Upstream of src:mariadb-mysql-kbs signs their release tags. Old v4
format for debian/watch works fine:

version=4
options="mode=git, gitexport=all, pgpmode=gittag" \
https://github.com/williamdes/mariadb-mysql-kbs/ \
   refs/tags/v?([\d\.]+) debian

However, when converting this to new v5 format uscan fails to find and
check the tag signatures:

Version: 5
Template: Github
Owner: williamdes
Project: mariadb-mysql-kbs
Pgp-Mode: gittag


$ uscan --force-download --verbose
uscan info: Scan watch files in .
uscan info: Check debian/watch and debian/changelog in .
uscan info: package="mariadb-mysql-kbs" version="1.3.0-2" (as seen in
debian/changelog)
uscan info: package="mariadb-mysql-kbs" version="1.3.0" (no epoch/revision)
uscan info: ./debian/changelog sets package="mariadb-mysql-kbs" version="1.3.0"
uscan info: Found upstream signing keyring: debian/upstream/signing-key.asc
uscan info: Process watch file at: debian/watch
    package = mariadb-mysql-kbs
    version = 1.3.0
    pkg_dir = .
uscan info: Parsing downloadurlmangle:
s%(api.github.com/repos/[^/]+/[^/]+)/git/refs/%$1/tarball/refs/%g
uscan info: Parsing filenamemangle:
s%.*/(?:[^/]+\-)?(?:[-_]?[Vv]?(\d[\-+\.:\~\da-zA-Z]*))%mariadb-mysql-kbs-$1.tar.gz%
uscan info: Parsing pgpmode: gittag
uscan info: Parsing searchmode: plain
uscan info: Last orig.tar.* tarball version (from debian/changelog): 1.3.0
uscan info: Last orig.tar.* tarball version (dversionmangled): 1.3.0
uscan info: Requesting URL:
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/matching-refs/tags/
uscan info: Found the following matching files on the web page (newest first):
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.3.0
(1.3.0) index=1.3.0-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.14
(1.2.14) index=1.2.14-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.13
(1.2.13) index=1.2.13-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.12
(1.2.12) index=1.2.12-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.11
(1.2.11) index=1.2.11-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.10
(1.2.10) index=1.2.10-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.9
(1.2.9) index=1.2.9-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.8
(1.2.8) index=1.2.8-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.7
(1.2.7) index=1.2.7-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.6
(1.2.6) index=1.2.6-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.5
(1.2.5) index=1.2.5-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.4
(1.2.4) index=1.2.4-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.3
(1.2.3) index=1.2.3-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.2
(1.2.2) index=1.2.2-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.1
(1.2.1) index=1.2.1-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.2.0
(1.2.0) index=1.2.0-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.1.0
(1.1.0) index=1.1.0-0
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.0.0
(1.0.0) index=1.0.0-0
uscan info: Looking at $base        =
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/matching-refs/tags/
with
    $filepattern        =
https://api.github.com/repos/[^/]+/[^/]+/git/refs/tags/(?:[^/]+\-)?(?:[-_]?[Vv]?(\d[\-+\.:\~\da-zA-Z]*))
found
    $newfile            =
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.3.0
    $mangled_newversion = 1.3.0
    $newversion         = 1.3.0
    $lastversion        = 1.3.0
uscan info: Matching target for downloadurlmangle:
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.3.0
uscan info: Upstream URL(+tag) to download is identified as
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/tarball/refs/tags/v1.3.0
uscan info: Matching target for filenamemangle:
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/git/refs/tags/v1.3.0
uscan info: Filename (filenamemangled) for downloaded file:
mariadb-mysql-kbs-1.3.0.tar.gz
uscan info: Newest version of mariadb-mysql-kbs on remote site is
1.3.0, local version is 1.3.0
uscan info:  => Package is up to date from:
             =>
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/tarball/refs/tags/v1.3.0
uscan info:  => Forcing download as requested
uscan info: Downloading upstream package: v1.3.0
uscan info: Requesting URL:
https://api.github.com/repos/williamdes/mariadb-mysql-kbs/tarball/refs/tags/v1.3.0
uscan info: Successfully downloaded upstream package: v1.3.0
uscan info: Renamed upstream package to: mariadb-mysql-kbs-1.3.0.tar.gz
Use of uninitialized value $prog[4] in exec at
/usr/share/perl5/Dpkg/IPC.pm line 310.
fatal: not a git repository: '../mariadb-mysql-kbs-temporary.614.git'
Use of uninitialized value $prog[4] in join or string at
/usr/share/perl5/Dpkg/IPC.pm line 330, <$output_pipe> line 1.
uscan: error: git --git-dir ../mariadb-mysql-kbs-temporary.614.git
show-ref  subprocess returned exit status 128

