Package: git-buildpackage
Version: 0.8.4
Severity: wishlist

Dear Maintainer,

`gpg import-orig --upstream-vcs-tag` provides a nice way to preserve the
upstream VCS tree up to the most recent tag.  However, signed upstream
tags, when present, are currently not verified.  It would be nice to
provide an option for automatic tag verification using the armored
keyring from debian/upstream/signing-key.asc, to match uscan(1)
signature verification logic.

In cases where upstream generates tarballs based on VCS tags,
maintainers could then easily avoid downloading upstream tarballs
altogether while 1/ preserving the upstream VCS tree, and 2/ still being
able to ensure upstream code integrity.

Thanks for maintaining gbp!

That makes a lot of sense. I'm not a heavy --upstream-vcs-tag user so
tested patches (preferably with a testcase [1]) would be nice!
Cheers,
 -- Guido

[1]: a simple test in tests/component would be sufficient to test this
behaviour at all

This is a comment to both
Bug#839866 import-orig: please make --upstream-vcs-tag=... verify tag signatures
Bug#980927 import-ref: Check tag signatures

The function to verify git tags is already in
https://salsa.debian.org/agx/git-buildpackage/-/commit/07b86440438286a03ffa7b314534f9bbb3d0a805
but it is currently not being used anywhere.

I wish that gbp import-ref and gbp import-orig *if*
gbp.conf:upstrem-vcs-tag would automatically attempt to run `git
verify-tag` and emit a warning if the upstream signature does not have
a signature, encouraging Debian maintainers to ask upstream to start
using signed git tags.

When the upstream tag does have a signature, gbp would emit a warning
if the tag wasn't signed with `debian/upstream/signing-key.asc`.

Additionally, there should be a new config option
`upstream-git-signatures`, which if set would make the warnings errors
and refuse to import if tag was not signed, or the key didn't match.

In some cases the `debian/upstream/signing-key.asc` might be a release
CI key, while the git tags might be signed by individual authors. Thus
we might also need to support something like
`debian/upstream/signing-keyring.asc` that has all valid upstream
release tag authors.

Otto Kekäläinen <otto@debian.org> writes:

+1

I think upstream tag signature verification failures should be an error,
not a warning.  That would be consistent with uscan, doesn't it also
fail on pgp key signature failures?

I believe signing-key.asc can contain multiple keys already.

/Simon

Hi,

Yes, that is what I tried to mean with what I wrote above :)
Opportunistically check everything and warn if they things are
missing, and when told via gbp.conf what to expect from upstream, then
enforce it and abort imports if requirements not met.

Yes, most of the time, but if gbp.conf:upstream-signatures=on is used
it can to enforce that no imports can happen without downloading the
signature. We should encourage people to use a gbp.conf and not rely
on if a maintainer happens to remember to pass a certain flag to gbp
or uscan or not.

Probably, but I feel a little bit at unease of mixing "official"
release signing keys with upstream author personal keys (what is
typically used for signing tags).

There seems to be 3 bug reports about checking upstream release tag signatures:

Bug#839866 import-orig: please make --upstream-vcs-tag=... verify tag signatures
Bug#871806: uscan: (dpkg, git-buildpackage) accept/mangle/store signed
git tags in cases where upstream does not publish detached sigs on
tarballs
Bug#980927 import-ref: Check tag signatures