[Pkg-clamav-devel] Processing of clamav_0.98.4+dfsg-1_i386.changes

[Sebastian Andrzej Siewior]

On 2014-07-02 23:12:01 [+0200], Andreas Cadhalpun wrote:
> Hi Sebastian,
Hi Andreas,

> Now uscan removes both contrib and win32 directories, so that's not the
> problem. It's rather that the originally downloaded tarball is now nearly 40
> MB instead of the 15 MB tarball from sourceforge.
> There are also various .gitignore files, which would interfere with our own
> usage of git, so I added them to Files-Excluded as well.

I wouldn't mind the initial download.

> The contrib folder contains many things, e.g. a (probably out of date)
> version of our split-tarball.sh. :)
hehe.

> The additional files/directories are:
>  * .gitignore files (and a .gitattributes)
>  * contrib directory
>  * additional Doxygen files
>  * config/test-driver
>  * libclamav/7z/lzma.diff (not sure what that's for)
>  * additional subdirectories in libclamav/c++/llvm
>    (but we don't care, as we remove it entirely)
>  * libclamav/c++/TODO.CLAMAV
>  * libclamav/c++/merge.sh
>  * libclamav/c++/strip-llvm.sh
>  * libclamav/tomsfastmath/mont/fp_mont_small.i
>  * libclamav/tomsfastmath/numtheory/fp_gcd.c
>  * libclamav/tomsfastmath/numtheory/fp_isprime.c
>  * libclamav/tomsfastmath/numtheory/fp_lcm.c
>  * libclamav/tomsfastmath/numtheory/fp_prime_miller_rabin.c
>  * libclamav/tomsfastmath/numtheory/fp_prime_random_ex.c
>  * libclamav/tomsfastmath/LICENSE
>  * llvm directory
>  * m4/reorganization/libs/libconfig.m4
>  * unit_tests/duma_tests.sh
>  * unit_tests/efence_tests.sh
>  * unit_tests/valgrind_tests.sh
>  * win32/clamav-for-windows (75 MB due to embedded wxWidgets)
>  * autojunk.sh
> 
> And it doesn't contain:
>  * libclamav/version.h
> 
> I don't know why they modify their release tarball in this way, but I don't
> think it makes much difference for us.

Ah. One reason might be that they do "make dist" and autoconf creates
the tarball. If the extra files (say fp_gcd.c) is not refrenced in
Makefile then it won't be added to the final tarball.

> >I will try ping upstream later about this.
> 
> Thanks. Maybe they can sync their repo and their release tarball contents a
> bit more.
> 
> >Maybe they can manage to sign their tags.
> 
> That would be good, although I don't know if uscan can verify signed tags.
> Or would there be detached signatures on the download page?

Argh, right. No, it would be part of the tag. So it wouldn't be of any
use for use then :P

> Best regards,
> Andreas

Sebastian