Package: devscripts Version: 2.25.18 Severity: important -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Uscan first downloads upstream-named tarball, then adds a symlink from that to the Debian-named *_orig filename. If upstream-named tarball is too generic, the tarball may clash with those of other projects. Most commonly this occurs when using git mode, where upstream tarball is just a version number. As a workaround, `uscan --rename` can instead rename, limiting the clash to concurrent calls to uscan. This workaround is limited, however, because it exists only as a command-line option (not a configfile statement) and tools like git-buildpackage does not support that option. A workaround for the uscan workaround is to first run `uscan --rename` and then `gbp import-orig --upstream-vcs-tag=0.11.1 ../name-of-fetched-tarball`. That workaround-workaround fails to work for projects with components, however, because `gbp import-orig` takes only a single source, whereas its `--uscan` option processes main and component tarballs together. This example (from btm package, simplified) worked previously: version=4 opts=\ filenamemangle=s/.*?@ANY_VERSION@(@ARCHIVE_EXT@)/@PACKAGE@_$1.orig$2/,\ downloadurlmangle=s!api.github.com/repos/[^/]+/[^/]+/\Kgit/!tarball/!g,\ searchmode=plain \ https://api.github.com/repos/ClementTsang/bottom/git/matching-refs/tags/ \ https://api.github.com/repos/[^/]+/[^/]+/git/refs/tags/@ANY_VERSION@ \ group opts=\ component=Xtimeless,\ filenamemangle=s/.*?@ANY_VERSION@(@ARCHIVE_EXT@)/@PACKAGE@_$1.orig-Xtimeless$2/,\ mode=git,pgpmode=none,pretty=0+%cd \ https://github.com/clementtsang/timeless.git \ HEAD \ group Since devscripts 2.25.18 it fails like this: $ uscan Newest version of btm on remote site is 0.11.1, local version is 0.10.2+20250107 => Newer package available from: => https://api.github.com/repos/ClementTsang/bottom/tarball/refs/tags/0.11.1 Newest version of Xtimeless on remote site is 0+20250330.orig-Xtimeless, local version is 0 => Newer package available from: => https://github.com/clementtsang/timeless.git HEAD uscan warn: Parameter ../0.11.1 does not have a file extension, guessed a tarball compressed with gzip. uscan warn: Missing debian/source/format, switch compression to gzip Successfully symlinked ../0.11.1 to ../btm_0.11.1.orig.tar.gz. Use of uninitialized value in subroutine entry at /usr/share/perl5/Devscripts/Uscan/Downloader.pm line 135. Use of uninitialized value $ver in concatenation (.) or string at /usr/share/perl5/Devscripts/Uscan/Downloader.pm line 301. Use of uninitialized value $ver in concatenation (.) or string at /usr/share/perl5/Devscripts/Uscan/Downloader.pm line 301. uscan error: Could not read ../btm_0+20250330.orig-Xtimeless.tar.xz: No such file or directory Dropping the filenamemangle entry from the component makes it succeed, but then I have clashing upstream tarball files again. - Jonas - -- Package-specific info: - --- /etc/devscripts.conf --- Empty. - --- ~/.devscripts --- Not present - -- System Information: Debian Release: forky/sid APT prefers buildd-unstable APT policy: (500, 'buildd-unstable'), (500, 'unstable'), (1, 'buildd-experimental'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 6.12.22-amd64 (SMP w/8 CPU threads; PREEMPT) Locale: LANG=da_DK.UTF-8, LC_CTYPE=da_DK.