[Pkg-clamav-devel] Processing of clamav_0.98.4+dfsg-1_i386.changes

[Sebastian Andrzej Siewior]

On 2014-07-02 21:03:36 [+0200], Andreas Cadhalpun wrote:
> Hi Scott,
> 
> On 02.07.2014 20:05, Scott Kitterman wrote:
> >On July 2, 2014 12:41:00 PM EDT, Andreas Cadhalpun <andreas.cadhalpun at googlemail.com> wrote:
> >>Indeed, as the sf.net page doesn't work currently, I switched the watch
> >>file now to github.com. The downsides are:
> >>  * larger tarball containing more win32 and contrib files

Some of the win32 files are removed by the split script so I wouldn't
bother. Not sure about the contrib stuff.

> >>  * no automatic verification of signatures, as the github tarballs
> >>    aren't signed
okay.

> >>When/If sf.net works again, we can switch back.
> >>
> >>I added a Files-Excluded field to debian/copyright so that uscan
> >>automatically removes a lot of useless files. The split-tarball.sh
> >>script is still needed to extract libclamunrar.
> >
> >Since upstream guitar is a copy of the 'real' private git repo, I wonder if we can be sure it'll always match the tarball?
> 
> Well, currently the tarball from github.com just contains some more files
> than the tarball from sourceforge.net, which doesn't do any harm.

Seriously? No wonder it takes them so long to create a new release if
they manually create the tarballs :) I will try ping upstream later
about this. Maybe they can manage to sign their tags. Then we have to worry
about the extra files. Unless ofcourse they host their files on
clamav.net which would solve the problem once for all :)

> And as long as sf.net doesn't work, I think this is better than effectively
> not having a watch file.

Even if the next release makes it t HEAnet, there is no guarantee that
release after will make it.

> Best regards,
> Andreas

Sebastian