Bug#869184: dpkg: source uploads including _amd64.buildinfo cause problems

[Salvatore Bonaccorso]

Hi Daniel,

On Sun, Jun 16, 2019 at 01:49:24PM -0400, Daniel Kahn Gillmor wrote:
> On Sun 2019-06-16 15:50:55 +0200, Ivo De Decker wrote:
> > As "--changes-option=-S" creates an upload that is broken from the point of
> > view of the archive, it might make sense not to recommend (or even allow) this
> > for now. Just building with "-S" instead should create a buildinfo file with
> > _source, which won't trigger this issue.
> 
> For the rest of the regular archive, --changes-option=-S is definitely
> *not* broken.  I use that regularly, and strongly prefer it.  It allows
> me to document what i managed to build, while still ensuring that the
> distributed binaries are created by debian's buildd network, and not my
> own machinery.
> 
> I would be pretty sad if --changes-option=-S was explicitly deprecated
> in any part of the debian archive.

This behaviour is really causing issues for the security-archive so in
one way or the other there needs to be a solution. Regularly we need
to fetch the buildd changes and build binary packages, resign them and
reupload them due to this bug.

Prefered for us would defintively to find a solution though which does
not mean the need to disable source only uploads for security-master,
that IMHO would be a read drawback.

That said, sorry it looks I'm repeating myself, but I wanted to
express again that this causes real issues for the work on releasing
security-updates via the security archive.

Regards,
Salvatore