#1098390 libcap2: upstream signatures missing / can't be verified

Package:
libcap2
Source:
libcap2
Description:
POSIX 1003.1e capabilities (library)
Submitter:
Otto Kekäläinen
Date:
2025-03-07 09:21:05 UTC
Severity:
normal
Tags:
#1098390#5
Date:
2025-02-19 23:07:53 UTC
From:
To:
While reviewing libcap2 I noticed that the upstream signatures are missing from

Also imports fail:

± gbp import-orig --uscan --upstream-version=2.73
gbp:info: Launching uscan...
gpgv: Signature made su  1. joulukuuta 2024 20.24.50 PST
gpgv:                using RSA key 38A644698C69787344E954CE29EE848AE2CCF3F4
gpgv: Good signature from "Andrew G. Morgan <morgan@kernel.org>"
gpgv:                 aka "Andrew G. Morgan (Work Address) <agm@google.com>"
gbp:info: Using uscan downloaded tarball ../libcap2_2.73.orig.tar.xz
gbp:info: Importing '../libcap2_2.73.orig.tar.xz' to branch 'upstream/latest'...
gbp:info: Source package is libcap2
gbp:info: Upstream version is 2.73
gbp:error: ../libcap2_2.73.orig.tar.xz does not have a signature file
gbp:error: Error detected, Will roll back changes.
gbp:info: Rolling back branch upstream/latest by resetting it to
094e2409f51e489fe8097bd14ff1d327499ae8c4
gbp:info: Rolling back branch pristine-tar by resetting it to
ed5dcdd323c161917e5cab7be92f85196bdb6e55

± git checkout pristine+tar
± ls -1
...
libcap2_2.63.orig.tar.xz.id
libcap2_2.66.orig.tar.xz.delta
libcap2_2.66.orig.tar.xz.id
libcap2_2.73.orig.tar.xz.delta
libcap2_2.73.orig.tar.xz.id

I noticed this while preparing a MR for the package to modify the
gbp.conf to make it more clear of what workflow/practices this package
works. I can finalize that if you give some guidance here on why the
signatures are missing and what command you have used to do the
upstream imports.

#1098390#10
Date:
2025-02-20 07:12:26 UTC
From:
To:
Hi Otto,

They're missing because I never noticed that they are not automatically
added to the pristine-tar branch...

This is odd. A `uscan --download-current-version` correctly retrieves
and verifies the signature:

And the default for gbp's --upstream-signatures is 'auto', so I would
have assumed that nothing else needs to be done:

$ uscan --download-current-version
Newest version of libcap2 on remote site is 2.73, specified download version is 2.73
gpgv: Signature made Mo 02 Dez 2024 05:24:50 CET
gpgv:                using RSA key 38A644698C69787344E954CE29EE848AE2CCF3F4
gpgv: Good signature from "Andrew G. Morgan <morgan@kernel.org>"
gpgv:                 aka "Andrew G. Morgan (Work Address) <agm@google.com>"
Successfully symlinked ../libcap-2.73.tar.xz to ../libcap2_2.73.orig.tar.xz.

2.74-rc4 is out, I assume a 2.74 release will appear soon-ish, so this
should be fixed in that version.

Best,
Christian

#1098390#15
Date:
2025-03-07 09:17:41 UTC
From:
To:
Control: reassign -1 git-buildpackage
Control: retitle -1 git-buildpackage: doesn't support signatures against uncompressed tarballs
Control: found -1 0.9.30
Control: tag -1 + patch

This is because libcap2's signature is for the uncompressed tarball,
instead of the (more typical) compressed tarball.

uscan supports this use case with the 'decompress' option, but it seems
that git-buildpackage isn't aware of this use case yet.

I've filed an MR that fixes this:

https://salsa.debian.org/agx/git-buildpackage/-/merge_requests/43

Best,
Christian

#1098390#28
Date:
2025-03-07 09:17:41 UTC
From:
To:
Control: reassign -1 git-buildpackage
Control: retitle -1 git-buildpackage: doesn't support signatures against uncompressed tarballs
Control: found -1 0.9.30
Control: tag -1 + patch

This is because libcap2's signature is for the uncompressed tarball,
instead of the (more typical) compressed tarball.

uscan supports this use case with the 'decompress' option, but it seems
that git-buildpackage isn't aware of this use case yet.

I've filed an MR that fixes this:

https://salsa.debian.org/agx/git-buildpackage/-/merge_requests/43

Best,
Christian