Package: git-buildpackage
Version: 0.9.9
Severity: wishlist

Hi,

I recently ran into a bug in pristine-tar [1], which means at least for
the systemd package we can no longer use pristine-tar for the time
being.

Imho it would be really useful  if gbp in the absence of pristine-tar,
would pull the tarball from the Debian archive or the upstream location
instead of generating an orig.tar.gz on the fly (which most likely will
not have the same md5sum as the one currently in the archive).

E.g. I have now explicitly turned off pristine-tar in gbp.conf for
systemd, and if I have removed the orig.tar.gz from my build/tarball
directory, so now I get:

$ gbp buildpackage
gbp:info: Tarballs 'systemd_239.orig.tar.gz' not found at '../tarballs/'
gbp:info: Creating systemd_239.orig.tar.gz from 'upstream/239'

Regards,
Michael

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902115

Hi Michael,

I agree that having upstream tarballs should be simple. If pristine-tar
can't be used we create the tarball as you noted but that tarball should
have the same checksum when being created so if you're using gbp all the
way there shouldn't be a problem.

I don't disagree that we might want to fallback to fetching from the
archive in certain situations like:

1.) create tarballs with stable checksums via either pristine-tar or by
    gbp
2.) verify checksum against the archive (or preferably against a
    checksum stored with the source tree so we have everything contained
    in the git archive)
3.) fetch if it doesn't match

1.) is already there 2.) would need to be done before we do 3.). Patches
for that would be welcome.

Does gbp not create a stable checksum when building tarballs for you?
That would be a different bug.
Cheers,
 -- Guido

Hi Guido

Am 25.06.2018 um 10:18 schrieb Guido Günther:


Well, it certainly creates a different checksum then the tarball I got
from upstream

upstream tarball
6137e3f50390391cf34521d071a1a078  systemd_239.orig.tar.gz

gbp generated orig.tar.gz
8b966f3da570b5fac91c830d04267315  systemd_239.orig.tar.gz



Regards,
Michael

Hi,

Yeah, that's expected but it should be the same on every run.
Cheers,
 -- Guido

Hi,
fetch orig tarballs from the archive (I hoped we could stay out of that
business in 2018 but since tarballs are still _the_ _thing_ in Debian
we should support fetching them from the archive when pristine-tar fails
so that building packages is not more trouble than necessary).

Cheers,
 -- Guido

In the Salsa CI pipeline, if git-buildpackage fails to fetch the
upstream tarball for whatever reason (git repository broken, missing
branches, pristine-tar mismatch) it will fall back to run the
origtargz command:
https://manpages.debian.org/unstable/devscripts/origtargz.1.en.html

I would be careful in not having too much automation in case of
pristine-tar failures. The person encountering them might be
uncovering a true mismatch and the package history/sources might need
to be audited to discover what/when wrong version was introduced.

If it is a true bug in pristine-tar, it should be reported to
pristine-tar and get fixed.