Hi,
While playing around with uscan, I found that using both
'--skip-signature' and '--force-download' nullifies the effect of
'--force-download'.
For example:
---------------------------------------------------------------------
emiliano@zapata:~/git/foo/firmware-tomu$ uscan --force-download --verbose
uscan info: uscan (version 2.19.2) See uscan(1) for help
uscan info: Scan watch files in .
uscan info: Check debian/watch and debian/changelog in .
uscan info: package="firmware-tomu" version="2.0~rc7-1" (as seen in
debian/changelog)
uscan info: package="firmware-tomu" version="2.0~rc7" (no epoch/revision)
uscan info: Check debian/watch and debian/changelog in
./.git/logs/refs/remotes/origin
uscan info: Check debian/watch and debian/changelog in
./.git/logs/refs/heads
uscan info: Check debian/watch and debian/changelog in
./.git/refs/remotes/origin
uscan info: Check debian/watch and debian/changelog in ./.git/refs/heads
uscan info: ./debian/changelog sets package="firmware-tomu"
version="2.0~rc7"
uscan info: Process watch file at: debian/watch
package = firmware-tomu
version = 2.0~rc7
pkg_dir = .
uscan info: opts:
filenamemangle=s/.+\/v?(\d\S+)\.tar\.gz/firmware-tomu-$1\.tar\.gz/,uversionmangle=s/(\d)[_\.\-\+]?((RC|rc|pre|dev|beta|alpha)\d*)$/$1~$2/
uscan info: line: https://github.com/im-tomu/tomu-bootloader/tags
.*/v?(\d[\d\.\-rc]+)\.tar\.gz
uscan info: Parsing
filenamemangle=s/.+\/v?(\d\S+)\.tar\.gz/firmware-tomu-$1\.tar\.gz/
uscan info: Parsing
uversionmangle=s/(\d)[_\.\-\+]?((RC|rc|pre|dev|beta|alpha)\d*)$/$1~$2/
uscan info: line: https://github.com/im-tomu/tomu-bootloader/tags
.*/v?(\d[\d\.\-rc]+)\.tar\.gz
uscan info: Last orig.tar.* tarball version (from debian/changelog): 2.0~rc7
uscan info: Last orig.tar.* tarball version (dversionmangled): 2.0~rc7
uscan info: Requesting URL:
https://github.com/im-tomu/tomu-bootloader/tags
uscan info: Matching pattern:
(?:(?:https://github.com)?\/im\-tomu\/tomu\-bootloader\/tags)?.*/v?(\d[\d\.\-rc]+)\.tar\.gz
uscan info: Found the following matching hrefs on the web page (newest
first):
/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz (2.0~rc7)
index=2.0~rc7-1
/im-tomu/tomu-bootloader/archive/v2.0-rc6.tar.gz (2.0~rc6)
index=2.0~rc6-1
/im-tomu/tomu-bootloader/archive/v2.0-rc5.tar.gz (2.0~rc5)
index=2.0~rc5-1
/im-tomu/tomu-bootloader/archive/v2.0-rc4.tar.gz (2.0~rc4)
index=2.0~rc4-1
/im-tomu/tomu-bootloader/archive/v2.0-rc3.tar.gz (2.0~rc3)
index=2.0~rc3-1
/im-tomu/tomu-bootloader/archive/v2.0-rc2.tar.gz (2.0~rc2)
index=2.0~rc2-1
/im-tomu/tomu-bootloader/archive/v2.0-rc1.tar.gz (2.0~rc1)
index=2.0~rc1-1
uscan info: Looking at $base =
https://github.com/im-tomu/tomu-bootloader/tags with
$filepattern = .*/v?(\d[\d\.\-rc]+)\.tar\.gz found
$newfile = /im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
$newversion = 2.0~rc7 which is newer than
$lastversion = 2.0~rc7
uscan info: Matching target for downloadurlmangle:
https://github.com/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
uscan info: Upstream URL(+tag) to download is identified as
https://github.com/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
uscan info: Matching target for filenamemangle:
/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
uscan info: Filename (filenamemangled) for downloaded file:
firmware-tomu-2.0-rc7.tar.gz
uscan info: Newest version of firmware-tomu on remote site is 2.0~rc7,
local version is 2.0~rc7
uscan info: => Package is up to date for from
https://github.com/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
uscan info: => Forcing download as requested
uscan info: Downloading upstream package: firmware-tomu-2.0-rc7.tar.gz
uscan info: Requesting URL:
https://github.com/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
uscan info: Successfully downloaded package: firmware-tomu-2.0-rc7.tar.gz
uscan info: Start checking for common possible upstream OpenPGP
signature files
uscan info: End checking for common possible upstream OpenPGP signature
files
uscan info: Missing OpenPGP signature.
uscan info: New orig.tar.* tarball version (oversionmangled): 2.0~rc7
uscan info: Launch mk-origtargz with options:
--package firmware-tomu --version 2.0~rc7 --compression default
--directory .. --copyright-file debian/copyright
../firmware-tomu-2.0-rc7.tar.gz
Successfully repacked ../firmware-tomu-2.0-rc7.tar.gz as
../firmware-tomu_2.0~rc7.orig.tar.xz, deleting 11 files from it.
