#827246 debsnap: downloading source package versions with multiple .dsc files gives broken source packages

Package:
devscripts
Source:
devscripts
Description:
scripts to make the life of a Debian Package maintainer easier
Submitter:
Paul Wise
Date:
2021-09-22 04:29:38 UTC
Severity:
normal
#827246#5
Date:
2016-06-14 04:45:07 UTC
From:
To:
Downloading gxine 0.5.908-3.1 gives a broken source package. It looks
like it is getting the debian.tar.xz file from the debian archive and
the .dsc file from the debian-ports archive.

The snapshot API is returning multiple .dsc and debian.tar.xz files,
the first .dsc is from the debian-ports archive while the first
debian.tar.xz is from the debian/debian-debug archives.

debsnap appears to download all of the files but doesn't pay attention
to identical file names with different contents from different
archives, which means that it overwrites some files with contents from
other archives.

I think the solution here might be to print an error when there are
multiple .dsc files with different contents, print the URLs to the .dsc
files, suggest downloading with `dget -q`  and exit with an  error:

Error: found multiple .dsc files, please choose one:
cd destdir ; dget -q http://snapshot.debian.org/archive/debian-ports/20150303T013353Z/pool-hurd-i386/main/g/gxine/gxine_0.5.908-3.1.dsc
cd destdir ; dget -q http://snapshot.debian.org/archive/debian/20141230T220552Z/pool/main/g/gxine/gxine_0.5.908-3.1.dsc

