Public bug reported: [FFE]
Unfortunately, the source tarball ceph_20.2.4+ds.orig.tar.xz contains an incorrect directory layout, and I really don't want it to be in stonking's release pocket. I know its late, and ceph is seeded, but please consider accepting to stonking. [Impact] For the 20.2.4+ds-0ubuntu1 upload, ceph_20.2.4+ds.orig.tar.xz was packed incorrectly. The source tarball used does not contain a prefix directory of ceph-20.2.4/ and instead, directly goes to the source files. This does not match the upstream tarball, and running pkgdiff shows 100% CHANGED, which is a real problem when it comes to verifying the contents of the tarball, mostly for SRU review and general trustworthiness. [Test Plan] Download the pristine upstream tarball. $ wget https://download.ceph.com/tarballs/ceph-20.2.4.tar.gz $ openssl sha256 ceph-20.2.4.tar.gz SHA2-256(ceph-20.2.4.tar.gz)= 5f34569241a2890446b931f06cd844f93bca665f740a20631429d2d55b1e9b37 In the debian directory, begin a repack: $ uscan --watchfile=debian/watch --download-version=20.2.4 Newest version of ceph on remote site is 20.2.4, specified download version is 20.2.4 Successfully repacked ../ceph-20.2.4.tar.gz as ../ceph_20.2.4+ds.orig.tar.xz, deleting 520 files from it. With 20.2.4+ds1-0ubuntu1, noting the additional CHM file added to d/copyright, the repack should have sha256: $ mv ceph_20.2.4+ds.orig.tar.xz ceph_20.2.4+ds1.orig.tar.xz $ openssl sha256 ceph_20.2.4+ds1.orig.tar.xz SHA2-256(ceph_20.2.4+ds1.orig.tar.xz)= 6ff42554c117759db00619d05e6c67355f229ed3bcb783044972efcd7cc14779 Note, this sha256 is deterministic and should be reproducible. You can verify that the repack happened correctly with: $ sudo apt install pkgdiff $ pkgdiff ceph-20.2.4.tar.gz ceph_20.2.4+ds1.orig.tar.xz The generated diff HTML file can be viewed in firefox, and there should be: - No files added. - Only files removed, notably debian, src/test/ubuntu-*, and others. - No files changed. [Where problems can occur] The directory structure might be incorrect again, or the package fails to build. ** Affects: ceph (Ubuntu) Importance: Undecided Status: In Progress ** Changed in: ceph (Ubuntu) Status: New => In Progress -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2169774 Title: [FFE] ceph_20.2.4+ds.orig.tar.xz is repacked incorrectly To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/2169774/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