uscan info: New orig.tar.* tarball version (after mk-origtargz): 2.0~rc7
uscan info: Scan finished
---------------------------------------------------------------------
The upstream package is downloaded and repacked as intended. Now with
'--skip-signature':
---------------------------------------------------------------------
emiliano@zapata:~/git/foo/firmware-tomu$ uscan --force-download
--skip-signature --verbose
uscan info: uscan (version 2.19.2) See uscan(1) for help
uscan info: Scan watch files in .
uscan info: Check debian/watch and debian/changelog in .
uscan info: package="firmware-tomu" version="2.0~rc7-1" (as seen in
debian/changelog)
uscan info: package="firmware-tomu" version="2.0~rc7" (no epoch/revision)
uscan info: Check debian/watch and debian/changelog in
./.git/logs/refs/remotes/origin
uscan info: Check debian/watch and debian/changelog in
./.git/logs/refs/heads
uscan info: Check debian/watch and debian/changelog in
./.git/refs/remotes/origin
uscan info: Check debian/watch and debian/changelog in ./.git/refs/heads
uscan info: ./debian/changelog sets package="firmware-tomu"
version="2.0~rc7"
uscan info: Process watch file at: debian/watch
package = firmware-tomu
version = 2.0~rc7
pkg_dir = .
uscan info: opts:
filenamemangle=s/.+\/v?(\d\S+)\.tar\.gz/firmware-tomu-$1\.tar\.gz/,uversionmangle=s/(\d)[_\.\-\+]?((RC|rc|pre|dev|beta|alpha)\d*)$/$1~$2/
uscan info: line: https://github.com/im-tomu/tomu-bootloader/tags
.*/v?(\d[\d\.\-rc]+)\.tar\.gz
uscan info: Parsing
filenamemangle=s/.+\/v?(\d\S+)\.tar\.gz/firmware-tomu-$1\.tar\.gz/
uscan info: Parsing
uversionmangle=s/(\d)[_\.\-\+]?((RC|rc|pre|dev|beta|alpha)\d*)$/$1~$2/
uscan info: line: https://github.com/im-tomu/tomu-bootloader/tags
.*/v?(\d[\d\.\-rc]+)\.tar\.gz
uscan info: Last orig.tar.* tarball version (from debian/changelog): 2.0~rc7
uscan info: Last orig.tar.* tarball version (dversionmangled): 2.0~rc7
uscan info: Requesting URL:
https://github.com/im-tomu/tomu-bootloader/tags
uscan info: Matching pattern:
(?:(?:https://github.com)?\/im\-tomu\/tomu\-bootloader\/tags)?.*/v?(\d[\d\.\-rc]+)\.tar\.gz
uscan info: Found the following matching hrefs on the web page (newest
first):
/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz (2.0~rc7)
index=2.0~rc7-1
/im-tomu/tomu-bootloader/archive/v2.0-rc6.tar.gz (2.0~rc6)
index=2.0~rc6-1
/im-tomu/tomu-bootloader/archive/v2.0-rc5.tar.gz (2.0~rc5)
index=2.0~rc5-1
/im-tomu/tomu-bootloader/archive/v2.0-rc4.tar.gz (2.0~rc4)
index=2.0~rc4-1
/im-tomu/tomu-bootloader/archive/v2.0-rc3.tar.gz (2.0~rc3)
index=2.0~rc3-1
/im-tomu/tomu-bootloader/archive/v2.0-rc2.tar.gz (2.0~rc2)
index=2.0~rc2-1
/im-tomu/tomu-bootloader/archive/v2.0-rc1.tar.gz (2.0~rc1)
index=2.0~rc1-1
uscan info: Looking at $base =
https://github.com/im-tomu/tomu-bootloader/tags with
$filepattern = .*/v?(\d[\d\.\-rc]+)\.tar\.gz found
$newfile = /im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
$newversion = 2.0~rc7 which is newer than
$lastversion = 2.0~rc7
uscan info: Matching target for downloadurlmangle:
https://github.com/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
uscan info: Upstream URL(+tag) to download is identified as
https://github.com/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
uscan info: Matching target for filenamemangle:
/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
uscan info: Filename (filenamemangled) for downloaded file:
firmware-tomu-2.0-rc7.tar.gz
uscan info: Newest version of firmware-tomu on remote site is 2.0~rc7,
local version is 2.0~rc7
uscan info: => Package is up to date for from
https://github.com/im-tomu/tomu-bootloader/archive/v2.0-rc7.tar.gz
uscan info: => Forcing download as requested
uscan info: Scan finished
---------------------------------------------------------------------
The upstream package isn't downloaded.
I've attached my watch file and my copyright file (I'm using
File-Excluded). If you need more context, the package I'm working on can
be found here:
https://salsa.debian.org/debian/firmware-tomu/
I've marked this as important since 'uscan --verbose
--download-current-version --force-download --rename --skip-signature'
is the default command used by the Salsa CI Team's default gbp CI pipeline.
If you think it isn't that high a severity, please feel free to
downgrade it.
Cheers!