I tried V5 with this V4 watch file
version=4
opts=dversionmangle=auto,\
     pgpsigurlmangle=s/$/.asc/,\
     searchmode=plain \
https://api.github.com/repos/libarchive/libarchive/releases?per_page=100 \
https://github.com/libarchive/libarchive/releases/download/@ANY_VERSION@/[^/]+tar.gz

Upstream seems to use the releases pages for distributing release and pgp

I think this should be supported but I do not achieve to get something working

rouca

Le 15/11/2025 à 12:50, Bastien Roucaries a écrit :

Hi,

you just have to use "Release-Only: yes" with Github template

Le samedi 15 novembre 2025, 12:54:38 heure normale d’Europe centrale Xavier a écrit :

It seems it does not work the release is not on the API case

Could you cross check ?

 Bastien

El lun, 20 abr 2026 a las 0:55, Agustin Martin (<agmartin@debian.org>) escribió:

Hi,

Did not reach something general working for detached signatures in
both maria-db and libarchive, but wrote something that can help with
'mode=git' and 'pgpmode=gittag'. I am attaching the current result of
my tests as a proof of concept. Part that helps with libarchive is
ugly and I think should not be used in that way, since it does not
work with maria-db, but the other things may help.

First there is a template reorganization with three sections. In first
one some variables are defined with defaults for the general case.
Second section tries to modify those defaults for some particular
cases. Finally, in third section assignations are done.

In second section I also set 'mode=git' if 'pgpmode=gittag' and was
not previously set. I think this is reasonable. This part seems to
work (only a warning "warning: refs/tags/v1.3.0
ffa336279080e519c8d9cc7894a444f3476c369f is not a commit!", apparetly
harmless)

Part using 'pgpmode=auto' for libarchive is anything but generat (so
IMHO is not ready) but adding it in case is useful. Some discussion
about this last thing. I have checked both libarchive and mariadb for
detached signatures support and they are different and difficult to
deal with a single set of rules. I do not know how many different
layouts we may have for detached signatures. If only a few and clear
enough, we could use a new template parameter (something like
'Detached-Signature-Layout') to handle one or other. Did not have time
to check more packages with detached signatures.

Anyway, I think that the change in structure is good (and would save
having another template for signed stuff), as well as the 'mode=git'
stuff. If you agree I can prepare a MR with only this part (leaving
detached signatures outside).

Hope this helps,

Hi,

I have opened a MR with this part, stripped of non directly related things
(and fixed, as original file was buggy),

https://salsa.debian.org/debian/devscripts/-/merge_requests/649

Regarding detached signatures, I have been looking at some packages, and
seems that there are at least two layouts, one is what happens with
libarchive, and other what happens with maria-db (may be with variants),
but did not go into details, so may be more complex.

As previously commented, I would suggest a new Github.pm local property,
"Detached-Signature", where values for defined layouts trigger different
behaviors. Currently I have only made it work for libarchive (and only for
'Release-Only: yes), which seems to be the more frequent case, from the
api page there is a pointer to tarball and signed tarball in the same
assets page and with full package-version.ext{.sigext}. Names for this
case is welcome, I thought about "namedboth".

Hope this helps,