In my first attempt to use tag2upload I was very confused because it
kept trying to push an old tag on the debian/unstable branch instead of
the one on the debian/experimental branch that I was working on.
Even after adding --branch=debian/experimental:

$ git debpush --dry-run --print-tag-text --upstream=varnish-7.7.1 --branch=debian/experimental --quilt=gbp
varnish release 7.7.0-3 for unstable

[dgit distro=debian split --quilt=gbp]
[dgit please-upload source=varnish version=7.7.0-3 upstream-tag=varnish-7.7.1 upstream=2e8180f788715e5bc44df08479d60c9435d79bdd]

After a lot of wasted time and attempts, I figured out that I had forgot
to commit the new changelog (I like to have a clean history and commit
a single complete changelog along with the release tag).

Maybe debpush could check that:
- the tag version matches the changelog version
- the tag is actually on the active branch (or the one selected with
  --branch)

Hi.  Thanks for the report.  We want this tooling to be easy to use,
and to help spot mistakes, so we appreciate the feedback.

FTR Sean is the UX lead for git-debpush but I have some thoughts:

Marco d'Itri writes ("Bug#1108088: should check that the changelog version matches the tag version"):

I'm not sure I completely understand the situation.

I think you are saying that:

 * You had intended to upload to experimental, from a local git branch
   called debian/experimental.
 * Your practice is to create the whole d/changelog entry for an
   upload immediately before upload.  So prior to that point,
   the changelog is the same as for the previous upload.
 * You had not (yet) done that for this upload, due to an oversight.
 * Your git tree was clean.
 * Your current branch was debian/unstable, which contained some
   other work which is not germane.  This was also an oversight.

Then you ran git-debpush --print-tag-text and got some kind of error
or unexpected behaviour.  You write "trying to push an old tag", but
maybe you mean "trying to re-upload an old release"?  git-debpush
won't ever push non-tag2upload tags.

To try to resolve the problem you ran git-debpush with an additional
option --branch=debian/experimental.  This also produced different
output which was in some way unexpected.  Perhaps the discrepancy is
that its upstream version tag name and the Debian version don't match?

(A shell transcript would have been very helpful.)

Did you have the debian/7.7.0-3 tag in your tree?  I think git-debpush
should complain if it finds an existing DEP-14 tag for the version it
is trying to upload.  (Ideally it would look both in your local tree,
and on salsa via the initial fetch proposed in #1107921.)

So if one forgets to update the changelog, or tries for any other
reason to repeat an existing upload, that would be detected.

I'm not sure what you mean by "the tag version".  Do you mean the
upstream tag you specified on the command line?

If so I think that might involve git-debpush trying to parse the
supplied upstream tag name to try to guess if it looks "enough like"
the upstream part of the version being uploaded.  This seems fraught
with difficulty.

I think git-debpush could check that the commit you are trying to
upload is fast forward from the nominated upstream (except with
--quilt=baredebian).  Maybe it already does check this.  But I think
that wouldn't have helped here.

What did you expect --branch to do ?

AIUI it's intended use case is precisely to upload from a branch you
don't currently have checked out.  I think this is a minority
interest.  Maybe it should have a less attractive name.

Ian.

No, the current branch was debian/experimental.
debian/unstable was fine, it just contains releases which have already
been uploaded.

I was at f34d2997e77afc729b162041c0c511e5c5b41594 of
https://salsa.debian.org/varnish-team/varnish/ .
Yes.

In other words, adding --branch=debian/experimental had not effect and
debpush was still proposing to create a tag on debian/unstable:

md:.../varnish debian/experimental(+27/-0)± git debpush --dry-run --print-tag-text --upstream=varnish-7.7.1 --quilt=gbp
varnish release 7.7.0-3 for unstable

[dgit distro=debian split --quilt=gbp]
[dgit please-upload source=varnish version=7.7.0-3 upstream-tag=varnish-7.7.1 upstream=2e8180f788715e5bc44df08479d60c9435d79bdd]
md:.../varnish debian/experimental(+27/-0) 1± git debpush --dry-run --print-tag-text --upstream=varnish-7.7.1 --branch=debian/experimental --quilt=gbp
varnish release 7.7.0-3 for unstable

