Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Guillem Jover]

On Sun, 2023-01-15 at 11:30:25 +0100, Sven Joachim wrote:
> Am 15.01.2023 um 08:41 schrieb Helge Kreutzmann:
> > On Fri, Jan 13, 2023 at 10:14:24PM +0100, Sven Joachim wrote:
> >> Am 13.01.2023 um 21:50 schrieb Helge Kreutzmann:
> > Then this two things should be documented:
> >
> > 1. .asc files are always (automatically) included if the upstream
> >sources are included (either by default or by -sa)
> 
> As long as they are present, yes.

Hmm, will look how to try to clarify this.

> > 2. .asc files cannot be included on their own, but rather require the
> >corresponding upstream sources (which would make sense, indeed).
> >[1]
> 
> Yes, there does not seem to be an option to only include the .asc file,
> you need to edit the .changes file after the build as you did.

I started to add support for such option some time ago, but it seems I
didn't go further:

  
https://git.hadrons.org/git/debian/dpkg/dpkg.git/log/?h=pu/dpkg-genchanges-include-asc

Perhaps because then the semantics could be rather strange. Or maybe
focused the energy into better diagnostics both in dpkg and lintian. Or
maybe because it looked like adding instead a dpkg-modchanges would be
better. Cannot really recall why though. :)

I'll try to see whether I can come up with an option that is not too
confusing.

Thanks,
Guillem

Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Sven Joachim]

Hi Helge,

Am 15.01.2023 um 08:41 schrieb Helge Kreutzmann:

> On Fri, Jan 13, 2023 at 10:14:24PM +0100, Sven Joachim wrote:
>> Am 13.01.2023 um 21:50 schrieb Helge Kreutzmann:
>> > As you can see, "linuxinfo_4.1.2.orig.tar.xz.asc" is contained in the
>> > .dsc file, but not in the .changes file.
>>
>> This is the opposite of what you wrote in the original report (where the
>> .asc file was in the changes file and not in the .dsc), and is in fact
>> normal as you did not include the upstream sources (the default if
>> debian/changelog indicates that this is not the first debian revision).
>
> This was a mistake of mine, I probably failed to write it correctly. I
> apologize.

Thanks, now this makes sense.

>> > When I uploaded this (with -2) the archive rejected this.
>>
>> Yes, because your .dsc file referenced the .asc file, but the changes
>> file did not include it, nor was the file already in the archive.
>>
>> > I manually edited the .changes to add
>> > "linuxinfo_4.1.2.orig.tar.xz.asc", and this worked.
>>
>> I guess could also have passed "-sa" to dpkg-buildpackage to include the
>> full sources again, but whatever worked for you.
>
> So I understand, if I had included the full sources, then the .asc file
> would have been included as well?

Yes.

> And does this work? - I remember that
> in the past I was told that the sources are already in the archive,
> and hence cannot be uploaded again (but I might be wrong on this).

AFAIK you can include the upstream tarball again, as long as it is
identical to what is already in the archive - which is required anyway,
otherwise the hashsums in the .dsc would not match and the upload
rejected.

> Then this two things should be documented:
>
> 1. .asc files are always (automatically) included if the upstream
>sources are included (either by default or by -sa)

As long as they are present, yes.

> 2. .asc files cannot be included on their own, but rather require the
>corresponding upstream sources (which would make sense, indeed).
>[1]

Yes, there does not seem to be an option to only include the .asc file,
you need to edit the .changes file after the build as you did.

Cheers,
   Sven

Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Helge Kreutzmann]

Hello Ansgar,
On Sun, Jan 15, 2023 at 10:03:33AM +0100, Ansgar wrote:
> On Thu, 12 Jan 2023 11:29:53 +0100 Helge Kreutzmann wrote:
> > -- Package-specific info:
> > This system uses merged-usr-via-aliased-dirs, going behind dpkg's
> > back, breaking its core assumptions. This can cause silent file
> > overwrites and disappearances, and its general tools misbehavior.
> > See .
> > 
> > I did not do this on purpose. Strange that I'm told this by reportbug
> > and not some other means?
> 
> There was a project decision to adopt usrmerge so no other tool warns
> about it. dpkg's maintainer is unhappy with the project decision and
> included this warning which sadly unsettles users.

