Hi Sven, On 2021/08/26 02:41 PM, Sven Hartge wrote: > I noticed a little weirdness when uploading a package for multiple > suites, in my case for "bullseye-backports" and > "buster-backports-sloppy". > > Reference is https://mentors.debian.net/package/radsecproxy/ > > I uploaded version 1.9.0-1~bpo10+1 first and then 1.9.0-1~bpo11+1 > second. > > The latter seems to have superseded the first, with the first still > being in the interface but somehow only "half". For example the URL to > the DSC does not work and the URL in the RFS template is only > "https://mentors.debian.netNone";. > > Simple fix is of course to just delete and reupload 1.9.0-1~bpo10+1 but > I think I happen to stumble upon an edge-case bug in the mentors backend > here. That's definitively a bug cause by a corner case in mentors. Here is the explanation: Mentors differs from Debian official archive in which it allow multiple upload of the same version+distribution, allowing people to overwrite they upload until they are satisfied with it. While mentors keeps track of each upload, the source repository simply cannot store multiple version of the same file. Therefore before installing the uploaded files to the repository any previous version of a file will be uninstalled from it. In theory, this shouldn't prevent people from retrieving sources package from the repository of the same package, for two different distributions and versions. For instance, uploading tmux/2.0-1 for unstable and tmux/1.9-1+deb11u1 (let's say for a security fix) for stable. Both live in different distributions, without any files overlapping and the repository is happy to serve both. Your use case is specific in which there is a overlap of the orig.tar, which both distributions use. Because of that, and even if the distribution differs and the file has the same checksum, the repository detected a new upload of the orig.tar and removed the previous upload that was using it. That's why the dsc of the first upload disappeared and the link doesn't show up. I'm not sure we can come up with a sound technical solution for this issue, given that the repository replacing uploads is an actual feature. I'll dig up the topic a little more to see if we can come up with something. I'll keep you posted. -- Baptiste Beauplat - lyknode
Attachment:
signature.asc
Description: PGP signature