[dgit distro=debian split --quilt=gbp]
[dgit please-upload source=varnish version=7.7.0-3 upstream-tag=varnish-7.7.1 upstream=2e8180f788715e5bc44df08479d60c9435d79bdd]
md:.../varnish debian/experimental(+27/-0)±
Yes, it was and still is in the debian/unstable branch (and on salsa).
No, I meant to check that the tags that it creates and is trying to push
matches the current version of the changelog. But my problem was that
the changelog version on disk was different from the one in the
repository (because I forgot to commit the changes), so probably there
is nothing that debpush can/should do about this.
OTOH I do not understand why it just did not fail since debian/7.7.0-3
already existed. Maybe --dry-run skips this check.
debian/experimental too and it matched the last changelog entry in the
repository.

In the end I am not sure anymore that there is much actionable here,
except figuring out why --dry-run did not detect the existing tag.

Marco d'Itri writes ("Bug#1108088: should check that the changelog version matches the tag version"):

Right.  git-debpush looks at debian/changelog to decide what to do.

So your git tree was dirty?  You had edited d/changelog but not
committed?  I'm surprised that git-debpush didn't object to this
situation...

... but it turns out it doesn't check for this.  And it does its work
in a little private tree where it sees only committed git objects, so
it carried on in blissful ignorance.

Gosh.  Well, we will fix that.  Thanks for the report!

I think there are several things about your situation nwhere
git-debpush could have done better:

1. It ought to complain if your git tree is dirty.  That nearly always
means you forgot to commit.  In this case that meant it used the
version of d/changelog in HEAD rather than the one in your working
tree, which is definitely wrong.

(This bug, #1108088.)

2. I think maybe --branch ought to be called --other-branch or
--upload-other-branch or --look-only-at-other-branch or
--other-git-branch or something.  Just --branch is too attractive a
name.

A user who is confused may use it in an effort to correct an apparent
misbehaviour, but in such a situation it's likely to make things worse
rather than better.  (In your case it did nothing.)  Some gbp tools
have --branch options which are much less exciting.

Another awkwardness with --branch is that some people might think it
referred to the target Debian release.  (Eg when the BTS says "from
other branch bugs".)  We call that a "suite".  This option is about
the local branch to use as input, not where the output ends up.

Let's see what Sean thinks about this.  (Bug clone -2, bug# TBD.)

3. git-debpush ought to avoid re-making an existing DEP-14 tag.
This is covered by #1107921, especially
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1107921

I'll write more there.

Ian.

