Bug#982562: general: Storing upstream signatures next to upstream tarballs is problematic

[Guillem Jover <guillem@debian.org>]

On Fri, 2021-02-12 at 01:05:21 +0100, Mattia Rizzolo wrote:
> On Fri, 12 Feb 2021, 12:52 am Guillem Jover, <guillem@debian.org> wrote:
> > Then there's the problem with changing contents for already seen
> > files, which seems like a dak bug. It does not allow to change a
> > tarball once it has been seen, so I don't see why it should allow a
> > changed .asc either?
> 
> That's not true.
> 
> Call it a dak bug or a feature, depending on where you stand.  Dak forgets
> everything concerning a file as soon as it's not present in any suite it
> manages.
> This usually appears in the way of people uploading a package with the same
> name and version of something that was removed long long ago and since then
> archived and forgotten by dak.

Ah, sorry, right, that dak forgetfulness problem which seems
contagious. :)

Ok, so then these seems like two bugs in dak. dak sees the .asc, then
they disappear and it forgets them, and then files with different
content can then be uploaded. While ideally dak would never forget,
the problem here is that dak allows uploads that drop the .asc files,
no?

Thanks,
Guillem