• Re: Call for participation in tag2upload closed beta

    From Simon Josefsson@21:1/5 to Sean Whitton on Sat Mar 15 11:50:01 2025
    Yay!

    I'm happy to beta-test this. Exactly what features are required from
    dgit to be able to use tag2upload? Maybe I can offer myself to vet the
    process as a package maintainer that only minimally uses dgit, assuming
    that I can manage to install and get dgit to work on my machine. A
    simple 'dpkg -i' of 12.9 worked now, and I was able to run 'dgit build'
    in my existing libntlm git clone. I haven't been using dgit before
    this, but maybe this is sufficient to count me as a dgit user.

    Packages (for example): libntlm, cppi, git2cl, guile-fibers

    /Simon

    Sean Whitton <spwhitton@spwhitton.name> writes:

    Hello everyone,

    We are ready to start a closed beta for tag2upload.

    For the first stage, these are the kind of participants we want:

    - Individual maintainer or small team, where everyone is on board.
    DDs and DMs are equally welcome.

    - (At least some of) the packages are uploaded relatively often.

    - Happy to perform an occasional upload that only touches d/changelog,
    for testing.

    - Happy to risk breakage or lossage, including possible broken uploads.
    We don't expect broken uploads, but one point of the beta is to
    discover any problems of that kind.

    - You already use dgit to upload.

    This is not because using tag2upload requires using dgit.
    There are two reasons for this limitation at this stage:

    There are some complications that will be avoided in git trees that
    are already known to work fine with dgit.

    On a social/pedagogical level, users of dgit will already be familiar
    with some of our terminology etc.

    - Happy to tolerate the history of your package on dgit-repos diverging
    a bit from what's on salsa.
    (Interleaving dgit pushes and tag2upload will add some merges.)

    - Willing to tolerate rough edges!

    Just to note, we will not ask you to use tag2upload for every upload of
    the packages for which it is enabled. Uploads done in the usual way can freely be done too.

    If you'd like to sign up, write to us at <dgit-owner@debian.org>,
    specifying a list of your packages for which we should enable tag2upload processing, and confirming you have your co-maintainers agreement.

    Or just reply to dgit-owner@ or on debian-devel if you have some
    questions first.

    For more information, see <https://wiki.debian.org/tag2upload>.

    For the tag2upload Delegates,

    -----BEGIN PGP SIGNATURE-----

    iQNoBAEWCAMQFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmfVWTIUHHNpbW9uQGpv c2Vmc3Nvbi5vcmfCHCYAmDMEXJLOtBYJKwYBBAHaRw8BAQdACIcrZIvhrxDBkK9f V+QlTmXxo2naObDuGtw58YaxlOu0JVNpbW9uIEpvc2Vmc3NvbiA8c2ltb25Aam9z ZWZzc29uLm9yZz6IlgQTFggAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYh BLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XQkBQkNZGbwAAoJENc89jjFPAa+BtIA /iR73CfBurG9y8pASh3cbGOMHpDZfMAtosu6jbpO69GHAP4p7l57d+iVty2VQMsx +3TCSAvZkpr4P/FuTzZ8JZe8BrgzBFySz4EWCSsGAQQB2kcPAQEHQOxTCIOaeXAx I2hIX4HK9bQTpNVei708oNr1Klm8qCGKiPUEGBYIACYCGwIWIQSx0r0Tdb7LeEz0 +MTXPPY4xTwGvgUCZ9F0SgUJDWRmSQCBdiAEGRYIAB0WIQSjzJyHC50xCrrUzy9R cisI/kdFogUCXJLPgQAKCRBRcisI/kdFoqdMAQCgH45aseZgIrwKOvUOA9QfsmeE 8GZHYNuFHmM9FEQS6AD6A4x5aYvoY6lo98pgtw2HPDhmcCXFItjXCrV4A0GmJA4J ENc89jjFPAa+wUUBAO64fbZek6FPlRK0DrlWsrjCXuLi6PUxyzCAY6lG2nhUAQC6 qobB9mkZlZ0qihy1x4JRtflqFcqqT9n7iUZkCDIiDbg4BFySz2oSCisGAQQBl1UB BQEBB0AxlRumDW6nZY7A+VCfek9VpEx6PJmdJyYPt3lNHMd6HAMBCAeIfgQYFggA JgIbDBYhBLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XTSBQkNZGboAAoJENc89jjF PAa+0M0BAPPRq73kLnHYNDMniVBOzUdi2XeF32idjEWWfjvyIJUOAP4wZ+ALxIeh is3Uw2BzGZE6ttXQ2Q+DeCJO3TPpIqaXDAAKCRBRcisI/kdFopVSAQD8I2b3ohOa Ex9qfySN+PTeyyXYTcnN4AM/rzyn+K+FLAD/QJPs41GVQ+HZWsjcDycCexzp+xd6 cu62SkFvRadEzQQ=
    =qrO0
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Johannes Schauer Marin Rodrigues@21:1/5 to All on Sat Mar 15 13:10:01 2025
    Hi Sean,

    Quoting Sean Whitton (2025-03-15 02:49:58)
    - (At least some of) the packages are uploaded relatively often.

    with the upcoming freeze, I do not expect too many uploads to be necessary (but can be done if needed). But is that a problem?

    - You already use dgit to upload.

    The wiki page says to use git-debpush from src:dgit. Which version of git-debpush is new enough? Does the version from Bookworm work?