Thanks for the information.

Hopefully this can be resolved without (eventually) reinstalling.

Greetings

   Helge

-- 
  Dr. Helge Kreutzmann deb...@helgefjell.de
   Dipl.-Phys.   http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
   Help keep free software "libre": http://www.ffii.de/


signature.asc
Description: PGP signature

Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Ansgar]

Hi,

On Thu, 12 Jan 2023 11:29:53 +0100 Helge Kreutzmann wrote:
> -- Package-specific info:
> This system uses merged-usr-via-aliased-dirs, going behind dpkg's
> back, breaking its core assumptions. This can cause silent file
> overwrites and disappearances, and its general tools misbehavior.
> See .
> 
> I did not do this on purpose. Strange that I'm told this by reportbug
> and not some other means?

There was a project decision to adopt usrmerge so no other tool warns
about it. dpkg's maintainer is unhappy with the project decision and
included this warning which sadly unsettles users.

Ansgar

Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Helge Kreutzmann]

Hello Sven,
sorry for my slow answer.

On Fri, Jan 13, 2023 at 10:14:24PM +0100, Sven Joachim wrote:
> Am 13.01.2023 um 21:50 schrieb Helge Kreutzmann:
> > As you can see, "linuxinfo_4.1.2.orig.tar.xz.asc" is contained in the
> > .dsc file, but not in the .changes file.
> 
> This is the opposite of what you wrote in the original report (where the
> .asc file was in the changes file and not in the .dsc), and is in fact
> normal as you did not include the upstream sources (the default if
> debian/changelog indicates that this is not the first debian revision).

This was a mistake of mine, I probably failed to write it correctly. I
apologize.

> > When I uploaded this (with -2) the archive rejected this.
> 
> Yes, because your .dsc file referenced the .asc file, but the changes
> file did not include it, nor was the file already in the archive.
> 
> > I manually edited the .changes to add
> > "linuxinfo_4.1.2.orig.tar.xz.asc", and this worked.
> 
> I guess could also have passed "-sa" to dpkg-buildpackage to include the
> full sources again, but whatever worked for you.

So I understand, if I had included the full sources, then the .asc file
would have been included as well? And does this work? - I remember that
in the past I was told that the sources are already in the archive,
and hence cannot be uploaded again (but I might be wrong on this).

Then this two things should be documented:

1. .asc files are always (automatically) included if the upstream
   sources are included (either by default or by -sa)

2. .asc files cannot be included on their own, but rather require the
   corresponding upstream sources (which would make sense, indeed).
   [1]

Greetings

 Helge

  [1] If I'm right that the upstream source can only be uploaded once,
  then possibly a sentence that .asc files should only be included at
  Debian revision 1.
-- 
  Dr. Helge Kreutzmann deb...@helgefjell.de
   Dipl.-Phys.   http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
   Help keep free software "libre": http://www.ffii.de/


signature.asc
Description: PGP signature

Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Sven Joachim]

Am 13.01.2023 um 21:50 schrieb Helge Kreutzmann:

