Dear Maintainer,

running "uscan --verbose --report" on the chkrootkit source tree infom
my local machine returns

   uscan info: Standard FTP listing.
   uscan warn: In debian/watch no matching files for watch source
     ftp://ftp.chkrootkit.org/pub/seg/pac/
   uscan info: Scan finished

instead of

   uscan info: Standard FTP listing.
   uscan info: Found the following matching files on the web page (newest first):
      chkrootkit-0.58b.tar.gz (0.58b) index=0.58b-1
      [...]
      chkrootkit-0.23a.tar.gz (0.23a) index=0.23a-1
   uscan info: Looking at $base        = ftp://ftp.chkrootkit.org/pub/seg/pac/ with
       $filepattern        = chkrootkit-(.*)\.tar\.gz found
       $newfile            = chkrootkit-0.58b.tar.gz
       $mangled_newversion = 0.58b
       $newversion         = 0.58b
       $lastversion        = 0.58b
   uscan info: Upstream URL(+tag) to download is identified as    ftp://ftp.chkrootkit.org/pub/seg/pac/chkrootkit-0.58b.tar.gz
   uscan info: Filename (filenamemangled) for downloaded file: chkrootkit-0.58b.tar.gz
   uscan info: Newest version of chkrootkit on remote site is 0.58b, local version is 0.58b
   uscan info:  => Package is up to date from:
                => ftp://ftp.chkrootkit.org/pub/seg/pac/chkrootkit-0.58b.tar.gz
   uscan info: Scan finished

An analysis of the network traffic revealed that a PORT request,
implying active mode was sent instead of a PASV request.

Prefixing the uscan call with FTP_PASSIVE=1 helps to work around this
issue.

FTP_PASSIVE was explicitly set in lib/Devscripts/Uscan/Downloader.pm
before commit 62d5fb7a2c4f60ffeb773b6a303510a07a73a31a if passive mode
was requested. With removal of the passive mode option FTP_PASSIVE is
not set anymore, apparently leading to active mode elsewhere.

Not sure where to now set FTP_PASSIVE permanently (due to the removed
option) to ensure passive mode.

I am afraid this affects all FTP transfers initiated by uscan from
behind a NAT router, thus the severity of "important".

Sven
--- /etc/devscripts.conf ---
Empty.

--- ~/.devscripts ---
DEBSIGN_MAINT="$DEBFULLNAME <$DEBEMAIL>"
DEBRELEASE_UPLOADER='dput'
DEBRELEASE_DEBS_DIR='../build-area/'
RMADISON_URL_MAP_FASTTRACK='https://fasttrack.debian.net/api/madison'

...
...
...
...
...
...

This bug breaks the uscan job in the salsa ci pipeline,

It appears to me like commit 62d5fb7a2c4f60ffeb773b6a303510a07a73a31a
intended to make passive mode the only option, but wrongly deleted the
code setting the envionment variable.

A merge request fixing this is
https://salsa.debian.org/debian/devscripts/-/merge_requests/646

Thanks