pabs@chianamo ~ $ debsnap --destdir . --verbose gxine 0.5.908-3.1
Getting json http://snapshot.debian.org/mr/package/gxine/
Getting json http://snapshot.debian.org/mr/package/gxine//0.5.908-3.1/srcfiles?fileinfo=1
Getting file gxine_0.5.908-3.1.dsc: http://snapshot.debian.org/file/9a46e23f17864660be5f09a85fbd6842eb53ce6d
Getting file gxine_0.5.908-3.1.debian.tar.xz: http://snapshot.debian.org/file/154eada9d3e94a0c641e60fc515a74afb736eb49
Getting file gxine_0.5.908-3.1.debian.tar.xz: http://snapshot.debian.org/file/663d85e0a8895d5054fe8c1a4d2f3f66252a5cda
Getting file gxine_0.5.908.orig.tar.xz: http://snapshot.debian.org/file/542e723c9c2d396a1da68272fae4cec762cb086f
Getting file gxine_0.5.908-3.1.dsc: http://snapshot.debian.org/file/d002e2f5bc3da9a097ee93111ce8d69a0f59d3c5
pabs@chianamo ~ $ dpkg-source -x gxine_0.5.908-3.1.dsc
dpkg-source: error: file ./gxine_0.5.908-3.1.debian.tar.xz has checksum a61c85b5cd28a15dd4e01063eaa98d9b instead of expected 8b949bf5393848697298052ec60e6eb1 (algorithm md5)
pabs@chianamo ~ $ sha1sum gxine*
154eada9d3e94a0c641e60fc515a74afb736eb49  gxine_0.5.908-3.1.debian.tar.xz
9a46e23f17864660be5f09a85fbd6842eb53ce6d  gxine_0.5.908-3.1.dsc
542e723c9c2d396a1da68272fae4cec762cb086f  gxine_0.5.908.orig.tar.xz
pabs@chianamo ~ $ dget -q http://snapshot.debian.org/archive/debian-ports/20150303T013353Z/pool-hurd-i386/main/g/gxine/gxine_0.5.908-3.1.dsc
gxine_0.5.908-3.1.dsc:
      Good signature found
   validating gxine_0.5.908.orig.tar.xz
   validating gxine_0.5.908-3.1.debian.tar.xz
All files validated successfully.
dpkg-source: info: extracting gxine in gxine-0.5.908
dpkg-source: info: unpacking gxine_0.5.908.orig.tar.xz
dpkg-source: info: unpacking gxine_0.5.908-3.1.debian.tar.xz
dpkg-source: info: applying debian-changes
pabs@chianamo ~ $ sha1sum gxine*
sha1sum: gxine-0.5.908: Is a directory
663d85e0a8895d5054fe8c1a4d2f3f66252a5cda  gxine_0.5.908-3.1.debian.tar.xz
9a46e23f17864660be5f09a85fbd6842eb53ce6d  gxine_0.5.908-3.1.dsc
542e723c9c2d396a1da68272fae4cec762cb086f  gxine_0.5.908.orig.tar.xz
pabs@chianamo ~ $ dget -q http://snapshot.debian.org/archive/debian/20141230T220552Z/pool/main/g/gxine/gxine_0.5.908-3.1.dsc
gxine_0.5.908-3.1.dsc:
      Good signature found
   validating gxine_0.5.908.orig.tar.xz
   validating gxine_0.5.908-3.1.debian.tar.xz
All files validated successfully.
dpkg-source: info: extracting gxine in gxine-0.5.908
dpkg-source: info: unpacking gxine_0.5.908.orig.tar.xz
dpkg-source: info: unpacking gxine_0.5.908-3.1.debian.tar.xz
dpkg-source: info: applying debian-changes
pabs@chianamo ~ $ sha1sum gxine*
sha1sum: gxine-0.5.908: Is a directory
154eada9d3e94a0c641e60fc515a74afb736eb49  gxine_0.5.908-3.1.debian.tar.xz
d002e2f5bc3da9a097ee93111ce8d69a0f59d3c5  gxine_0.5.908-3.1.dsc
542e723c9c2d396a1da68272fae4cec762cb086f  gxine_0.5.908.orig.tar.xz
pabs@chianamo ~ $ curl -s http://snapshot.debian.org/mr/package/gxine/0.5.908-3.1/srcfiles?fileinfo=1 | jq
{
  "_comment": "foo",
  "version": "0.5.908-3.1",
  "result": [
    {
      "hash": "663d85e0a8895d5054fe8c1a4d2f3f66252a5cda"
    },
    {
      "hash": "9a46e23f17864660be5f09a85fbd6842eb53ce6d"
    },
    {
      "hash": "542e723c9c2d396a1da68272fae4cec762cb086f"
    },
    {
      "hash": "d002e2f5bc3da9a097ee93111ce8d69a0f59d3c5"
    },
    {
      "hash": "154eada9d3e94a0c641e60fc515a74afb736eb49"
    }
  ],
  "fileinfo": {
    "9a46e23f17864660be5f09a85fbd6842eb53ce6d": [
      {
        "name": "gxine_0.5.908-3.1.dsc",
        "archive_name": "debian-ports",
        "path": "/pool-hurd-i386/main/g/gxine",
        "first_seen": "20150303T013353Z",
        "size": 2131
      }
    ],
    "d002e2f5bc3da9a097ee93111ce8d69a0f59d3c5": [
      {
        "name": "gxine_0.5.908-3.1.dsc",
        "archive_name": "debian",
        "path": "/pool/main/g/gxine",
        "first_seen": "20141230T220552Z",
        "size": 2261
      },
      {
        "name": "gxine_0.5.908-3.1.dsc",
        "archive_name": "debian-debug",
        "path": "/pool/main/g/gxine",
        "first_seen": "20160315T212933Z",
        "size": 2261
      }
    ],
    "154eada9d3e94a0c641e60fc515a74afb736eb49": [
      {
        "name": "gxine_0.5.908-3.1.debian.tar.xz",
        "archive_name": "debian",
        "path": "/pool/main/g/gxine",
        "first_seen": "20141230T220552Z",
        "size": 12176
      },
      {
        "name": "gxine_0.5.908-3.1.debian.tar.xz",
        "archive_name": "debian-debug",
        "path": "/pool/main/g/gxine",
        "first_seen": "20160315T212933Z",
        "size": 12176
      }
    ],
    "542e723c9c2d396a1da68272fae4cec762cb086f": [
      {
        "name": "gxine_0.5.908.orig.tar.xz",
        "archive_name": "debian",
        "path": "/pool/main/g/gxine",
        "first_seen": "20140510T042022Z",
        "size": 917780
      },
      {
        "name": "gxine_0.5.908.orig.tar.xz",
        "archive_name": "debian-ports",
        "path": "/pool-hurd-i386/main/g/gxine",
        "first_seen": "20150303T013353Z",
        "size": 917780
      },
      {
        "name": "gxine_0.5.908.orig.tar.xz",
        "archive_name": "debian-debug",
        "path": "/pool/main/g/gxine",
        "first_seen": "20160315T212933Z",
        "size": 917780
      }
    ],
    "663d85e0a8895d5054fe8c1a4d2f3f66252a5cda": [
      {
        "name": "gxine_0.5.908-3.1.debian.tar.xz",
        "archive_name": "debian-ports",
        "path": "/pool-hurd-i386/main/g/gxine",
        "first_seen": "20150303T013353Z",
        "size": 12176
      }
    ]
  },
  "package": "gxine"
}

#827246#10
Date:
2021-09-22 04:21:30 UTC
From:
To:
Hello,

Good morning,

We have gone through your samples from a partner and Here is our  Order
List. Please do bear in mind that we are very much in  need of this
order, quote your competitive prices.

Kindly send the Order confirmation.

Your early reply will be much appreciated.

Best Regards,

Maryanah Erwin.

PT FINDORA INTERNUSA

Jln Pahlawan 66 Kec. Arjawinangun

45162 CIREBON West-Java INDONESIA

tel : +62 231 357334

fax: +62 231 357260

email: marketing@findora.com