Package: developers-reference
Severity: minor
Tags: patch

'*.list' files are now replaced by '*.sources' files. The provided
patch (in attachment) replaces the example by the new file format. It
also adds some highlights.

I don't know if the 'Signed-By' line is necessary. I added it based on
'/etc/apt/sources.list.d/debian.sources' file on 'testing' system.

I can send a PR on salsa if you prefer.

Regards

Hi!

This change seems unrelated to this bug report?

Please use the «.pgp» extension, as the «.gpg» one is currently a
symlink for backwards compatibility, that will eventually go away.
(And this is not a GnuPG artifact, but an OpenPGP one. :)

Thanks,
Guillem

Hello,

Le mar. 24 févr. 2026 à 01:25, Guillem Jover <guillem@debian.org> a écrit :

Yes. I removed it from the new patch (in attachment). I will write
another bug report dedicated to highlighting if I see other ones.

I fixed it too.


Regards

For the trixie release notes, especially for the “Upgrades from Debian 12 (bookworm)” section, it probably is a bad idea to change the .gpg file extensions to .pgp as the changes to the .pgp file extension for the files in the filesystem was done in the trixie release cycle and is not present within bookworm. 
The Upgrade from bookworm fails with .pgp in here.
btw:
(And this is not a GnuPG artifact, but an OpenPGP one. :)

If this change was rushed because of the GnuPG vs. OpenPGP controversity, please revise this kind of emotional changes. 
And please do not add an updated package to old bookwork just to show us that .pgp is yet the one to get used here and .gpg is bad. That probably will have other side effects and unforeseen drawbacks... 
There's nothing wrong with having the .gpg extension in the current upgrade guidance and to change this with the next or one of the upcoming releases. 
Thanks
hede

Hi!

Ah, I initially thought this comment was confusing devref with the
rel-notes (as it otherwise seemed misplaced here), but I see now
there was a change done on the rel-notes related to this (which still
seems misplaced here, and the proposed change in this report seems
correct to me).

I've not checked the context of the rel-notes change, but switching
the pathnames to the keyrings should only be done after a Debian
system has been fully upgraded to Debian trixie (not before), because
the keyring renames were done only in Debian trixie.

If the current text proposes doing that before the upgrade, I think
that instead of reverting that change, it would be better to mention
that the user should be doing this after the upgrade to avoid having
to remember to do it on a next upgrade where there might no longer
be a .gpg symlink anymore.

Using .gpg for OpenPGP artifacts has always been wrong as there's
always been other implementations. Now that GnuPG has decided to get off
the OpenPGP RFC process and implementation, it's also in addition very
confusing and misleading, it's also unfair to other implementations,
and creates an unnatural lock-in by association. I've been going around
trying to correct this for years now (5 or more?), so this is not an
"emotional change", it is a change for correctness, clarification and
fairness. (Using .gpg for LibrePGP artifacts would make perfect sense
to me for example.)

But I agree that phasing it out should be done carefully, taking
backwards compatibility into account (when pathnames are "an interface"),
and that's why I didn't propose a change to the rel-notes in trixie,
I was waiting for forky (but as mentioned above I think the users can
already be notified about this to be done post-upgrade).

Thanks,
Guillem

Hi!

I've prepared an MR to try to clarify this via a "Note" at
<https://salsa.debian.org/ddp-team/release-notes/-/merge_requests/341>.

Thanks,
Guillem

The disadvantage of /only/ adding notes in the text is that people are
likely to refer to the debian.sources examples (they stand out on the
page, and are framed on the webpage) without necessarily (re)reading
the surrounding text. For the official sources, restoring the '.gpg'
in the Release Notes, as below, will cause less confusion, though
not for the unfortunates who downloaded copies during the last week.

  ┌─────────────────────────────────────────────────────────────┐
  │                                                             │
  │  Types: deb                                                 │
  │  URIs: https://deb.debian.org/debian                        │
  │  Suites: trixie trixie-updates                              │
  │  Components: main non-free-firmware                         │
  │  Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg  │
  │                                                             │
  │  Types: deb                                                 │
  │  URIs: https://security.debian.org/debian-security          │
  │  Suites: trixie-security                                    │
  │  Components: main non-free-firmware                         │
  │  Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg  │
  │                                                             │
  └─────────────────────────────────────────────────────────────┘

(That's for §4.3.1; I won't include the one for §4.3.2 here.)

Cheers,
David.

I'm with David. 
 
Better to have a working guidance (probably with a note saying that this will change in the future) instead of having a non-working guidance with a note explaining why it breaks, if following the guidance. 
 
We do have both names (.pgp plus a .gpg-symlink) in trixie for the transition period and with the next release (forky?) the upgrade guidance in the release notes will change this to .pgp, so the additional .gpg-symlink will no longer be needed. 
 
hede

control: tags -1 - patch
thanks

thanks, I guess, but this bug is about documenting this in
developers-reference as well, as the initial bug report has
a patch for. (though that patch also has enough issues making
it unusable which is also why i'm removing the patch tag.)