Intend to update gnome-authenticator 3.32.2 to 4.3.1

[Axel Kittenberger <axel.kittenberger@univie.ac.at>]

Hello mentors,

the application "gnome-authenticator"

  debian: https://packages.debian.org/sid/main/gnome-authenticator
  upstream: https://gitlab.gnome.org/World/Authenticator

is pretty out of date (3.32.2 vs 4.3.1) and has basic functionality bugs 
for me (token delay too big, 2F-auth does not working)

thus I intent to get the package updated.

Note that 4.x series has been a complete rewrite from upstream. 
Previously it was a Python App, now it is Rust.

Question 1) So one thing that likely has to be done is to move the 
responsibility from the Debian Python Team to the Debian Gnome Team (the 
Rust team suggests they are only responsible for crates not for in Rust 
written apps). Dunno how to best approach this?

Note the mailing address of the most active uploader so far, 
Henry-Nicolas Tourneur <debian@nilux.be> unfortunally gets an error for 
me. So I guess no help from there :(

Question 2) The upgrade from 3.x to 4.x erases the user database, 
upstream has no automatic conversation, nor a conversation procedure:

https://gitlab.gnome.org/World/Authenticator/-/issues/385

So I suggest the upgrade should give one of these warning/information 
breaking-changes messages when doing an `apt dist-upgrade`. How do I do 
this in the package format?

(Upstream suggested to instead deprecate the old package and make a new 
package name, but IMO this would be confusing for users, also the name 
of the app didn't change)

Question 3) Taking the old package as base and after setting up sbuild 
modifying it, I currently have following control file:

--- debian/control ---

Source: gnome-authenticator
Section: gnome
Priority: optional
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Uploaders: Henry-Nicolas Tourneur <debian@nilux.be>,
           Axel Kittenberger <axel.kittenberger@univie.ac.at>
Build-Depends: cargo:native,
               debhelper-compat (= 13),
               desktop-file-utils,
               dh-cargo,
               libadwaita-1-dev,
               libglib2.0-dev,
               libgdk-pixbuf2.0-dev,
               libgtk-4-dev,
               libgstreamer1.0-dev,
               libgstreamer-plugins-base1.0-dev,
               libgstreamer-plugins-bad1.0-dev,
               librust-crates-io-dev,
               libzbar-dev,
               meson,
               rustc:native,
Standards-Version: 4.6.1
Rules-Requires-Root: no
Homepage: https://gitlab.gnome.org/World/Authenticator
Vcs-Browser: 
https://salsa.debian.org/python-team/packages/gnome-authenticator
Vcs-Git: 
https://salsa.debian.org/python-team/packages/gnome-authenticator.git

Package: gnome-authenticator
Architecture: all
Depends: libadwaita-1,
         libglib2.0,
         libgdk-pixbuf2.0,
         libgtk-4,
         libgstreamer1.0,
         libgstreamer-plugins-base1.0,
         libgstreamer-plugins-bad1.0,
         libzbar,
         ${misc:Depends},
Description: TOTP authentication app for the GNOME Desktop
 Authenticator is a GTK3 application for the GNOME desktop, featuring:
  - QR code scanner
  - Beautiful UI
  - Huge database of more than 560 supported services
  - Keep your PIN tokens secure by locking the application with a password
  - Automatically fetch an image for services using their favicon
  - The possibility to add new services
---

I get following error:

[43/46] /usr/bin/glib-compile-resources ../data/resources.gresource.xml 
--sourcedir ../data --internal --generate --target 
data/authenticator.gresource --dependency-file 
data/authenticator.gresource.d
xml-stripblanks preprocessing requested, but XMLLINT is not set, and 
xmllint is not in PATH
[43/46] /usr/bin/env 
CARGO_HOME=/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/cargo-home 
/usr/bin/cargo build --manifest-path /<<PKGBUILDDIR>>/Cargo.toml 
--target-dir /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/src --release && cp 
src/release/authenticator src/authenticator
    Updating crates.io index
error: failed to get `favicon-scrapper` as a dependency of package 
`authenticator v4.3.1 (/<<PKGBUILDDIR>>)`

Caused by:
  failed to load source for dependency `favicon-scrapper`

Caused by:
  Unable to update registry `crates-io`

Caused by:
  failed to fetch `https://github.com/rust-lang/crates.io-index`

Caused by:
  network failure seems to have happened
  if a proxy or similar is necessary `net.git-fetch-with-cli` may help here
https://doc.rust-lang.org/cargo/reference/config.html#netgit-fetch-with-cli

Caused by:
  the SSL certificate is invalid: 0x08 - The certificate is not 
correctly signed by the trusted CA; class=Ssl (16); code=Certificate (-17)
---

Albeit it complains about SSL I guess fixing SSL is not the right way to 
go, as far I understand sbuild should not depend on any downloads 
outside of the debian ecosystem, right?

In upstreams Cargo.toml file they have:

  favicon-scrapper = {path = "./favicon-scrapper"}

So it's a local cargo in the upstream sources. I'm a bit stumped here 
how to stop dh_auto_build trying to download a create it should find and 
compile in the local source tree? (Without sbuild using debuild of the 
whole package in a trixie installation it works)

Kind regards, Axel

Attachment: OpenPGP_0x7AC320FF153B3A9D.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature
Description: OpenPGP digital signature