#1116706 uscan: --dehs reports incorrect uscan status

Package:
devscripts
Source:
devscripts
Description:
scripts to make the life of a Debian Package maintainer easier
Submitter:
Milan Kupcevic
Date:
2026-08-25 03:53:01 UTC
Severity:
normal
#1116706#5
Date:
2025-09-30 12:42:30 UTC
From:
To:
UDD upstream watch gets incorrect uscan status:

 $ curl https://udd.debian.org/cgi-bin/upstream-status.json.cgi | jq '.[] | select(.package == "osg-certificates")'
 [...]
 {
   "debian-mangled-uversion": "1.137+~1.137+~25258.4d4352d",
   "debian-uversion": "1.137+dfsg+~1.137+~25258.4d4352d",
   "package": "osg-certificates",
   "status": "newer package available",
   "upstream-url": "https://api.github.com/repos/opensciencegrid/osg-certificates/tarball/refs/tags/v1.137.igtf.1.137",
   "upstream-version": "1.137.igtf.1.137+~1.137+~25258.4d4352d",
   "warnings": null,
   "errors": null
 }

Nevertheless, running uscan on a command line gets correct upstream status:

 $ dget https://deb.debian.org/debian/pool/main/o/osg-certificates/osg-certificates_1.137+dfsg+~1.137+~25258.4d4352d-1.dsc
 [...]
 $ uscan --pasv --dehs --no-download
 <dehs>
 <package>osg-certificates</package>
 <debian-uversion>1.137+dfsg+~1.137+~25258.4d4352d</debian-uversion>
 <debian-mangled-uversion>1.137+~1.137+~25258.4d4352d</debian-mangled-uversion>
 <upstream-version>1.137+~1.137+~25258.4d4352d</upstream-version>
 <upstream-url>https://api.github.com/repos/opensciencegrid/osg-certificates/tarball/refs/tags/v1.137.igtf.1.137</upstream-url>
 <status>up to date</status>
 <component id="igtf-bundle">
   <component-debian-uversion>1.137</component-debian-uversion>
   <component-debian-mangled-uversion>1.137</component-debian-mangled-uversion>
   <component-upstream-version>1.137</component-upstream-version>
   <component-upstream-url>https://dist.eugridpma.info/distribution/igtf/current/igtf-policy-installation-bundle-1.137.tar.gz</component-upstream-url>
 </component>
 <component id="letsencrypt-ca">
   <component-debian-uversion>25258.4d4352d</component-debian-uversion>
   <component-debian-mangled-uversion>25258.4d4352d</component-debian-mangled-uversion>
   <component-upstream-version>25258.4d4352d</component-upstream-version>
   <component-upstream-url>https://github.com/opensciencegrid/letsencrypt-certificates.git HEAD</component-upstream-url>
 </component>
 </dehs>

Could you please check what is going on with the UDD upstream importer?

Thank you,

Milan
#1116706#10
Date:
2025-09-30 13:39:19 UTC
From:
To:
Hi,

UDD uses devscripts 2.25.19. Could it be a regression introduced with
the recent uscan changes in devscripts?

Lucas
#1116706#15
Date:
2025-09-30 21:53:38 UTC
From:
To:
While uscan 2.25.15 works fine, the uscan 2.25.19 in verbose mode lists
all upstream components as "Package is up to date" but the --dehs XML
output incorrectly reports "newer package available". It surely looks
like uscan 2.25.19 regression.

Milan
#1116706#20
Date:
2025-10-01 13:46:47 UTC
From:
To:
Hi Xavier,

The original reporter might not read -qa@, re-added to Cc (as well as
the bug)

I can reproduce with
https://deb.debian.org/debian/pool/main/o/osg-certificates/osg-certificates_1.137+dfsg+~1.137+~25258.4d4352d-1.dsc

Lucas
#1116706#25
Date:
2025-10-01 13:49:16 UTC
From:
To:
(Re-sent because I messed up headers)

Hi Xavier,

The original reporter might not read -qa@, re-added to Cc (as well as
the bug)

I can reproduce with
https://deb.debian.org/debian/pool/main/o/osg-certificates/osg-certificates_1.137+dfsg+~1.137+~25258.4d4352d-1.dsc

Lucas