#1101484 popularity-contest: Cannot build from VCS

#1101484#5
Date:
2025-03-28 09:02:46 UTC
From:
To:
Hi!

Was checking the git repo, and noticed that the package cannot be
built from a git checkout, as it is at least missing the
debian-popcon.gpg file.

Thanks,
Guillem

#1101484#10
Date:
2025-03-28 09:30:59 UTC
From:
To:
Hi Guillem,

This is intended. You can get this file from the Debian source package.
This way, there is only one official source.

Cheers,

#1101484#15
Date:
2025-03-28 12:01:47 UTC
From:
To:
* Bill Allombert <ballombe@debian.org> [250328 10:33]:

If you intend for this to be the case, please drop the Vcs-* headers
from the package in the archive.
This avoids confusion and wasting contributors time.

Thanks,
Chris

#1101484#20
Date:
2025-03-28 12:23:19 UTC
From:
To:
Hi!

Hmm, I'm not sure I really understand this rationale, of making the
git repo unbuildable to mark it as non-official.

When I noticed the missing file, I didn't expect the git repo to contain
all the files (such as I would not expect to find auto-generated autotools
artifacts or similar), but at least I was expecting a way to fetch that
from its canonical location, or to generate it or similar (I looked
for example for a make rule to do that).

After not finding anything, I was rather confused and wondered whether
the file had simply been omitted from «git add» or similar, as at that
point I'd expect to find its history and how it has changed over time
to be important for the git repo (given that changes to it are also
listed in the changelog).

If you still think omitting that file makes sense, then i think what
Chris suggests would be better. And with that I'd have defaulted to
«apt source» the source package and provide a patch based on that.

Thanks,
Guillem

#1101484#25
Date:
2025-03-28 19:16:32 UTC
From:
To:
Sorry, I did not explain correctly. I meant
'there is only one official source _for debian-popcon.gpg_'.

While debian-popcon.gpg is a public key, the question rests whether this is a
public key corresponding to one of the popcon server private keys. There is no
way for the git repository to ascertain that. Without an account on the popcon
server, the only way is to obtain the official popularity-contest package
(whether source or binary) provided by the Debian archive, check the chain of
signature and checksums, and use the debian-popcon.gpg file therein.

Cheers,
Bill.