We believe that the bug you reported is fixed in the latest version of
dgit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1108088@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ian Jackson <ijackson@chiark.greenend.org.uk> (supplier of updated dgit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 14 Jul 2025 09:45:16 +0100
Source: dgit
Architecture: source
Version: 13.5
Distribution: experimental
Urgency: medium
Maintainer: Debian tag2upload Delegates <dgit-owner@debian.org>
Changed-By: Ian Jackson <ijackson@chiark.greenend.org.uk>
Closes: 1107151 1108088 1108242 1108613
Changes:
 dgit (13.5) experimental; urgency=medium
 .
   git-debpush user experience improvements:
   * Check for tag already existing at the remote.  Part of #1107921.
   * Improve error message for tag already existing locally.
   * Check for uncommitted changes in working tree.
     Closes: #1108088.  [Sean Whitton]
 .
   tag2upload service:
   * Properly RFC2047-escape non-ASCII names.  Closes: #1108613.
   * Hide virt runes in a per-invocation ssh wrapper  Closes: #1107151.
   * Print oracle and builder dgit versions in transcript.  Closes: #1108242.
   * d-r-s t2u: Add missing -oBatchMode=yes option to ssh invocation.
 .
   CI and administrivia:
   * CI: Check for missing Signed-off-by.
   * git-debpush: Add missing copyright notice.  [Sean Whitton]
   * Add missing Closes for #1108180 to changelog entry for 12.125.
   * CI: Drop compatibility tests for buster, which is gone from the archive.
 .
   Suppporting changes:
   * git-debpush: Figure out the previous maintainer upload version.
   * dgit: Honour DGIT_VERSION in dgit --version and use it in ./using-these.
   * git-debpush: Reorganisation and tidying.  [Ian Jackson and Sean Whitton]
Checksums-Sha1:
 1dc92374f80db9fabb9a543c12b7b034b17e6ce1 2616 dgit_13.5.dsc
 8c7d014bfa008e820baa7c547377a4f86f776505 766005 dgit_13.5.tar.gz
 a690295dc4c1a9f9b3ecb266c6ef4cc0e0d8e459 963780 dgit_13.5.git.tar.xz
 5c7c48076d6574a2980f12a07f02badf47427098 18012 dgit_13.5_source.buildinfo
Checksums-Sha256:
 b298039d52177bb042df540f6d7f576c34ba54fce40c8e920eec9a288bd1e0f2 2616 dgit_13.5.dsc
 e405d353965df99cf677c6c0387e7cdc553d106e11b950c8744ec413d27ad586 766005 dgit_13.5.tar.gz
 afd63277856323318d2729da1146b77b09e2bc947b98b4579a8970b61a683cd8 963780 dgit_13.5.git.tar.xz
 bce4276cd07d592ca8e905402d712b6efb885d1dcb5d6a8ae91feb4e5b624c44 18012 dgit_13.5_source.buildinfo
Files:
 91eb0846e74f8fd7d519c341104a4113 2616 devel optional dgit_13.5.dsc
 188f9cf4305ca59baca2e84f0d45f79c 766005 devel optional dgit_13.5.tar.gz
 923c809a7cad5cdb21b60f0db0aa1f4e 963780 devel optional dgit_13.5.git.tar.xz
 56f5531fec3eebe35c6a8d615616e14c 18012 devel optional dgit_13.5_source.buildinfo
Git-Tag-Info: tag=b2701f0b29a8349c102a0ead5c460e13f1162cc0 fp=559ae46c2d6b6d3265e7cba1e3e3392348b50d39
Git-Tag-Tagger: Ian Jackson <ijackson@chiark.greenend.org.uk>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmh0z78ACgkQYG0ITkaD
wHnljQ//fZ2FVPhgCb+Zw39SbMvC03X+a1eOrSHQUdiIIRWZ4o1wbxekYtPebTjM
kpuYAgyeZzcf3UCfBcR1Apre5Ar446Jl0R4e3saRRZE+yyjM02z2nHxBnsnIrRXD
jYcV09XaBkyjs9efGZnwUJcxs7XFF3iKIOEb3cT5UWIMbDyUUuM7Nn+hMneGmWuP
Mei4CgBrhL4n2rnFIcNRNeMkn8tA5dkec+MWPpq3IO+xgozWm4leiWtDTi2JVl3K
mw0nDGE+y818T8o5rPZ9OiNDK2E2NvTCr2EcMdvCAvPdDxb64wPAKXwD0kem33v+
lo6ZRbz23AjV9kkLFdZGykIYJxGspuXQoy/Q6PBVOZ9gGj1znjd3KWgSVaZWohFH
uaEoULv4XWEgKJ++QZA7BZQu2v4OmQEny+OLJVK4kTrAjPwP7x/fX8za29laHFBy
N60dMbKUAqFC9cNfumbxviFQaPOe07krg9gEfiLyCC6OYtnN1zBU8Mgmac7tlE/a
9WcvpKmTFAE+EV485C/hvY0hHMBZmnPWW/R1IGONF+GHei4VL0W74aJDTs1vD1ns
IbYaF/ELnZEvY4UQn3pjSjifgO+n8eK4JO6lBR4T83EV9CcaI6pPR0PHWAClLMAD
HrkJ/o/RFd7+kjSg5dbTvATFl5dXUH8iB3xetGkVq1M+TCH3f7k=
=psbi