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages devscripts depends on: ii dpkg-dev 1.22.21 ii file 1:5.46-5 ii gpg 2.4.8-2 ii gpg-agent 2.4.8-2 ii gpg-from-sq [gpg] 0.13.1-3 ii gpgv 2.4.8-2 ii gpgv-from-sq [gpgv] 0.13.1-3 ii libdpkg-perl 1.22.21 ii libfile-dirlist-perl 0.05-3 ii libfile-homedir-perl 1.006-2 ii libfile-touch-perl 0.12-2 ii libmoo-perl 2.005005-1 ii libwww-perl 6.78-1 ii patchutils 0.4.2-1 ii perl 5.40.1-6 ii python3 3.13.5-1 ii sensible-utils 0.0.25 ii wdiff 1.2.2-9 Versions of packages devscripts recommends: ii apt 3.1.4 ii curl 8.15.0-1 ii dctrl-tools 2.24-3+b1 ii debian-keyring 2025.07.26 ii debian-tag2upload-keyring 1.1 ii dput 1.2.4 ii equivs 2.3.2 ii git-debpush 13.12 ii libdistro-info-perl 1.14 ii libencode-locale-perl 1.05-3 ii libgitlab-api-v4-perl 0.27-1 ii libio-string-perl 1.08-4 ii libjson-perl 4.10000-1 ii liblwp-protocol-https-perl 6.14-1 ii libsoap-lite-perl 1.27-3 ii libstring-shellquote-perl 1.04-3 ii liburi-perl 5.30-1 ii licensecheck 3.3.9-1 ii lintian 2.122.0 ii lzip 1.25-3 ii man-db 2.13.1-1 ii patch 2.8-2 ii pristine-tar 1.50+nmu2 ii python3-apt 3.0.0 ii python3-debian 1.0.1 ii python3-magic 2:0.4.27-3 ii python3-requests 2.32.3+dfsg-5 ii python3-unidiff 0.7.5-2 ii python3-xdg 0.28-2 ii strace 6.16+ds-2 ii unzip 6.0-29 ii wget 1.25.0-2 ii xz-utils 5.8.1-1 Versions of packages devscripts suggests: pn adequate <none> pn at <none> pn autopkgtest <none> pn bls-standalone <none> pn bsd-mailx | mailx <none> ii build-essential 12.12 pn check-all-the-things <none> ii debhelper 13.25 pn diffoscope <none> pn disorderfs <none> pn docker.io <none> ii dose-extra 7.0.0-6+b2 pn duck <none> pn elpa-devscripts <none> pn faketime <none> pn gnuplot <none> pn how-can-i-help <none> ii libauthen-sasl-perl 2.1900-1 pn libdbd-pg-perl <none> pn libmetacpan-client-perl <none> pn libterm-size-perl <none> ii libtimedate-perl 2.3300-2 ii libyaml-libyaml-perl 0.903.0+ds-1 ii mmdebstrap 1.5.7-3 pn mutt <none> ii openssh-client [ssh-client] 1:10.0p1-8 pn piuparts <none> pn postgresql-client <none> pn pristine-lfs <none> ii python3-debianbts 4.1.1 pn python3-pycurl <none> ii quilt 0.68-1 pn ratt <none> pn reprotest <none> pn svn-buildpackage <none> ii w3m 0.5.3+git20230121-2.1 - -- no debconf information -----BEGIN PGP SIGNATURE----- wsG7BAEBCgBvBYJooGV5CRAsfDFGwaABIUcUAAAAAAAeACBzYWx0QG5vdGF0aW9u cy5zZXF1b2lhLXBncC5vcmcpSkaZLuBfT13LQMq106vIB8R1PB53023K0BY/cA+R SxYhBJ/j6cNmkaaf9TzGhCx8MUbBoAEhAAAkoxAApmZWkPl1OojH/wJl2iSdE6cb JUkEYY9zOZfxwG1BDdH4cmTdDhFXk5gETikIu6ZL6HQxUxS3JpGjFBsOBHmGcxoW M83piFr99tKL+qkkJU142PV0IF7xmPVryBqgypULhJ7pKmNfCfS1HGNpNd27F+py CPSJGCBszD0s0IDlyfqTS608m87Z7+o+JcHu3XfGxNGV/YORD+k3KLGMc8LqnQYY 1Bj6T84PHsM4hQqo+phEQSGmUW2Pl5qBeer7UxHellMN31+0saZG4fUOAPSR9eVq fsOt5jNn9c40eGophGlZl/VZY0nsympV7o321lSYaB9GN1S9f3fRSmb2f6aPyIL5 NYd2sVuacctzhy8KEpWHCifgJfMW3afLDNIOuVQzCeuZans6/mWlXhDZ8DzHbVhj WCiEwGmlF4R6r5M7a+7nvkgTxwh+htCj0WYGjJpiQ88qI6Ktxdg7AGC1w0nAhE7S J0qlRXuQ9LO6iLFF2yBXUj5RnAJOVQhXxNjqq9b4LOeu3ssk+zGN0AmPBuBpoB/f 4bLhrFa/MKHnsKqqLjgVht4o73zyB7ncp5NJCrSilw1IFkSVOJtAhubPSe/QNrOx xsbmKFopIkxFhDSy2RbFx70TrRHwOGuKytvd/sewNZVewHuxE7tvjMCExSgXzS+q EoclM3EkzT3blDUcw8Y= =hhSR -----END PGP SIGNATURE-----
