#980233 uscan: please allow for non-GPG signature verification mechanisms

Package:
devscripts
Source:
devscripts
Description:
scripts to make the life of a Debian Package maintainer easier
Submitter:
Ryan Kavanagh
Date:
2021-01-16 16:36:02 UTC
Severity:
wishlist
#980233#5
Date:
2021-01-16 14:35:55 UTC
From:
To:
Please allow users to specify arbitrary scripts to verify upstream
release tarballs. For example, the OpenSMTPD and OpenBSD projects use
signify-openbsd (from the signify-openbsd package) instead of GnuPG to
verify their releases.

For example, to verify
https://opensmtpd.org/archives/opensmtpd-6.8.0p2.tar.gz
one goes:

rak@zeta:/tmp$ wget --quiet https://opensmtpd.org/archives/opensmtpd-20181026.pub
# (In principle, you should already have saved the public key
# opensmtpd-20181026.pub somewhere and verified it out of band.)
rak@zeta:/tmp$ wget --quiet https://opensmtpd.org/archives/opensmtpd-6.8.0p2.tar.gz
rak@zeta:/tmp$ wget --quiet https://opensmtpd.org/archives/opensmtpd-6.8.0p2.sum.sig
rak@zeta:/tmp$ signify-openbsd -C -p opensmtpd-20181026.pub -x
opensmtpd-6.8.0p2.sum.sig
Signature Verified
opensmtpd-6.8.0p2.tar.gz: OK
--- /etc/devscripts.conf ---
Empty.

--- ~/.devscripts ---
Not present
#980233#8
Date:
2021-01-16 16:32:06 UTC
From:
To:
I suppose that's a fine feature to add, however keep in mind that the
upstrem gpg signatures have a much wider support, including in dpkg
itself.
Perhaps you may wish to start a broader discussion about this topic and
get dpkg & friends onboard?