Uscan first downloads upstream-named tarball, then adds a symlink from
that to the Debian-named *_orig filename. If upstream-named tarball is
too generic, the tarball may clash with those of other projects. Most
commonly this occurs when using git mode, where upstream tarball is just
a version number.

As a workaround, `uscan --rename` can instead rename, limiting the
clash to concurrent calls to uscan. This workaround is limited, however,
because it exists only as a command-line option (not a configfile
statement) and tools like git-buildpackage does not support that option.
A workaround for the uscan workaround is to first run `uscan --rename`
and then
`gbp import-orig --upstream-vcs-tag=0.11.1 ../name-of-fetched-tarball`.
That workaround-workaround fails to work for projects with components,
however, because `gbp import-orig` takes only a single source, whereas
its `--uscan` option processes main and component tarballs together.

This example (from btm package, simplified) worked previously:

version=4
opts=\
filenamemangle=s/.*?@ANY_VERSION@(@ARCHIVE_EXT@)/@PACKAGE@_$1.orig$2/,\
downloadurlmangle=s!api.github.com/repos/[^/]+/[^/]+/\Kgit/!tarball/!g,\
searchmode=plain \
https://api.github.com/repos/ClementTsang/bottom/git/matching-refs/tags/ \
https://api.github.com/repos/[^/]+/[^/]+/git/refs/tags/@ANY_VERSION@ \
group

opts=\
component=Xtimeless,\
filenamemangle=s/.*?@ANY_VERSION@(@ARCHIVE_EXT@)/@PACKAGE@_$1.orig-Xtimeless$2/,\
mode=git,pgpmode=none,pretty=0+%cd \
https://github.com/clementtsang/timeless.git \
HEAD \
group

Since devscripts 2.25.18 it fails like this:

$ uscan
Newest version of btm on remote site is 0.11.1, local version is 0.10.2+20250107
 => Newer package available from:
        => https://api.github.com/repos/ClementTsang/bottom/tarball/refs/tags/0.11.1
Newest version of Xtimeless on remote site is 0+20250330.orig-Xtimeless, local version is 0
 => Newer package available from:
        => https://github.com/clementtsang/timeless.git HEAD
uscan warn: Parameter ../0.11.1 does not have a file extension, guessed a tarball compressed with gzip.
uscan warn: Missing debian/source/format, switch compression to gzip
Successfully symlinked ../0.11.1 to ../btm_0.11.1.orig.tar.gz.
Use of uninitialized value in subroutine entry at /usr/share/perl5/Devscripts/Uscan/Downloader.pm line 135.
Use of uninitialized value $ver in concatenation (.) or string at /usr/share/perl5/Devscripts/Uscan/Downloader.pm line 301.
Use of uninitialized value $ver in concatenation (.) or string at /usr/share/perl5/Devscripts/Uscan/Downloader.pm line 301.
uscan error: Could not read ../btm_0+20250330.orig-Xtimeless.tar.xz: No such file or directory

Dropping the filenamemangle entry from the component makes it succeed,
but then I have clashing upstream tarball files again.

 - Jonas

- -- Package-specific info:

- --- /etc/devscripts.conf ---
Empty.

- --- ~/.devscripts ---
Not present

- -- System Information:
Debian Release: forky/sid
  APT prefers buildd-unstable
  APT policy: (500, 'buildd-unstable'), (500, 'unstable'), (1, 'buildd-experimental'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.22-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=da_DK.UTF-8, LC_CTYPE=da_DK.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages devscripts depends on:
ii  dpkg-dev              1.22.21
ii  file                  1:5.46-5
ii  gpg                   2.4.8-2
ii  gpg-agent             2.4.8-2
ii  gpg-from-sq [gpg]     0.13.1-3
ii  gpgv                  2.4.8-2
ii  gpgv-from-sq [gpgv]   0.13.1-3
ii  libdpkg-perl          1.22.21
ii  libfile-dirlist-perl  0.05-3
ii  libfile-homedir-perl  1.006-2
ii  libfile-touch-perl    0.12-2
ii  libmoo-perl           2.005005-1
ii  libwww-perl           6.78-1
ii  patchutils            0.4.2-1
ii  perl                  5.40.1-6
ii  python3               3.13.5-1
ii  sensible-utils        0.0.25
ii  wdiff                 1.2.2-9

Versions of packages devscripts recommends:
ii  apt                         3.1.4
ii  curl                        8.15.0-1
ii  dctrl-tools                 2.24-3+b1
ii  debian-keyring              2025.07.26
ii  debian-tag2upload-keyring   1.1
ii  dput                        1.2.4
ii  equivs                      2.3.2
ii  git-debpush                 13.12
ii  libdistro-info-perl         1.14
ii  libencode-locale-perl       1.05-3
ii  libgitlab-api-v4-perl       0.27-1
ii  libio-string-perl           1.08-4
ii  libjson-perl                4.10000-1
ii  liblwp-protocol-https-perl  6.14-1
ii  libsoap-lite-perl           1.27-3
ii  libstring-shellquote-perl   1.04-3
ii  liburi-perl                 5.30-1
ii  licensecheck                3.3.9-1
ii  lintian                     2.122.0
ii  lzip                        1.25-3
ii  man-db                      2.13.1-1
ii  patch                       2.8-2
ii  pristine-tar                1.50+nmu2
ii  python3-apt                 3.0.0
ii  python3-debian              1.0.1
ii  python3-magic               2:0.4.27-3
ii  python3-requests            2.32.3+dfsg-5
ii  python3-unidiff             0.7.5-2
ii  python3-xdg                 0.28-2
ii  strace                      6.16+ds-2
ii  unzip                       6.0-29
ii  wget                        1.25.0-2
ii  xz-utils                    5.8.1-1

