Dear Maintainer,
within the Mobian project, we would like to provide a 'modernized' mobian.sources to avoid users harming themselves
by running 'apt modernize-sources' command that doesn't know about the key file, hence users would jump from apt
showing a "please modernize your sources" hint to apt showing an "Untrusted repository" error [1].

Yet, lintian flags an
|E: mobian-archive-keyring: package-installs-apt-sources
[etc/apt/sources.list.d/mobian.sources]|
error [2] on this change. This is confusing, because Debian wiki [3] states
Certificate updates SHOULD be distributed by a Debian package calledderiv-archive-keyring. This package [...] MAY also include the/etc/apt/sources.list.d/deriv.sources [...].
Below this sentence, an example including/etc/apt/sources.list.d/deriv.sources is shown.

AFAICT, the wiki allows the case of apt sources being delivered through a package, while lintian treats this as an error.
Are we missing something? Or shall that lintian flag be downgraded/removed?
Kind regards
Marco


[1]https://salsa.debian.org/Mobian-team/mobian-keyring/-/merge_requests/2
[2]https://salsa.debian.org/Mobian-team/mobian-keyring/-/jobs/7093991#L40
[3]https://wiki.debian.org/DebianRepository/UseThirdParty#Certificate_rollover_and_updates

I concur with the bug submitter.

package-installs-apt-sources is currently marked at severity Error. Without a lintian-explain-tags reference to a specific Debian Policy item, this is an incorrect severity. Either provide the reference to Debian Policy or downgrade it to severity Pedantic.

Thanks!
Martin-Éric