[pkg-gnupg-maint] Trouble uploading libgpg-error 1.43-2 [was: Re: Accepted libgpg-error 1.43-1 (source) into unstable]

[Daniel Kahn Gillmor]

Hi Christoph and other folks interested in packaging GnuPG for debian--

I'm having difficulty uploading 1.43-2 of libgpg-error.  This message
tries to document what the problem is, even though i haven't sorted out
how to fix it yet.

On Sun 2021-12-19 18:19:40 +0000, Debian FTP Masters wrote:
> Source: libgpg-error
> Architecture: source
> Version: 1.43-1
> Distribution: unstable
> Urgency: medium
> Maintainer: Debian GnuPG Maintainers <pkg-gnupg-maint at lists.alioth.debian...org>
> Changed-By: Christoph Biedl <debian.axhn at manchmal.in-ulm.de>
> Changes:
>  libgpg-error (1.43-1) unstable; urgency=medium
>  .
>    * New upstream release 1.43
[…]
> Checksums-Sha256:
>  a20196b17ca56e4aeef2701b6fdc1e5a264fc7989a2e0a4262621d2cc283ecff 2616 libgpg-error_1.43-1.dsc
>  a9ab83ca7acc442a5bd846a75b920285ff79bdb4e3d34aa382be88ed2c3aebaf 999006 libgpg-error_1.43.orig.tar.bz2
>  6afd5a5dbe6ffcbcdb5a85c3b3747d009fdd17024aef49bd2115edfe96eff220 19016 libgpg-error_1.43-1.debian.tar.xz
>  d9f5cf1e14318a6967c38bf510cd0214566b9c1c99730a7e2896c04ababf17d4 8945 libgpg-error_1.43-1_powerpc.buildinfo

I just tried to upload 1.43-2 (fixing #1003313 with a cherry-picked
commit from upstream) and i'm running into trouble getting it uploaded,
because i'm trying to upload with the upstream signature
(libgpg-error_1.43.orig.tar.bz2.asc) but the archive doesn't know
anything about that file.

Typically, when a new version is uploaded, we want the original tarball
uploaded with the upstream signature alongside it.

I still haven't succeeded in getting the upload to be accepted by dak as
a result.

I tracked this down with the help of themill and hephaistor over on
#debian-ftp:

00:31 < dkg> i'm seeing
             20220114050430|process-upload|dak|REJECT|libgpg-error_1.43-2_amd64.changes
             in coccia:/srv/ftp-master.debian.org/log/current -- but i
             don't know why it's being REJECTed (there is no feedback to
             me that i can tell).  how can i get more information about
             what's going wrong?
00:34 < themill> dkg: «libgpg-error_1.43-2.dsc: Refers to non-existing
                 file 'libgpg-error_1.43.orig.tar.bz2.asc'»

00:35 < themill> dkg: you can see that (plus a bit more) in
                 /srv/ftp-master.debian.org/queue/reject/libgpg-error_1.43-2_amd64.changes.reason
00:38 < dkg> themill: thank you for the pointer!  so it looks like the
             original upload didn't include the upstream signature
00:39 < dkg> normally i wouldn't do an upload that includes the
             upstream source of a package with a -2  version
00:40 < dkg> i guess that's how to fix it though
00:48 < themill> or not include the .asc file in the -2 upload anywhere
00:49 < dkg> not sure why i'd want to not include the .asc -- always
             better for the archive to have a copy of upstream's signature
00:50 < themill> sure, I suspect that if you include the .tar.bz2 in the
                 .changes you'll get another reject because that file is
                 already in the archive 
00:51 < dkg> we'll see
00:51 < dkg> seems silly for the archive to reject a file that it
             already has accepted
00:52 < dkg> especially if the file is the same, byte-for-byte
00:54 < themill> It would have to have a hissy fit if the file were
                 different; yes, it might be reasonable to just carry on
                 if the file were identical
00:54 < hephaistor> just include the .asc but not the .bz2
00:54 < hephaistor> do with -sa then edit the .changes before signing
00:56 < themill> indeed. editing the .changes file always makes me sad
00:56 < themill> (and if you get it wrong, ansgar will complain when you
                  broke dak)
00:58 < dkg> yes, i don't want to make ansgar sad either


For future uploads of new upstream versions, please remember to include
the upstream signature!

(i'll try to sort out fiddling with the .changes to get this upload to work,
but i'm out of time for it this evening)

    --dkg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/attachments/20220114/a7fcce96/attachment.sig>