Bug#1141236: --source-only-changes includes a (source + binary) $ARCH.buildinfo file

[Johannes Schauer Marin Rodrigues]

Hi,

Quoting Stefano Rivera (2026-07-01 22:19:01)
> When people generate source-only uploads with "sbuild --source-only-changes",
> the _source.changes file includes an _amd64.buildinfo file (for example).
> This would then fail to merge with an _amd64.buildinfo file from the amd64
> binary build, that would include an identically named buildinfo file with
> likely different contents.
> 
> See: https://salsa.debian.org/freexian-team/debusine/-/work_items/1488
> 
> The Debian archive doesn't seem to care about this, at present. But it 
> also doesn't actually do anything with .buildinfo files itself, it 
> pushes them all off to buildinfos.debian.net. I don't see any special 
> handling in there, so I don't know if these are handled or thrown away. 
> Reproducible Builds people CCed.
> 
> Debusine took the stance of dissallowing .buildinfo files that are not 
> named _source.buildinfo, in source-only uploads. I stand by that choice, 
> but obviously it has some impact for users who were using toolchains 
> that produced such things.
> 
> I would suggest that when called with --source-only-changes, sbuild copy 
> the .buildinfo file to _source.buildinfo and include *that* in the 
> _source.changes instead.
> 
> pbuilder has the same issue, I'll file a similar bug there.

the command which includes the *_${BUILD_ARCH}.changes into *_source.changes is
"dpkg-genchanges --build=source".

I think that a *_source.changes *should* include a *_${BUILD_ARCH}.changes
because the architecture-specific buildinfo file serves as a proof that build
artifacts *were* produced and then we apply the existing naming rules for
buildinfo files to that (using the $DEB_BUILD_ARCH in the filename).

What are you using to merge the .changes files? I regularly use the
mergechanges tool from devscripts to merge a *_source.changes with a
*_${BUILD_ARCH}.changes just fine.

In any case, I don't think sbuild should have much of a say in the naming. If
you want to change the naming then I think that change has to happen in dpkg
(and of course in collaboration with the reproducibile builds team). This would
also mean that you don't have to file a bug against every package builder out
there (like for pbuilder as you suggested).

If you agree, please re-assign this bug to dpkg.

Thanks!

cheers, josch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: signature
URL: <http://alioth-lists.debian.net/pipermail/reproducible-builds/attachments/20260701/05c85b19/attachment.sig>