Pristine source from upstream VCS repository

[Ben Finney <ben+debian@benfinney.id.au>]

Howdy all,

A Debian source package is constructed from a “pristine source”
tree, plus Debian-specific changes. The pristine source is usually the
tarball distributed by the upstream developer of the work.

The ‘uscan’ tool, as configured by the ‘debian/watch’ file in the
source package, allows assurance that every Debian user can get the
same pristine source, for as long as it's available from the same
upstream location — but only if it's available as a tarball.

Increasingly, some upstream developers are not making tarball releases
of their source, and Debian's “pristine source” is an exported
revision from an upstream version control system. The ‘uscan’ tool
currently has no way to accomodate these packages.


Debian's policy §4.9 discusses a ‘debian/rules’ target named
‘get-orig-source’:

     `get-orig-source' (optional)
          This target fetches the most recent version of the original
          source package from a canonical archive site (via FTP or
          WWW, for example), does any necessary rearrangement to turn
          it into the original source tar file format described below,
          and leaves it in the current directory.

I have had some success with the following approach:

* Name the Debian package's release version such that the upstream
  version ends with the upstream VCS revision number, e.g.
  ‘foo-1.2.3~bzr.r987-1’ (the upstream version number is thus
  ‘1.2.3~bzr.r987’).

* Write a ‘debian/get-orig-source’ program that will:

  * Parse the changelog to get the package name and upstream version.

  * Parse the upstream version string to get the specified VCS
    revision number.

  * Specify the upstream VCS repository URL.

  * Invoke the appropriate VCS tool to export the specified revision
    from the VCS repository URL to a temporary directory.

  * Pack the temporary directory to an appropriately-named tarball in
    the current directory.

* In ‘debian/rules’, define ‘get-orig-source’ as a ‘.PHONY’ target,
  and make its action run the program ‘debian/get-orig-source’.

* Write a ‘debian/watch’ that explains in comments that the upstream
  source is fetched via ‘debian/rules get-orig-source’ as per policy.

For an example of this approach, see the ‘docutils-manpage-writer’
package. (The program ‘get-orig-source’ is licensed under GPLv2+,
share and enjoy.)


This gives satisfactory results, but it does require non-trivial
fiddling with each package's rules and programs to do the right thing.
I can't help thinking that it's only a stop-gap waiting for a true
solution.

I imagine a true solution would be to tell the Debian packaging tools
more directly that the source is to be fetched, not as a tarball, but
as a specified revision from a specified public VCS repository.

Is anyone working on something like this capability?

-- 
 \     “It is hard to believe that a man is telling the truth when you |
  `\      know that you would lie if you were in his place.” —Henry L. |
_o__)                                                          Mencken |
Ben Finney