When people generate source-only uploads with "sbuild
--source-only-changes", the _source.changes file includes an 
_amd64.buildinfo file (for example). This would then fail to merge with
an _amd64.buildinfo file from the amd64 binary build, that would include
an identically named buildinfo file with likely different contents.

See: https://salsa.debian.org/freexian-team/debusine/-/work_items/1488

The Debian archive doesn't seem to care about this, at present. But it
also doesn't actually do anything with .buildinfo files itself, it
pushes them all off to buildinfos.debian.net. I don't see any special
handling in there, so I don't know if these are handled or thrown away.
Reproducible Builds people CCed.

Debusine took the stance of dissallowing .buildinfo files that are not
named _source.buildinfo, in source-only uploads. I stand by that choice,
but obviously it has some impact for users who were using toolchains
that produced such things.

I would suggest that when called with --source-only-changes, sbuild copy
the .buildinfo file to _source.buildinfo and include *that* in the
_source.changes instead.

pbuilder has the same issue, I'll file a similar bug there.

Stefano

Hi,

Quoting Stefano Rivera (2026-07-01 22:19:01)

the command which includes the *_${BUILD_ARCH}.changes into *_source.changes is
"dpkg-genchanges --build=source".

I think that a *_source.changes *should* include a *_${BUILD_ARCH}.changes
because the architecture-specific buildinfo file serves as a proof that build
artifacts *were* produced and then we apply the existing naming rules for
buildinfo files to that (using the $DEB_BUILD_ARCH in the filename).

What are you using to merge the .changes files? I regularly use the
mergechanges tool from devscripts to merge a *_source.changes with a
*_${BUILD_ARCH}.changes just fine.

In any case, I don't think sbuild should have much of a say in the naming. If
you want to change the naming then I think that change has to happen in dpkg
(and of course in collaboration with the reproducibile builds team). This would
also mean that you don't have to file a bug against every package builder out
there (like for pbuilder as you suggested).

If you agree, please re-assign this bug to dpkg.

Thanks!

cheers, josch

Hi,

It actually does, that's why the build daemons use the --dpkg-file-suffix
of sbuild to rename the .changes and .buildinfo files.

Regards
Aurelien

Hi Aurelien (2026.07.01_21:29:30_+0000)

Ooh, I'd missed that option. Of course it can only take a single suffix,
so in this use-case (producing both a source-only upload and a mixed
upload) it can't do the right thing for both.

Stefano

See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869184 on dpkg
on this general topic.

Cheers,