-widgets blogilo bluedevil bluez-qt bomber bovo breeze breeze-gtk breeze-icons breeze-plymouth cantor cervisia cflow clazy datamash dolphin dolphin-plugins dragon drkonqi extra-cmake-modules ffcall ffmpegthumbs filelight frameworkintegration freetype gawk-doc gdbm granatier grantlee-editor groff gwenview kaccounts-integration kaccounts-providers kactivities-kf5 kactivities-stats kactivitymanagerd kaddressbook kajongg kalarm kalarmcal kalgebra kalzium kamera kanagram kapidox kapman kapptemplate karchive kate katomic kbackup kblackbox kblocks kblog kbookmarks kbounce kbreakout kbruch kcachegrind kcalc kcalcore kcalutils kcharselect kcmutils kcodecs kcolorchooser kcompletion kconfig kconfigwidgets kcontacts kcoreaddons kcrash kcron kdav kdbusaddons kde-cli-tools kde-dev-scripts kde-dev-utils kde-gtk-config kde-spectacle kdebugsettings kdeclarative kdecoration kded kdeedu-data kdegraphics-mobipocket kdegraphics-thumbnailers kdelibs4support kdenetwork-filesharing kdenlive kdepim-addons kdepim-runtime kdeplasma-addons kdesdk-kioslaves kdesdk-thumbnailers kdesignerplugin kdesu kdewebkit kdf kdialog kdiamond kdnssd-kf5 keditbookmarks kemoticons kf5-kdepim-apps-libs kf5-messagelib kfilemetadata-kf5 kfind kfloppy kfourinline kgamma5 kgeography kget kglobalaccel kgoldrunner kgpg kguiaddons khangman khelpcenter kholidays khotkeys khtml ki18n kiconthemes kidentitymanagement kidletime kig kigo killbots kimageformats kimagemapeditor kimap kinfocenter kinit kio kio-extras kirigami2 kiriki kitemmodels kitemviews kiten kitinerary kjobwidgets kjs kjsembed kjumpingcube kldap kleopatra klettres klickety klines kmag kmahjongg kmail kmail-account-wizard kmailtransport kmbox kmediaplayer kmenuedit kmime kmines kmousetool kmplot knavalbattle knetwalk knewstuff knights knotes knotifications knotifyconfig kolf kollision kolourpaint kompare konqueror konquest konsole kontact kontactinterface korganizer kpackage kparts kpat kpeople kphotoalbum kpimtextedit kpkpass kplotting kpty kqtquickcharts krdc kreversi krfb kronometer kross kruler krunner kscreen kscreenlocker kservice kshisen ksirk ksmtp ksnakeduel kspaceduel ksquares ksshaskpass kstars ksudoku ksyntax-highlighting ksysguard ksystemlog kteatime ktexteditor ktextwidgets ktimer ktouch ktuberling kturtle kubrick kunitconversion kwallet-kf5 kwallet-pam kwalletmanager kwayland kwayland-integration kwidgetsaddons kwin kwindowsystem kwordquiz kwrited kxmlgui kxmlrpcclient latte-dock libkcddb libkcompactdisc libkdegames libkeduvocdocument libkf5calendarsupport libkf5eventviews libkf5grantleetheme libkf5gravatar libkf5incidenceeditor libkf5kdcraw libkf5kexiv2 libkf5kgeomap libkf5kipi libkf5kmahjongg libkf5ksieve libkf5libkdepim libkf5libkleo libkf5mailcommon libkf5mailimporter libkf5pimcommon libkf5sane libkgapi libkomparediff2 libkscreen libksysguard libsigsegv libtasn1-6 libtool libunistring lokalize lskat mailutils marble mbox-importer milou minuet modemmanager-qt mongodb mutt-vc-query network-manager-l2tp networkmanager-qt okteta oxygen oxygen-icons5 palapeli parley partitionmanager phonon phonon-backend-vlc picmi pim-data-exporter pim-sieve-editor plasma-browser-integration plasma-desktop plasma-discover plasma-framework plasma-integration plasma-nm plasma-pa plasma-sdk plasma-vault plasma-workspace plasma-workspace-wallpapers plymouth-kcm polkit-kde-agent-1 powerdevil poxml prison-kf5 purpose qqc2-desktop-style qtcurve rhythmbox-plugin-alternative-toolbar rocs rolo sddm-kcm signon-kwallet-extension solid sonnet startpar step surfraw svgpart sweeper syndication systemsettings sysvinit threadweaver ucspi-unix umbrello user-manager wacomtablet xdg-desktop-portal-kde zile