I tried variations on the v5 syntax but didn't get any of them to work.

If this is a user error, please close this bug with an documentation
update to man page
(https://manpages.debian.org/unstable/devscripts/uscan-templates.5.en.html#Github)
showing example of using GitHub template with no signatures, with
signed git tags, and with detached signatures in the GitHub "release".

Le 19/10/2025 à 02:28, Otto Kekäläinen a écrit :

Hi,

you switch here from git mode to http mode, so it's normal to no more
have gittag working. Simply use here the result of "uscan
--update-watchfile" as new debian/watch file.

Cheers,
Xavier

Hi,

I confirm that running `uscan --update-watchfile` produces the file
below, and that file continues to verify the signature:

  Version: 5
  Source: https://github.com/williamdes/mariadb-mysql-kbs/
  Matching-Pattern: refs/tags/v?([\d\.]+)
  Gitexport: all
  Mode: git
  Pgpmode: gittag
  Update-Script: uupdate

Thus the thing I ran into is simply that the uscan GitHub template
currently doesn't support checking either detached signatures or
signed git tags. As you suggested in #1118383, that would be solved by
having separate GitHub templates called e.g. GitHubSignedTags and
GitHubSignedReleases

El lun, 20 abr 2026 a las 0:55, Agustin Martin (<agmartin@debian.org>) escribió:

Hi,

Did not reach something general working for detached signatures in
both maria-db and libarchive, but wrote something that can help with
'mode=git' and 'pgpmode=gittag'. I am attaching the current result of
my tests as a proof of concept. Part that helps with libarchive is
ugly and I think should not be used in that way, since it does not
work with maria-db, but the other things may help.

First there is a template reorganization with three sections. In first
one some variables are defined with defaults for the general case.
Second section tries to modify those defaults for some particular
cases. Finally, in third section assignations are done.

In second section I also set 'mode=git' if 'pgpmode=gittag' and was
not previously set. I think this is reasonable. This part seems to
work (only a warning "warning: refs/tags/v1.3.0
ffa336279080e519c8d9cc7894a444f3476c369f is not a commit!", apparetly
harmless)

Part using 'pgpmode=auto' for libarchive is anything but generat (so
IMHO is not ready) but adding it in case is useful. Some discussion
about this last thing. I have checked both libarchive and mariadb for
detached signatures support and they are different and difficult to
deal with a single set of rules. I do not know how many different
layouts we may have for detached signatures. If only a few and clear
enough, we could use a new template parameter (something like
'Detached-Signature-Layout') to handle one or other. Did not have time
to check more packages with detached signatures.

Anyway, I think that the change in structure is good (and would save
having another template for signed stuff), as well as the 'mode=git'
stuff. If you agree I can prepare a MR with only this part (leaving
detached signatures outside).

Hope this helps,

Hi,

I have opened a MR with this part, stripped of non directly related things
(and fixed, as original file was buggy),

https://salsa.debian.org/debian/devscripts/-/merge_requests/649

Regarding detached signatures, I have been looking at some packages, and
seems that there are at least two layouts, one is what happens with
libarchive, and other what happens with maria-db (may be with variants),
but did not go into details, so may be more complex.

As previously commented, I would suggest a new Github.pm local property,
"Detached-Signature", where values for defined layouts trigger different
behaviors. Currently I have only made it work for libarchive (and only for
'Release-Only: yes), which seems to be the more frequent case, from the
api page there is a pointer to tarball and signed tarball in the same
assets page and with full package-version.ext{.sigext}. Names for this
case is welcome, I thought about "namedboth".

Hope this helps,