[Pkg-clamav-devel] Processing of clamav_0.98.4+dfsg-1_i386.changes

[Scott Kitterman]

On July 2, 2014 12:41:00 PM EDT, Andreas Cadhalpun <andreas.cadhalpun at googlemail.com> wrote:
>Hi,
>
>On 02.07.2014 13:35, Sebastian Andrzej Siewior wrote:
>> On 2014-07-01 22:38:02 [+0200], Andreas Cadhalpun wrote:
>>>> So I am building the
>>>> get-oring thingy and was first looking why 0.98.4 isn't reported
>>>> properly. The reason is that it is missing on HEAnet mirror server
>which
>>>> is the source for the database at the [1] link you posted. I
>dropped
>>>> HEAnet an email asking wtf.
>>>
>>> Other Debian packages have the same problem and the HEAnet operators
>have
>>> already been informed [0].
>>> It turns out it was never guaranteed to work correctly.
>>
>> Ah. great. So sf.net is a pain and it is getting better and better
>every
>> day. We could wait and hope that the next release makes it to HEAnet
>and
>> just ignore it for now. Option two would be that I could come up with
>a
>> script that parses clamav.net and creates a page for uscan on
>breakpoint.cc.
>> Idea three which could be the one where the least amount is incuded:
>we switch
>> to github based tags (as the uscan man pages suggests).
>> I am in favour of the last one right now.
>
>Indeed, as the sf.net page doesn't work currently, I switched the watch
>
>file now to github.com. The downsides are:
>  * larger tarball containing more win32 and contrib files
>  * no automatic verification of signatures, as the github tarballs
>    aren't signed
>When/If sf.net works again, we can switch back.
>
>I added a Files-Excluded field to debian/copyright so that uscan 
>automatically removes a lot of useless files. The split-tarball.sh 
>script is still needed to extract libclamunrar.

Since upstream guitar is a copy of the 'real' private git repo, I wonder if we can be sure it'll always match the tarball?


Scott K