> Hello Sven,
> On Fri, Jan 13, 2023 at 09:36:47PM +0100, Sven Joachim wrote:
>> Am 13.01.2023 um 21:16 schrieb Helge Kreutzmann:
>> > Maybe we use the tools differently?
>> >
>> > Since we use source only uploads, I run:
>> > dpkg-buildpackage --changes-option=-S
>>
>> I was a bit lazier and ran "dpkg-buildpackage -S", not even bothering to
>> build binaries.  But it does not really matter, as ultimately every tool
>> eventually runs "dpkg-source -b ." to create the .dsc file.  Here is
>> what I got with your command:
>>
>> ,
>> | $ LANG=C dpkg-buildpackage -uc -us --changes-option=-S
>> | dpkg-buildpackage: info: source package linuxinfo
>> | dpkg-buildpackage: info: source version 4.1.2-3
>> | dpkg-buildpackage: info: source distribution unstable
>> | dpkg-buildpackage: info: source changed by Helge Kreutzmann 
>> 
>> |  dpkg-source --before-build .
>> | dpkg-buildpackage: info: host architecture amd64
>> |  debian/rules clean
>> | dh clean
>> |dh_clean
>> |  dpkg-source -b .
>> | dpkg-source: info: using source format '3.0 (quilt)'
>> | dpkg-source: info: verifying ./linuxinfo_4.1.2.orig.tar.xz.asc
>> | dpkg-source: info: building linuxinfo using existing 
>> ./linuxinfo_4.1.2.orig.tar.xz
>> | dpkg-source: info: building linuxinfo using existing 
>> ./linuxinfo_4.1.2.orig.tar.xz.asc
>> | dpkg-source: info: building linuxinfo in linuxinfo_4.1.2-3.debian.tar.xz
>> | dpkg-source: info: building linuxinfo in linuxinfo_4.1.2-3.dsc
>> | [...]
>> `
>>
>> As you can see, dpkg-source included the orig.tar.xz.asc file.
>>
>> > And I screwed up linuxinfo 4.1.2-1, thus I decided to also include the
>> > signature and tried to do 4.1.2-2 (which failed) and manually added it
>> > in 4.1.2-3 (which is now in the archive).
>> >
>> > For now, I noticed down to add the asc file manually, but I don't
>> > think this is a desirable solution.
>>
>> Can you please send a build log?
>
> Please find it attached.
>
> As you can see, "linuxinfo_4.1.2.orig.tar.xz.asc" is contained in the
> .dsc file, but not in the .changes file.

This is the opposite of what you wrote in the original report (where the
.asc file was in the changes file and not in the .dsc), and is in fact
normal as you did not include the upstream sources (the default if
debian/changelog indicates that this is not the first debian revision).

> When I uploaded this (with -2) the archive rejected this.

Yes, because your .dsc file referenced the .asc file, but the changes
file did not include it, nor was the file already in the archive.

> I manually edited the .changes to add
> "linuxinfo_4.1.2.orig.tar.xz.asc", and this worked.

I guess could also have passed "-sa" to dpkg-buildpackage to include the
full sources again, but whatever worked for you.

Still I am unable to reproduce your original problem.

Cheers,
   Sven

Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Helge Kreutzmann]

