#1145588 mate-utils: debian/watch is broken, uscan silently reports nothing and 1.28.1 has gone unnoticed

Package:
mate-utils
Source:
mate-utils
Description:
MATE desktop utilities
Submitter:
Kenny Daniel
Date:
2026-08-25 19:47:01 UTC
Severity:
normal
Tags:
#1145588#5
Date:
2026-08-25 19:44:30 UTC
From:
To:
Dear Maintainer,

mate-utils in unstable is 1.26.1. Upstream has released 1.28.0 (Feb 2024) and
1.28.1 (May 2026) since then, and uscan hasn't flagged either one.

The reason is the watch URL. https://git.mate-desktop.org/mate-utils/ returns
HTTP 502 for every path right now, and uscan doesn't treat that as an error. It
requests the URL, matches nothing and exits 0, so the package looks up to date
when it isn't:

  $ uscan --verbose --report
  uscan info: Requesting URL:
https://git.mate-desktop.org/mate-utils/
  uscan info: Scan finished
  $ echo $?
  0

The patch below repoints debian/watch at the GitHub releases API. With it
applied:

  $ uscan --verbose --report
  Newest version of mate-utils on remote site is 1.28.1, local version is 1.26.1
   => Newer package available from:
      => https://github.com/mate-desktop/mate-utils/releases/download/v1.28.1/mate-utils-1.28.1.tar.xz

Tested with uscan 2.26.7. The [02468] in the minor position keeps the old watch
file's restriction to even-numbered stable series, so 1.23.x, 1.25.1 and 1.27.0
are still skipped.

Worth knowing: the 502 hits every repo path on that host, not just this one
(/, /marco/, /caja/, /atril/, /mate-panel/ and so on). Other packages the team
maintains use the same watch URL, so they're likely sitting on the same blind
spot.

I used the releases API rather than the /releases HTML page because that page
lazy-loads its asset list and has no tarball links for uscan to match. I avoided
/tags because those are git archives without the pre-generated configure that
upstream's release tarballs ship.

I also looked at pointing this at pub.mate-desktop.org, but
mate-utils-1.28.1.tar.xz was never uploaded there (404), so pub can't see the
current release at all. It only gets you as far as 1.28.0, and that still has
the fork-based save this package already patches out in 1.26.1-2, so it isn't a
useful target either. That gap isn't specific to mate-utils: of the 20
mate-desktop repos with a v1.28.1 release on GitHub, 8 have no tarball on pub,
because uploading there is a manual script the release CI doesn't run. I'll
report that upstream separately.

Regards,
Kenny Daniel

diff --git a/debian/watch b/debian/watch
index a57cb61..2497982 100644
--- a/debian/watch
+++ b/debian/watch
@@ -1,3 +1,21 @@
 version=4
-https://git.mate-desktop.org/mate-utils/ \
-    snapshot/mate-utils-(\d\.(?:[0-9]+|)[24680]\.\d)\.tar\.xz
+
+# Upstream MATE publishes its release tarballs on GitHub.
+#
+# The previous watch URL (https://git.mate-desktop.org/mate-utils/) currently
+# returns HTTP 502 for every per-repository path, so uscan can no longer detect
+# new upstream releases. This affects the MATE packages generally, not just
+# this one.
+#
+# GitHub lazy-loads the asset list on the HTML /releases page, so that page
+# contains no tarball links for uscan to match; the releases API is scanned
+# with searchmode=plain instead. The /tags tarballs are deliberately not used:
+# they are git archives without the pre-generated configure script that the
+# release tarballs ship.
+#
+# The [02468] in the minor position restricts uscan to MATE's even-numbered
+# stable series, preserving the behaviour of the previous watch file.
+
+opts="searchmode=plain" \
+ https://api.github.com/repos/mate-desktop/mate-utils/releases?per_page=100 \
+ https://github\.com/mate-desktop/mate-utils/releases/download/[^"]+/mate-utils-(\d+\.\d*[02468]\.\d+)\.tar\.xz