Hi,

> all the additions found in the tarball are generated automatically I
> assume. Why can't they be simply added to the Git repo while creating
> the tag in a classic "Releasing version foo" commit? (A common pattern

Isn't the obvious solution to use dual git+tarball imports?

That way you have the upstream tag in your Debian packaging
repository, and from the tag contents are imported to upstream/latest
branch. Note that branch does not represent the upstream git contents,
but the Debian import contents. If the Debian package is commit and
tree same with what upstream release git tag, that branch will have no
extra changes. However, is there are any special stuff going on in the
tarball due to upstream practices, that will show up in the import
commit, or if Debian has extra things going on (such as applying
copyright:Files-Excluded removals) they too will show up in that
commit, and from upstream/latest things are merged on the
debian/latest branch.

Also all tooling that do exports will do the correct export using the
contents from upstream/latest branch at the Debian import tag (+apply
pristine-tar if the git repo uses it).

Git-buildpackage has supported dual git+tarball imports for many
years, and a lot of maintainers and packages are using them. The whole
structure has been in DEP-14 as well for many years.

You can read a longer explanation of how to read upstream git commits,
the tarball import commit and Debian commits in one single git repo in
one single sessions with the same git log / diff / difftool commands
in 
https://optimizedbyotto.com/post/xz-backdoor-debian-git-detection/#comparing-upstream-source-packages-to-git-contents

Reply via email to