Dear Maintainer,

doing a sponsored upload/push via "git debpush" works, while the fact
it was sponsored is not mentioned by tracker.debian.org [1], no "signed
by:" annotation, and DDPO [2], the package in question is not listed
under "Sponsored/other uploads".

Please find attached tag2upload's notification email regarding the
successful push.

[1] https://tracker.debian.org/pkg/scalpel
[2] https://qa.debian.org/developer.php?login=sge%40debian.org

Hello,

This isn't a bug in tag2upload, but instead in those other tools, which
need to learn to parse our metadata.  I'm closing this bug; please file
new ones against those tools.

Hi.  We (the tag2upload team) received the following report:

Sven Geuer writes ("Bug#1116530: git-debpush: fact of a sponsored upload/push gets lost"):
...

I believe both of these services are getting their data from UDD.
I looked in UDD and:

udd=> select * from upload_history where source='scalpel' and version='1.60+git20240110.6960eb2-2';
 source  |          version           |          date          |               changed_by               | changed_by_name  |  changed_by_email   |                          maintainer                          |    maintainer_name    |           maintainer_email           | nmu | signed_by | signed_by_name | signed_by_email | key_id | distribution |             file             | fingerprint
---------+----------------------------+------------------------+----------------------------------------+------------------+---------------------+--------------------------------------------------------------+-----------------------+--------------------------------------+-----+-----------+----------------+-----------------+--------+--------------+------------------------------+-------------
 scalpel | 1.60+git20240110.6960eb2-2 | 2025-09-27 19:57:51+00 | Matheus Polkorny <mpolkorny@gmail.com> | Matheus Polkorny | mpolkorny@gmail.com | Debian Security Tools <team+pkg-security@tracker.debian.org> | Debian Security Tools | team+pkg-security@tracker.debian.org | f   | N/A       | N/A            |                 | N/A    | unstable     | debian-devel-changes.current | N/A
(1 row)

udd=>

I don't know precisely how UDD gets its data, but I think this may be
happening because UDD is mishandling `Git-Tag-*` fields in the
.changes file?

Compare these uploads:

1. Traditional sponsored upload

https://tracker.debian.org/news/1671040/accepted-secnet-068-source-into-unstable/

    Maintainer: Ian Jackson <ijackson@chiark.greenend.org.uk>
    Changed-By: Ian Jackson <ijackson@chiark.greenend.org.uk>

 The PGP signature is from the sponsor, Sean Whitton. [1]
 UDD has Sean in the `signed_by` column, which is correct.

2. tag2upload non-sponsored upload

https://tracker.debian.org/news/1659525/accepted-dgit-1313-source-into-unstable/

    Maintainer: Debian tag2upload Delegates <dgit-owner@debian.org>
    Changed-By: Ian Jackson <ijackson@chiark.greenend.org.uk>
    Git-Tag-Info: tag=937352782edf8d25b5c6d7f3de1180e8566b7c40 fp=559ae46c2d6b6d3265e7cba1e3e3392348b50d39
    Git-Tag-Tagger: Ian Jackson <ijackson@chiark.greenend.org.uk>

 The PGP signature on the .changes is from the tag2upload service.
 UDD has no `signed_by`, which I think is correct.

3. tag2upload sponsored upload (the case above)

https://tracker.debian.org/news/1671352/accepted-scalpel-160git202401106960eb2-2-source-into-unstable/

    Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
    Changed-By: Matheus Polkorny <mpolkorny@gmail.com>
    Git-Tag-Info: tag=0f74dabff93a3a006a61c485ad8af3ecce86f4b0 fp=3df5e8aa43fc9fdfd086f195adf50edaf8add585
    Git-Tag-Tagger: Sven Geuer <sge@debian.org>

 The PGP signature on the .changes is from the tag2upload service.
 I think UDD ought to have `signed_*` fields mentioning Sven Geuer,
 but in fact it has 'N/A'.

The spec for the .changes fields can be found here:

https://salsa.debian.org/dgit-team/dgit/-/blob/609c3e90a1b093c513d250ee6c1c995719b02a41/TAG2UPLOAD-DESIGN.txt#L193

I hope this is enough information to fix it, but we're happy to answer
questions of course.   Thanks for your attention.

Ian.

[1] I am having to replace my PGP key, so Sean kindly sponsored me.

Hi Ian,

Thanks for your detailled comment. I added a reference to it to
https://salsa.debian.org/qa/distro-tracker/-/issues/86 which seems to
be the place where this problem will get dealt with.

Sven

Hi,
I believe that tracker.d.o is doing its own parsing of the
debian-devel-changes mailing list, unrelated to UDD's.
According to the discussion in
https://salsa.debian.org/qa/distro-tracker/-/issues/86, UDD is the
source for qa.debian.org.