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
dgit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1108088@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ian Jackson <ijackson@chiark.greenend.org.uk> (supplier of updated dgit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 10 Aug 2025 20:18:45 +0100
Source: dgit
Architecture: source
Version: 13.11
Distribution: unstable
Urgency: medium
Maintainer: Debian tag2upload Delegates <dgit-owner@debian.org>
Changed-By: Ian Jackson <ijackson@chiark.greenend.org.uk>
Closes: 1107151 1107921 1108088 1108242 1108378 1108613 1108658 1109130 1109473 1110339 1110402
Changes:
 dgit (13.11) unstable; urgency=medium
 .
   * No change upload, targeting mainline to unstable.
 .
 dgit (13.11+exp1) experimental; urgency=medium
 .
   git-debpush UX improvements:
   * Always print a message before fetching from salsa.
     Closes: #1110402.  [Sean Whitton]
   * Detect debian/source/local-options, as a failed check.
     This avoids later failures.  Closes: #1110339.  [Sean Whitton]
   * Detect redundant --quilt mode option, as a failed check.
     Helps useers avoid dangerous habits.  Closes: #1108378.  [Sean Whitton]
   * Detect possible intent to use pristine-tar even if pristine-tar
     is not installed.  [Andrea Pappacoda]
 .
   tag2upload service:
   * If origs cannot be obtained from the archive (eg due to mirror delays),
     try to regenerate them.  Closes: #1109130.  (Deployment TBC.)
 .
   Documentation:
   * Workflow manpages: Replace bookworm with trixie.  [Sean Whitton]
   * Workflow manpages: Suggest sbuild -d, not sbuild -c.  [Sean Whitton]
   * tag2upload(5): Specify ! for service-critical extensions.
 .
   Minor bugfixes:
   * git-debpush: Avoid ignoring a failure of git-cat-file.  [Sean Whitton]
   * Add missing newline to overridden --force fail message.
 .
   dgit download-unfetched-origs subcommand (changes to support tag2upload):
   * Look in the source tree's current suite, specifically.
   * New --write-sha256sums subcommand option.
   * Don't download files already present in the build-products-dir.
   * Save downloaded files to .tmp names until file checksums verified.
   * Report unobtainable origs with special exit status 3.
 .
   Supporting and internal changes:
   * Cleanups and defensiveness in tag2upload-oracled.  [Sean Whitton]
   * Code cleanups, and refactoring, in git-debpush.  [Sean Whitton]
   * Much logic moved from tag2upload-obtain-origs into dgit.
 .
   Tests:
   * Refactoring and additions for testing the new functionality.
   * restore checking of error messages in tag2upload emails.
   * t2u-integration: Include the event_name field in webhook.
     (Compatibility with tag2upload-service-manager changes.)
 .
 dgit (13.10) experimental; urgency=medium
 .
   git-debpush user experience improvements:
   * Print some status messages while processing.
   * Better error messages when git-deborig tag search fails.
   * New --help, -h options.  Closes: #1109473.
 .
   tag2upload infrastructure:
   * Switch to using new tag2upload-obtain-origs script.
     Closes: #1108658.  [Ian Jackson]
   * tag2upload Manager protocol: Introduce some protocol state names.
     [Ian Jackson]
   * tag2upload-oracled: Speak Manager protocol version 5.
   * tag2upload-builder-rebuild: Request restarting workers.
 .
   git-debpush miscellaneous:
   * Expand and update statement of design principles.
   * Delete a completed TODO.
 .
 dgit (13.9) experimental; urgency=medium
 .
   tag2upload infrastructure:
   * Improve and shorten command lines appearing in report emails.
   * Check upstream tag/commit correspondence even when using existing origs.
