[Qa-jenkins-scm] [Git][qa/jenkins.debian.net][master] 2 commits: reproducible Debian rebuilder 'thing': more verbose output

[Holger Levsen]

Holger Levsen pushed to branch master at Debian QA / jenkins.debian.net


Commits:
b384cab5 by Holger Levsen at 2020-05-03T11:10:49+02:00
reproducible Debian rebuilder 'thing': more verbose output

Signed-off-by: Holger Levsen <holger at layer-acht.org>

- - - - -
26bf92ba by Holger Levsen at 2020-05-03T11:10:49+02:00
reproducible Debian rebuilder 'thing': don't try to verify the sources, this should be done by debrebuild using the checksums from the .buildinfo file

Signed-off-by: Holger Levsen <holger at layer-acht.org>

- - - - -


1 changed file:

- bin/reproducible_debian_rebuilder_prototype.sh


Changes:

=====================================
bin/reproducible_debian_rebuilder_prototype.sh
=====================================
@@ -89,7 +89,7 @@ BINARY_VERSION="$(echo $FILE | cut -d '_' -f2)"
 POOLPATH=""            # declared as a global variable
 set_poolpath $PKG      # so we can set it here with a function
 FTPMASTERPATH="$(echo $BUILTINPHOPATH | cut -d '/' -f2-4)"
-URLPATH="https://buildinfos.debian.net/ftp-master.debian.org/buildinfo/$FTPMASTERPATH/"
+URLPATH="https://buildinfos.debian.net/ftp-master.debian.org/buildinfo/$FTPMASTERPATH"
 
 if [ "$VERSION" != "$BINARY_VERSION" ] ; then
 	output_echo "Warning: .buildinfo files known for $PKG and $VERSION is $URL_PATH/$FILE this indicates a binNMU because $VERSION != $BINARY_VERSION..."
@@ -128,12 +128,15 @@ cp $FILE $FILE.orig
 # download the source early to fail early if it's not available...
 # I guess I think it would be nice if debrebuild would also do this:
 # FIXME: file another wishlist bug?
-output_echo "fetching source package $PKG"
-dget https://deb.debian.org/debian/pool/main/$POOLPATH/$PKG/${PKG}_$VERSION.dsc
+output_echo "fetching source package $PKG ($VERSION)"
+# just download the source, don't verify it. (keys will expire and be removed from the keyrings)
+# FIXME: we should verify the downloaded source matches the ones described in .buildinfo file, thus indeed it would be cool if debrebuild would download and verify the source. -> file another wishlist bug.
+dget https://deb.debian.org/debian/pool/main/$POOLPATH/$PKG/${PKG}_$VERSION.dsc || echo "Warning: failed to verify signature, continueing anyway."
+
 
 # prepare rebuild command
 DEBREBUILD=$(mktemp -t debrebuild-cmd.XXXXXXXX)
-output_echo "trying to debrebuild $PKG"
+output_echo "trying to debrebuild $PKG ($BINARY_VERSION), which means building instructions how to re-create the build environment as specified in $URLPATH/$FILE"
 # workaround until devscripts 2.20.3 is released
 /srv/jenkins/bin/rb-debrebuild $FILE 2>&1 | tee $DEBREBUILD
 



View it on GitLab: https://salsa.debian.org/qa/jenkins.debian.net/-/compare/4d53cdede89897fd2ae74aa42edfc8de3fd3c8cd...26bf92ba5d32a7cebe0dcddbb28174d7bd4b9e4c

-- 
View it on GitLab: https://salsa.debian.org/qa/jenkins.debian.net/-/compare/4d53cdede89897fd2ae74aa42edfc8de3fd3c8cd...26bf92ba5d32a7cebe0dcddbb28174d7bd4b9e4c
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/qa-jenkins-scm/attachments/20200503/21768419/attachment-0001.html>