The code that populates the upload_history table in UDD is
https://salsa.debian.org/qa/udd/-/blob/master/udd/upload_history_gatherer.py?ref_type=heads

But there's a pre-processing phase, see:
https://salsa.debian.org/qa/udd/-/blob/master/scripts/README.upload-history?ref_type=heads
https://salsa.debian.org/qa/udd/-/blob/master/scripts/Makefile.upload-history?ref_type=heads
https://salsa.debian.org/qa/udd/-/blob/master/scripts/upload_history_extractor.py?ref_type=heads

Unfortunately that's not very nice code. It's painful that the source we
are using for this information is email archives. Maybe that problem is
a good opportunity for reworking all of it...

Lucas

Hi,

UDD's upload_history table now includes the content of the Git-Tag-Info
and Git-Tag-Tagger fields. They are also split into separate columns to
make their use easier.

Additionally, I added uploaded_by_* that either uses the tag2upload
fields (if present) or the signed_by fields, so provide an easy way to
fallback between the tag2upload information and the traditional
information.

Example with two uploads (one with tag2upload, one without):

-[ RECORD 1 ]-----------+-----------------------------------------------------------------------------------------
source                  | dh-lisp
version                 | 0.7.3
date                    | 2026-01-16 13:33:34+00
changed_by              | Sean Whitton <spwhitton@spwhitton.name>
changed_by_name         | Sean Whitton
changed_by_email        | spwhitton@spwhitton.name
maintainer              | Debian Common Lisp Team <debian-common-lisp@lists.debian.org>
maintainer_name         | Debian Common Lisp Team
maintainer_email        | debian-common-lisp@lists.debian.org
nmu                     | f
signed_by               | Debian tag2upload service (key 1) <debian-tag2upload@lists.debian.org>
signed_by_name          | Debian tag2upload service (key 1)
signed_by_email         | debian-tag2upload@lists.debian.org
key_id                  | 606D084E4683C079
distribution            | unstable
file                    | debian-devel-changes.current
fingerprint             | 374D8CE4DB96E9CBD4C0972A606D084E4683C079
git_tag_info            | tag=cf039592ab1f6aa0ecfbd50f482f96fac5fe3887 fp=9b917007ae030e36e4fc248b695b7ae4bf066240
git_tag_tagger          | Sean Whitton <spwhitton@spwhitton.name>
git_tag_tagger_name     | Sean Whitton
git_tag_tagger_email    | spwhitton@spwhitton.name
git_tag_info_tag        | cf039592ab1f6aa0ecfbd50f482f96fac5fe3887
git_tag_info_fp         | 9b917007ae030e36e4fc248b695b7ae4bf066240
uploaded_by             | Sean Whitton <spwhitton@spwhitton.name>
uploaded_by_name        | Sean Whitton
uploaded_by_email       | spwhitton@spwhitton.name
uploaded_by_fingerprint | 9B917007AE030E36E4FC248B695B7AE4BF066240
-[ RECORD 2 ]-----------+-----------------------------------------------------------------------------------------
source                  | phosh-osk-stevia
version                 | 0.52.1-1
date                    | 2026-01-16 13:18:50+00
changed_by              | Guido Günther <agx@sigxcpu.org>
changed_by_name         | Guido Günther
changed_by_email        | agx@sigxcpu.org
maintainer              | Guido Günther <agx@sigxcpu.org>
maintainer_name         | Guido Günther
maintainer_email        | agx@sigxcpu.org
nmu                     | f
signed_by               | Guido Günther <guido@xcpu.ch>
signed_by_name          | Guido Günther
signed_by_email         | guido@xcpu.ch
key_id                  | 25BF86524AFCC1E3
distribution            | unstable
file                    | debian-devel-changes.current
fingerprint             | 0DB3932762F78E592F6522AFBB5A2C77584122D3
git_tag_info            |
git_tag_tagger          |
git_tag_tagger_name     |
git_tag_tagger_email    |
git_tag_info_tag        |
git_tag_info_fp         |
uploaded_by             | Guido Günther <guido@xcpu.ch>
uploaded_by_name        | Guido Günther
uploaded_by_email       | guido@xcpu.ch
uploaded_by_fingerprint | 0DB3932762F78E592F6522AFBB5A2C77584122D3

As an unrelated change, I also stopped using 'N/A' for empty values, and
instead use NULLs.

Lucas

Hi Lucas,

Thanks for bringing these data to UDD.

Unfortunately it does not help with what I reported when opening the bug:

DDPO seems not to rely on UDD at all. According to the code [3]+[4] it
pulls the data from some Berkley DBs. I think this should be changed to
read from UDD instead.

Does this warrant a new bug report? Or would it be preferable to
unmerge und reopen this bug, #1116530?

Sven

[3] https://salsa.debian.org/qa/qa/-/blob/master/wml/developer.wml#L1772
[4] https://salsa.debian.org/qa/qa/-/blob/master/wml/developer.wml#L1469

On Wed, 2026-02-04 at 12:13 +0100, Sven Geuer wrote:
[...]

Reopening this bug as extending UDD's upload_history table did not fix
what this bug is about.

Sven