Questions before my first upload attempt

["Thomas Schmitt" <scdbackup@gmx.net>]

Hi,

i am the upstream developer of freshly orphaned packages
libburn4, libisofs6, libisoburn1, cdrskin, and xorriso.
Now preparing to get them in shape for sponsorship and
for closing old bug reports.

Steve McIntyre offered his help (i hope this means
sponsorship). But knowing how busy he is, i ask my
pre-upload questions here first.

Achieved so far:

Package upstream sources are updated.
Files in ./debian have been adapted.
debian/changelog files got new sections "1.4.0".
The packages do build by
  dpkg-buildpackage -us -uc
with not more warnings than the current Debian packages
of version 1.3.2.
The .deb packages do install by dpkg -i.
Installed binaries and Xfburn, a user of the libraries,
do start up and look ok. Installed xorriso was tested
in my afternoon backup script. I dare to trust it.

Currently i am stuck at:

- https://wiki.debian.org/DebianMentorsFaq#How_do_I_make_my_first_package.3F
  "Put a package together, built against a current version of sid."

  I'm on Jessie 8.1. The dependencies of the packages in question
  are very basic. The package sources are portable to any X/Open
  compliant system. Tested upstream on very old GNU/Linux, FreeBSD,
  Solaris, and NetBSD.
  I understand i have to submit source packages anyway.

  So is there a way to do my packaging work in Debian 8.1 ?
  (The PackagingTutorial says i shall write "9" into
   debian/compat. Is that enough of a sid ?)

  Else: Is there a shortcut description how to quickly set up
  Debian package development in a virtual machine and how
  to keep it up to date ?
  (Hardware is plenty but my own VM scripts date back to Debian 6.)

- I still did not find a hands-on description of fulfilling
  the demand of http://mentors.debian.net/intro-maintainers:
    "All packages must be signed with the GnuPG key you configured
     in your control panel."

  http://mentors.debian.net/my has my public key now. I guess
  this does the necessary configuration.
  But how to use gpg or other programs to sign the packages ?
  As GNU maintainer i use on tarballs
    gpg -o ...sig -u ...
  on announcement messages
    gpg --clearsign ...
  Suspiciously all newbie tutorials for Debian packaging
  propose to use options -us -uc, which i understand prevent
  some kind of signing.


Have a nice day :)

Thomas