Hello Sven,
On Fri, Jan 13, 2023 at 09:36:47PM +0100, Sven Joachim wrote:
> Am 13.01.2023 um 21:16 schrieb Helge Kreutzmann:
> > On Fri, Jan 13, 2023 at 09:05:21PM +0100, Sven Joachim wrote:
> >> Am 12.01.2023 um 11:29 schrieb Helge Kreutzmann:
> >>
> >> > Package: dpkg-dev
> >> > Version: 1.21.17
> >> > Severity: normal
> >> >
> >> > I got a linitian error for my package (linuxinfo) that the upstream
> >> > signature is missing and should be put alongside the .orig.tar.xz
> >> > during the build.
> >> >
> >> > This worked, the signature was included in the .changes file. However,
> >> > it is not included in the .dsc file.
> >>
> >> I cannot reproduce this.  If I provide the upstream signature as
> >> linuxinfo_4.1.2.orig.tar.xz.asc, it ends up in both the .changes and the
> >> .dsc files.  The .changes file for linuxinfo 4.1.2-1 which you uploaded[1]
> >> does not contain it.
> >
> > Maybe we use the tools differently?
> >
> > Since we use source only uploads, I run:
> > dpkg-buildpackage --changes-option=-S
> 
> I was a bit lazier and ran "dpkg-buildpackage -S", not even bothering to
> build binaries.  But it does not really matter, as ultimately every tool
> eventually runs "dpkg-source -b ." to create the .dsc file.  Here is
> what I got with your command:
> 
> ,
> | $ LANG=C dpkg-buildpackage -uc -us --changes-option=-S
> | dpkg-buildpackage: info: source package linuxinfo
> | dpkg-buildpackage: info: source version 4.1.2-3
> | dpkg-buildpackage: info: source distribution unstable
> | dpkg-buildpackage: info: source changed by Helge Kreutzmann 
> 
> |  dpkg-source --before-build .
> | dpkg-buildpackage: info: host architecture amd64
> |  debian/rules clean
> | dh clean
> |dh_clean
> |  dpkg-source -b .
> | dpkg-source: info: using source format '3.0 (quilt)'
> | dpkg-source: info: verifying ./linuxinfo_4.1.2.orig.tar.xz.asc
> | dpkg-source: info: building linuxinfo using existing 
> ./linuxinfo_4.1.2.orig.tar.xz
> | dpkg-source: info: building linuxinfo using existing 
> ./linuxinfo_4.1.2.orig.tar.xz.asc
> | dpkg-source: info: building linuxinfo in linuxinfo_4.1.2-3.debian.tar.xz
> | dpkg-source: info: building linuxinfo in linuxinfo_4.1.2-3.dsc
> | [...]
> `
> 
> As you can see, dpkg-source included the orig.tar.xz.asc file.
> 
> > And I screwed up linuxinfo 4.1.2-1, thus I decided to also include the
> > signature and tried to do 4.1.2-2 (which failed) and manually added it
> > in 4.1.2-3 (which is now in the archive).
> >
> > For now, I noticed down to add the asc file manually, but I don't
> > think this is a desirable solution.
> 
> Can you please send a build log?

Please find it attached.

As you can see, "linuxinfo_4.1.2.orig.tar.xz.asc" is contained in the
.dsc file, but not in the .changes file.

When I uploaded this (with -2) the archive rejected this.

I manually edited the .changes to add
"linuxinfo_4.1.2.orig.tar.xz.asc", and this worked.

Greetings

   Helge

-- 
  Dr. Helge Kreutzmann deb...@helgefjell.de
   Dipl.-Phys.   http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
   Help keep free software "libre": http://www.ffii.de/
Script started on 2023-01-13 21:46:32+01:00 [TERM="linux" TTY="/dev/tty11" 
COLUMNS="240" LINES="75"]
[?2004hhelge@twentytwo:/tmp/libuild$ dpkg-buildpackage --changes-option=-S
cd
 linuxinfo-4.1.2-3/
[?2004l
[?2004hhelge@twentytwo:/tmp/libuild/linuxinfo-4.1.2-3$ dpkg-buildpackage 
--changes-option=-S
[?2004l
dpkg-buildpackage: Information: Quellpaket linuxinfo
dpkg-buildpackage: Information: Quellversion 4.1.2-3
dpkg-buildpackage: Information: Quelldistribution unstable
dpkg-buildpackage: Information: Quelle geändert durch Helge 
Kreutzmann 
dpkg-buildpackage: Information: Host-Architektur amd64
 dpkg-source --before-build .
 debian/rules clean
dh clean
   dh_clean
 dpkg-source -b .
dpkg-source: Information: Quellformat »3.0 (quilt)« wird 
verwendet
dpkg-source: Information: ./linuxinfo_4.1.2.orig.tar.xz.asc 
wird überprüft
dpkg-source: Information: linuxinfo wird unter Benutzung des 
existierenden ./linuxinfo_4.1.2.orig.tar.xz gebaut
dpkg-source: Information: linuxinfo wird unter Benutzung des 
existierenden ./linuxinfo_4.1.2.orig.tar.xz.asc gebaut
dpkg-source: Information: linuxinfo wird in 
linuxinfo_4.1.2-3.debian.tar.xz gebaut
dpkg-source: Information: linuxinfo wird in 
linuxinfo_4.1.2-3.dsc gebaut
 debian/rules binary
dh binary
   dh_update_autotools_config
   dh_autoreconf
Copying file m4/codeset.m4
Copying file m4/fcntl-o.m4
Copying file m4/glibc2.m4
Copying file m4/glibc21.m4
Copying file 

Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Sven Joachim]

Hello Helge,

Am 13.01.2023 um 21:16 schrieb Helge Kreutzmann:

> Hello Sven,
> On Fri, Jan 13, 2023 at 09:05:21PM +0100, Sven Joachim wrote:
>> Am 12.01.2023 um 11:29 schrieb Helge Kreutzmann:
>>
>> > Package: dpkg-dev
>> > Version: 1.21.17
>> > Severity: normal
>> >
>> > I got a linitian error for my package (linuxinfo) that the upstream
>> > signature is missing and should be put alongside the .orig.tar.xz
>> > during the build.
>> >
>> > This worked, the signature was included in the .changes file. However,
>> > it is not included in the .dsc file.
>>
>> I cannot reproduce this.  If I provide the upstream signature as
>> linuxinfo_4.1.2.orig.tar.xz.asc, it ends up in both the .changes and the
>> .dsc files.  The .changes file for linuxinfo 4.1.2-1 which you uploaded[1]
>> does not contain it.
>
> Maybe we use the tools differently?
>
> Since we use source only uploads, I run:
> dpkg-buildpackage --changes-option=-S

I was a bit lazier and ran "dpkg-buildpackage -S", not even bothering to
build binaries.  But it does not really matter, as ultimately every tool
eventually runs "dpkg-source -b ." to create the .dsc file.  Here is
what I got with your command:

,
| $ LANG=C dpkg-buildpackage -uc -us --changes-option=-S
| dpkg-buildpackage: info: source package linuxinfo
| dpkg-buildpackage: info: source version 4.1.2-3
| dpkg-buildpackage: info: source distribution unstable
| dpkg-buildpackage: info: source changed by Helge Kreutzmann 

|  dpkg-source --before-build .
| dpkg-buildpackage: info: host architecture amd64
|  debian/rules clean
| dh clean
|dh_clean
|  dpkg-source -b .
| dpkg-source: info: using source format '3.0 (quilt)'
| dpkg-source: info: verifying ./linuxinfo_4.1.2.orig.tar.xz.asc
| dpkg-source: info: building linuxinfo using existing 
./linuxinfo_4.1.2.orig.tar.xz
| dpkg-source: info: building linuxinfo using existing 
./linuxinfo_4.1.2.orig.tar.xz.asc
| dpkg-source: info: building linuxinfo in linuxinfo_4.1.2-3.debian.tar.xz
| dpkg-source: info: building linuxinfo in linuxinfo_4.1.2-3.dsc
| [...]
`

As you can see, dpkg-source included the orig.tar.xz.asc file.

> And I screwed up linuxinfo 4.1.2-1, thus I decided to also include the
> signature and tried to do 4.1.2-2 (which failed) and manually added it
> in 4.1.2-3 (which is now in the archive).
>
> For now, I noticed down to add the asc file manually, but I don't
> think this is a desirable solution.

Can you please send a build log?

Cheers,
   Sven

Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Helge Kreutzmann]

Hello Sven,
On Fri, Jan 13, 2023 at 09:05:21PM +0100, Sven Joachim wrote:
> Am 12.01.2023 um 11:29 schrieb Helge Kreutzmann:
> 
> > Package: dpkg-dev
> > Version: 1.21.17
> > Severity: normal
> >
> > I got a linitian error for my package (linuxinfo) that the upstream
> > signature is missing and should be put alongside the .orig.tar.xz
> > during the build.
> >
> > This worked, the signature was included in the .changes file. However,
> > it is not included in the .dsc file.
> 
> I cannot reproduce this.  If I provide the upstream signature as
> linuxinfo_4.1.2.orig.tar.xz.asc, it ends up in both the .changes and the
> .dsc files.  The .changes file for linuxinfo 4.1.2-1 which you uploaded[1]
> does not contain it.

Maybe we use the tools differently?

