Bug#870069: orig-tarball-missing-upstream-signature error breaks rebuilding existing packages and more

[Paul Hardy <unifoundry@gmail.com>]

Chris,

On Fri, Sep 1, 2017 at 11:08 PM, Chris Lamb <lamby@debian.org> wrote:
> Hi Paul,
>
>> > Can you think of another way your particular versions could be
>> > detected?
>>
>> Sorry, I don't understand what you mean by "versions".  I do use a
>> watch file for Unifont
>
> Nothing to do with watchfiles, but rather I want to work out somehow
> we can not emit this tag until you are ready to release and a
> signature would actually exist.

Oh, I see.  Personally, my only concern was that a lintian error would
prevent an uploaded, released package from migrating to testing.  I
did not think it should be a lintian error, because not having the
file does not violate Debian Policy.  I think a warning would be a
better severity level.

I think having lintian give a warning for a missing ".orig.tar.*.asc"
file is appropriate even for UNRELEASED, so the package maintainer
realizes the omission as early as possible and can prioritize adding
it (or even severity "Info" in cases where it is not known if the
upstream tarball has a signature).  An exception, as you mentioned,
would be a dfsg version of an upstream tarball.

However, I have modified my building procedure so that now I do create
a ".asc" signature file from my GNU ".sig" file before pdebuild
starts.  So I have circumvented the whole issue, but that doesn't
solve it for others.

Thank you,


Paul Hardy