While reviewing libcap2 I noticed that the upstream signatures are missing from Also imports fail: ± gbp import-orig --uscan --upstream-version=2.73 gbp:info: Launching uscan... gpgv: Signature made su 1. joulukuuta 2024 20.24.50 PST gpgv: using RSA key 38A644698C69787344E954CE29EE848AE2CCF3F4 gpgv: Good signature from "Andrew G. Morgan <morgan@kernel.org>" gpgv: aka "Andrew G. Morgan (Work Address) <agm@google.com>" gbp:info: Using uscan downloaded tarball ../libcap2_2.73.orig.tar.xz gbp:info: Importing '../libcap2_2.73.orig.tar.xz' to branch 'upstream/latest'... gbp:info: Source package is libcap2 gbp:info: Upstream version is 2.73 gbp:error: ../libcap2_2.73.orig.tar.xz does not have a signature file gbp:error: Error detected, Will roll back changes. gbp:info: Rolling back branch upstream/latest by resetting it to 094e2409f51e489fe8097bd14ff1d327499ae8c4 gbp:info: Rolling back branch pristine-tar by resetting it to ed5dcdd323c161917e5cab7be92f85196bdb6e55 ± git checkout pristine+tar ± ls -1 ... libcap2_2.63.orig.tar.xz.id libcap2_2.66.orig.tar.xz.delta libcap2_2.66.orig.tar.xz.id libcap2_2.73.orig.tar.xz.delta libcap2_2.73.orig.tar.xz.id I noticed this while preparing a MR for the package to modify the gbp.conf to make it more clear of what workflow/practices this package works. I can finalize that if you give some guidance here on why the signatures are missing and what command you have used to do the upstream imports.
Hi Otto, They're missing because I never noticed that they are not automatically added to the pristine-tar branch... This is odd. A `uscan --download-current-version` correctly retrieves and verifies the signature: And the default for gbp's --upstream-signatures is 'auto', so I would have assumed that nothing else needs to be done: $ uscan --download-current-version Newest version of libcap2 on remote site is 2.73, specified download version is 2.73 gpgv: Signature made Mo 02 Dez 2024 05:24:50 CET gpgv: using RSA key 38A644698C69787344E954CE29EE848AE2CCF3F4 gpgv: Good signature from "Andrew G. Morgan <morgan@kernel.org>" gpgv: aka "Andrew G. Morgan (Work Address) <agm@google.com>" Successfully symlinked ../libcap-2.73.tar.xz to ../libcap2_2.73.orig.tar.xz. 2.74-rc4 is out, I assume a 2.74 release will appear soon-ish, so this should be fixed in that version. Best, Christian
Control: reassign -1 git-buildpackage Control: retitle -1 git-buildpackage: doesn't support signatures against uncompressed tarballs Control: found -1 0.9.30 Control: tag -1 + patch This is because libcap2's signature is for the uncompressed tarball, instead of the (more typical) compressed tarball. uscan supports this use case with the 'decompress' option, but it seems that git-buildpackage isn't aware of this use case yet. I've filed an MR that fixes this: https://salsa.debian.org/agx/git-buildpackage/-/merge_requests/43 Best, Christian
Control: reassign -1 git-buildpackage Control: retitle -1 git-buildpackage: doesn't support signatures against uncompressed tarballs Control: found -1 0.9.30 Control: tag -1 + patch This is because libcap2's signature is for the uncompressed tarball, instead of the (more typical) compressed tarball. uscan supports this use case with the 'decompress' option, but it seems that git-buildpackage isn't aware of this use case yet. I've filed an MR that fixes this: https://salsa.debian.org/agx/git-buildpackage/-/merge_requests/43 Best, Christian