Since we use source only uploads, I run:
dpkg-buildpackage --changes-option=-S

And I screwed up linuxinfo 4.1.2-1, thus I decided to also include the
signature and tried to do 4.1.2-2 (which failed) and manually added it
in 4.1.2-3 (which is now in the archive).

> > No I need to inform dpkg-buildpackage how to add this, however, I
> > cannot find any option to do so.
> 
> Neither can I, but I do not really see the need for it.

For now, I noticed down to add the asc file manually, but I don't
think this is a desirable solution.

Greetings

 Helge
-- 
  Dr. Helge Kreutzmann deb...@helgefjell.de
   Dipl.-Phys.   http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
   Help keep free software "libre": http://www.ffii.de/


signature.asc
Description: PGP signature

Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Sven Joachim]

Hi Helge,

Am 12.01.2023 um 11:29 schrieb Helge Kreutzmann:

> Package: dpkg-dev
> Version: 1.21.17
> Severity: normal
>
> I got a linitian error for my package (linuxinfo) that the upstream
> signature is missing and should be put alongside the .orig.tar.xz
> during the build.
>
> This worked, the signature was included in the .changes file. However,
> it is not included in the .dsc file.

I cannot reproduce this.  If I provide the upstream signature as
linuxinfo_4.1.2.orig.tar.xz.asc, it ends up in both the .changes and the
.dsc files.  The .changes file for linuxinfo 4.1.2-1 which you uploaded[1]
does not contain it.

> No I need to inform dpkg-buildpackage how to add this, however, I
> cannot find any option to do so.

Neither can I, but I do not really see the need for it.

Cheers,
   Sven


1. 
https://tracker.debian.org/news/1407992/accepted-linuxinfo-412-1-source-into-unstable/

Bug#1028523: dpkg-dev: No obvious way to include upstream signature in dpkg-genchanges

[Helge Kreutzmann]

Package: dpkg-dev
Version: 1.21.17
Severity: normal

I got a linitian error for my package (linuxinfo) that the upstream
signature is missing and should be put alongside the .orig.tar.xz
during the build.

This worked, the signature was included in the .changes file. However,
it is not included in the .dsc file.

No I need to inform dpkg-buildpackage how to add this, however, I
cannot find any option to do so.

(As a hot fix I can add the signature manually to the .dsc file)

-- Package-specific info:
This system uses merged-usr-via-aliased-dirs, going behind dpkg's
back, breaking its core assumptions. This can cause silent file
overwrites and disappearances, and its general tools misbehavior.
See .

I did not do this on purpose. Strange that I'm told this by reportbug
and not some other means?

Hopefully this can be fixed easily :-((

-- System Information:
Debian Release: bookworm/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) (ignored: LC_ALL 
set to de_DE.UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages dpkg-dev depends on:
ii  binutils  2.39.90.20221231-1
ii  bzip2 1.0.8-5+b1
ii  libdpkg-perl  1.21.17
ii  make  4.3-4.1
ii  patch 2.7.6-7
ii  perl  5.36.0-6
ii  tar   1.34+dfsg-1
ii  xz-utils  5.4.0-0.1

Versions of packages dpkg-dev recommends:
ii  build-essential  12.9
ii  fakeroot 1.29-1
ii  gcc [c-compiler] 4:12.2.0-2+b1
ii  gcc-10 [c-compiler]  10.4.0-6
ii  gcc-11 [c-compiler]  11.3.0-8
ii  gcc-12 [c-compiler]  12.2.0-13
ii  gnupg2.2.40-1
ii  gpgv 2.2.40-1
ii  libalgorithm-merge-perl  0.08-5

Versions of packages dpkg-dev suggests:
ii  debian-keyring  2022.12.24

-- no debconf information

-- 
  Dr. Helge Kreutzmann deb...@helgefjell.de
   Dipl.-Phys.   http://www.helgefjell.de/debian.php
64bit GNU powered gpg signed mail preferred
   Help keep free software "libre": http://www.ffii.de/


signature.asc
Description: PGP signature