Bug#1060370: lintian: orig-tarball-missing-upstream-signature does not say what to do when using 'gbp import-ref'

[Otto Kekäläinen <otto@debian.org>]

Package: lintian
Version: 2.116.3
Severity: normal

While preparing entr 5.5 I imported upstream sources directly based on
upstream git tag using command:

    gbp import-ref --verbose --upstream-version=5.5

Eventually after building the resulting .changes file being uploaded
did not contain the upstream tarball signature as it wasn't part of
the gbp import-ref[1].

Hence it triggered a Lintian warning
'orig-tarball-missing-upstream-signature'[2].

However, I noticed that the current explanation does not advise the
maintainer on what to do when using 'gbp import-ref' as import method.

In this case I will need to use uscan in a separate step to download
the upstream release tarball and signature, and using pristine tar
generate the delta file and then manually add on the gbp managed
repository 'pristine-tar' branch the files:

entr_5.5.orig.tar.gz.asc
entr_5.5.orig.tar.gz.delta
entr_5.5.orig.tar.gz.id

Also this only works as long as upstream release tarball and git tag
actually are the same set of files.

To close this bug, I or some other contributor needs to submit a patch
for https://salsa.debian.org/lintian/lintian/-/blob/master/tags/o/orig-tarball-missing-upstream-signature.tag

[1] https://manpages.debian.org/unstable/git-buildpackage/gbp-import-ref.1.en.html
[2] https://udd.debian.org/lintian-tag.cgi?tag=orig-tarball-missing-upstream-signature