Hi!

The new templates feature in uscan for debian/watch contents greatly
streamlines things:

Example:

  Version: 5

  Template: Github
  Author: guimard
  Project: llng-docker

This is a great improvement, thanks for working on it!

I was wondering if we could go one step further and use the existing
fields in debian/upstream/metatada directly? Or if they don't suffice,
extend https://dep-team.pages.debian.net/deps/dep12/ so that it is
enough?

This would feel like a very natural place to document how and where
upstream publishes releases, and was also proposed in
https://lists.debian.org/debian-devel/2025/08/msg00147.html

Also, if Jelmer is open to it, the upstream metadata could maybe be
extended to have a field documenting if upstream publishes signature
files or not, and uscan could maybe read that file too when deciding
if the new version can be downloaded and trusted or not.

Hello,

Bug #1111114 in devscripts reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/devscripts/-/commit/0eb2557c2ab83b319208f66aee76b5270ce498ff
------------------------------------------------------------------------
uscan: use debian/upstream/metadata if debian/watch is missing

Closes: #1111114
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1111114

From https://salsa.debian.org/debian/devscripts/-/merge_requests/540#note_642316

I tried testing this on package
[glow](https://salsa.debian.org/go-team/packages/glow) that had the
Archive field added:

```diff
--- a/debian/upstream/metadata
+++ b/debian/upstream/metadata
@@ -3,3 +3,4 @@ Bug-Database: https://github.com/charmbracelet/glow/issues
 Bug-Submit: https://github.com/charmbracelet/glow/issues/new
 Repository: https://github.com/charmbracelet/glow.git
 Repository-Browse: https://github.com/charmbracelet/glow
+Archive: GitHub
```

Diff of running `uscan --verbose` before vs after deleting the
`debian/watch` file:
```diff
+uscan info: Scan watch files in .
+uscan info: Check debian/watch and debian/changelog in .
+uscan info: Found debian/upstream/metadata instead of debian/watch,
trying to read it
-uscan info: Start checking for common possible upstream OpenPGP signature files
-uscan info: End checking for common possible upstream OpenPGP signature files
```

The `glow-2.1.1.tar.gz` was correctly fetched, but without the `watch`
file it was not ignoring the upstream signatures.

For signature checking has currently regressed. To make them work
again https://dep-team.pages.debian.net/deps/dep12/ should extended
with a new field like e.g. `Release-signatures: yes`, or alternatively
uscan should just assume that if `debian/upstream/signing-key.asc`
exists, it must be used to check the upstream signature as suggested
in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111115#25