   * Minor performance improvement for native packages (skip pre-fetch).
 .
   Internal changes:
   * Testing improvements for tag2upload.
   * changelog: Start 13.9
   * Introduce new tag2upload-obtain-origs script.
 .
 dgit (13.8) experimental; urgency=medium
 .
   git-debpush user experience improvements:
   * Check for and handle an existing tag for this version.
   * Try to check our branch against the remote target branch,
     to detect releasing from behind mainline, and avoid push failures.
     Closes: #1107921.
 .
   Internal changes:
   * dgit: Provide abbreviated --t2u-* options, to support log improvements.
   * git-debpush: Improve comment about remote branch.  [Sean Whitton]
   * git-debpush: Coding style cleanups.
   * dir-locals.el: Set fill-column to 78 for all languages.
 .
 dgit (13.7) experimental; urgency=medium
 .
   * Demo upload for talk.
 .
 dgit (13.6) experimental; urgency=medium
 .
   * Demo upload for talk rehearsal.
 .
 dgit (13.5) experimental; urgency=medium
 .
   git-debpush user experience improvements:
   * Check for tag already existing at the remote.  Part of #1107921.
   * Improve error message for tag already existing locally.
   * Check for uncommitted changes in working tree.
     Closes: #1108088.  [Sean Whitton]
 .
   tag2upload service:
   * Properly RFC2047-escape non-ASCII names.  Closes: #1108613.
   * Hide virt runes in a per-invocation ssh wrapper  Closes: #1107151.
   * Print oracle and builder dgit versions in transcript.  Closes: #1108242.
   * d-r-s t2u: Add missing -oBatchMode=yes option to ssh invocation.
 .
   CI and administrivia:
   * CI: Check for missing Signed-off-by.
   * git-debpush: Add missing copyright notice.  [Sean Whitton]
   * Add missing Closes for #1108180 to changelog entry for 12.125.
   * CI: Drop compatibility tests for buster, which is gone from the archive.
 .
   Suppporting changes:
   * git-debpush: Figure out the previous maintainer upload version.
   * dgit: Honour DGIT_VERSION in dgit --version and use it in ./using-these.
   * git-debpush: Reorganisation and tidying.  [Ian Jackson and Sean Whitton]
 .
 dgit (13.4) experimental; urgency=medium
 .
   Documentation:
   * t2u o2m: Describe version 5, with 'restart' message.  [Sean Whitton]
   * t2u FAQ: Clarify that debian/-only repos still need
     upstream source in git.  [Christoph Berg]
   * t2u FAQ: Remove much obsolete material.
 .
   Tests:
   * t2u: Test "tag changed between fetches" path.
   * CI: Check for blocking todos (three or more X's).
 .
   Internals:
   * Avoid blocking-todo markers in a few places in docs and comments.
   * dgit-repos-server: Fix a comment about indistrodir.
   * tests: debpolicy-taintrm: Downgrade a TODO.
Checksums-Sha1:
 9193e59edd3b0c18c8347e09d776d313b66a0eb0 2111 dgit_13.11.dsc
 7f99505fd4f2ce48b05d2c284027558ee183d56b 775411 dgit_13.11.tar.gz
Checksums-Sha256:
 4824f3e9a499a6c7e0699c6f7792f16b0d1105a86bac64644a70b73cf0cacf00 2111 dgit_13.11.dsc
 a1fca8a024897385e6238b0ceef172d4754493071d51ac0def18b17b4ab68bb6 775411 dgit_13.11.tar.gz
Files:
 7966448f18a47e620270ba6888e153d6 2111 devel optional dgit_13.11.dsc
 51e56d2f6a4773ce3cc47156c6e9c0bc 775411 devel optional dgit_13.11.tar.gz
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEVZrkbC1rbTJl58uh4+M5I0i1DTkFAmiZDtYACgkQ4+M5I0i1
DTmhdQf/VUwTc+1xg3POYk6Nn7ai83HGt+Gc36FCeQLp8qjNgQ3lCtS2pcsVBcmE
VS9/Feh6q5o9jpbMob/TBKaH6VdyNs0koEEi2VDC9ELi7KVZkPgQlsiq31IAMN6B
00gQ9ZJzs0A5Gfy0dAFUXBNE8EGHufhq3Ee87aFmvgLSipo8r6I+GJC1u+5cBoSr
TV7SsBAwyNjy+nIYbg3rCU2cYjI8vSGNySrwnXTyKrJ8HnCY9nC+DGSBrgWWvqg3
Sj58Ny3MIqkoH6d/bapwpawcdK5kowv3ToDvUhSH1Ix4nQCCpvTRcdOlp2EnHVrZ
3OVU4lUcKy3AKooeP1QU8uaAd1RYGw==
=du5z
-----END PGP SIGNATURE-----