Versions of packages devscripts suggests:
pn  adequate                     <none>
pn  at                           <none>
pn  autopkgtest                  <none>
pn  bls-standalone               <none>
pn  bsd-mailx | mailx            <none>
ii  build-essential              12.12
pn  check-all-the-things         <none>
ii  debhelper                    13.25
pn  diffoscope                   <none>
pn  disorderfs                   <none>
pn  docker.io                    <none>
ii  dose-extra                   7.0.0-6+b2
pn  duck                         <none>
pn  elpa-devscripts              <none>
pn  faketime                     <none>
pn  gnuplot                      <none>
pn  how-can-i-help               <none>
ii  libauthen-sasl-perl          2.1900-1
pn  libdbd-pg-perl               <none>
pn  libmetacpan-client-perl      <none>
pn  libterm-size-perl            <none>
ii  libtimedate-perl             2.3300-2
ii  libyaml-libyaml-perl         0.903.0+ds-1
ii  mmdebstrap                   1.5.7-3
pn  mutt                         <none>
ii  openssh-client [ssh-client]  1:10.0p1-8
pn  piuparts                     <none>
pn  postgresql-client            <none>
pn  pristine-lfs                 <none>
ii  python3-debianbts            4.1.1
pn  python3-pycurl               <none>
ii  quilt                        0.68-1
pn  ratt                         <none>
pn  reprotest                    <none>
pn  svn-buildpackage             <none>
ii  w3m                          0.5.3+git20230121-2.1

- -- no debconf information
-----BEGIN PGP SIGNATURE-----

wsG7BAEBCgBvBYJooGV5CRAsfDFGwaABIUcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmcpSkaZLuBfT13LQMq106vIB8R1PB53023K0BY/cA+R
SxYhBJ/j6cNmkaaf9TzGhCx8MUbBoAEhAAAkoxAApmZWkPl1OojH/wJl2iSdE6cb
JUkEYY9zOZfxwG1BDdH4cmTdDhFXk5gETikIu6ZL6HQxUxS3JpGjFBsOBHmGcxoW
M83piFr99tKL+qkkJU142PV0IF7xmPVryBqgypULhJ7pKmNfCfS1HGNpNd27F+py
CPSJGCBszD0s0IDlyfqTS608m87Z7+o+JcHu3XfGxNGV/YORD+k3KLGMc8LqnQYY
1Bj6T84PHsM4hQqo+phEQSGmUW2Pl5qBeer7UxHellMN31+0saZG4fUOAPSR9eVq
fsOt5jNn9c40eGophGlZl/VZY0nsympV7o321lSYaB9GN1S9f3fRSmb2f6aPyIL5
NYd2sVuacctzhy8KEpWHCifgJfMW3afLDNIOuVQzCeuZans6/mWlXhDZ8DzHbVhj
WCiEwGmlF4R6r5M7a+7nvkgTxwh+htCj0WYGjJpiQ88qI6Ktxdg7AGC1w0nAhE7S
J0qlRXuQ9LO6iLFF2yBXUj5RnAJOVQhXxNjqq9b4LOeu3ssk+zGN0AmPBuBpoB/f
4bLhrFa/MKHnsKqqLjgVht4o73zyB7ncp5NJCrSilw1IFkSVOJtAhubPSe/QNrOx
xsbmKFopIkxFhDSy2RbFx70TrRHwOGuKytvd/sewNZVewHuxE7tvjMCExSgXzS+q
EoclM3EkzT3blDUcw8Y=
=hhSR
-----END PGP SIGNATURE-----

USCAN_SYMLINK=rename in ~/.devscripts is something I've been using for
years.

Cheers,

Quoting James McCoy (2025-08-16 14:39:25)

Thanks, that is interesting - that extends the workaround to be usable
also system-wide for a custom-configured host.

Is it possible to declare something like that in the watch file instead?
What I want is to be able to describe how to get from upstream name to
Debian name without the need for an intermediary unsafe filename, and
it seems sensible that such information should be possible to declare
specific to the package, without involving host tuning.

 - Jonas

Quoting Jonas Smedegaard (2025-08-16 15:10:30)

Turns out this is a limitation of git-buildpackage, seemingly treating
USCAN_SYMLINK as a binary which is always either set or unset, and
therefore overriding a default setting of USCAN_SYMLINK=rename.

I've filed a separate bugreport against git-buildpackage about that.

Thanks again, James, for the hint - that helped my experimentation.

 - Jonas