    If you'd like to sign up, write to us at <dgit-owner@debian.org>, specifying a list of your packages for which we should enable tag2upload processing, and confirming you have your co-maintainers agreement.

    No co-maintainers and happy to try out tag2upload for: box64, ldraw-parts-free, pico-sdk, picotool, vcmi, img2pdf, plakativ

    Co-maintainer (Jochen) agrees: sbuild

    Thanks!

    cheers, josch
    --==============€39412785791817274=MIME-Version: 1.0
    Content-Transfer-Encoding: 7bit
    Content-Description: signature
    Content-Type: application/pgp-signature; name="signature.asc"; charset="us-ascii"

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEElFhU6KL81LF4wVq58sulx4+9g+EFAmfVbIAACgkQ8sulx4+9 g+GBGRAAtbnEKVZuGodlxdKtjBiyK+HbN4SwR4ri+73/zBCuq4U9Ke05BP2w/QSK MvInvvz2hH8FVX5HJMQACjGZf0H4GqOGSBfmb97gDuImWVLTcwmJY0ooMDdoW14Z o99+o/PWo/6MXPjcqLSuKypuLSAghip0wzC0GW/QJ6gAsSTyFwQc3w7F2ol/IjFv Bct3zGrFSbe9RuzDsDdiX0SnSAW4KN2Q2TdCp8mPEGs3S1yv0EbHWkq6WLt5NcyJ 92045Y4N/5GmlSEwIOul4UoMTE3lbtHyhTpSsh2qiTYRRrEBKK+uSjGggEWsxwhB CPiT1OhsjvDWhC0CiSuT271f2vz1ugKhAn7Kxvxb6uFbY0v3zANsF2hTAFr5qqv/ sofyjmj3ae9ajRXP6EvCzeWTENXTl2IviddenD4wWc+Ltopr8ubRQSQBivPj/Zg7 UEfMWQ6s6wV4wWqPazGgZ8eyutolTREx4dbhquK5fB/0+B86A622EHNfwQx82R2F /UnaH1xWhz/smp2gjptvQbx2chvmZHQbO+69XyOLuw2Bb3z0KFY2U8JkG8sHtF83 NHhB68YyqdT91TwTGJA2DKVl4YqjPxgdVKuysC9Ah+okZaTHLQLfiqb80YVzYoae vCX1muVwQSDDUzO+EYhMWZoW7bV1mFvChEcavMtPVBmcHYIEch4=
    =Wv92
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Sean Whitton@21:1/5 to Johannes Schauer Marin Rodrigues on Wed Mar 19 00:10:01 2025
    Hello,

    On Sat 15 Mar 2025 at 01:03pm +01, Johannes Schauer Marin Rodrigues wrote:

    Hi Sean,

    Quoting Sean Whitton (2025-03-15 02:49:58)
    - (At least some of) the packages are uploaded relatively often.

    with the upcoming freeze, I do not expect too many uploads to be necessary (but
    can be done if needed). But is that a problem?

    No, no problem, should be okay. We just wanted to point out that if it something you upload once per release cycle, there is probably not much
    point in signing up for that package.

    - You already use dgit to upload.

    The wiki page says to use git-debpush from src:dgit. Which version of git-debpush is new enough? Does the version from Bookworm work?

    As of last weekend's point release, yes, it does :)

    If you'd like to sign up, write to us at <dgit-owner@debian.org>, specifying >> a list of your packages for which we should enable tag2upload processing, and
    confirming you have your co-maintainers agreement.

    No co-maintainers and happy to try out tag2upload for: box64, ldraw-parts-free,
    pico-sdk, picotool, vcmi, img2pdf, plakativ

    Co-maintainer (Jochen) agrees: sbuild

    Thanks, that's great.

    --
    Sean Whitton

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Sean Whitton@21:1/5 to Simon Josefsson on Wed Mar 19 00:10:01 2025
    Hello,

    On Sat 15 Mar 2025 at 11:40am +01, Simon Josefsson wrote:

    Yay!

    I'm happy to beta-test this. Exactly what features are required from
    dgit to be able to use tag2upload? Maybe I can offer myself to vet the process as a package maintainer that only minimally uses dgit, assuming
    that I can manage to install and get dgit to work on my machine. A
    simple 'dpkg -i' of 12.9 worked now, and I was able to run 'dgit build'
    in my existing libntlm git clone. I haven't been using dgit before
    this, but maybe this is sufficient to count me as a dgit user.

    Packages (for example): libntlm, cppi, git2cl, guile-fibers

    That should be enough! If you were able to do at least one upload using
    'dgit push-source' for each package to confirm everything is okay, that
    would be great.

    --
    Sean Whitton

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Sean Whitton@21:1/5 to Simon Josefsson on Wed Mar 19 01:00:01 2025
    Hello,

    On Wed 19 Mar 2025 at 12:25am +01, Simon Josefsson wrote:

    Sean Whitton <spwhitton@spwhitton.name> writes:

    That should be enough! If you were able to do at least one upload using
    'dgit push-source' for each package to confirm everything is okay, that
    would be great.

    I'll try. I got a SSH push warning on first use -- how would I verify
    this host SSH key? What's the risk uploaders getting MITM'ed here?

    The authenticity of host 'push.dgit.debian.org (2001:41b8:202:deb::311:78)' can't be established.
    ED25519 key fingerprint is SHA256:O4i2PPFELuj49wYZSwLt+a2r356sB19KMCFhrUKkYiM.
    This key is not known by any other names.
    Are you sure you want to continue connecting (yes/no/[fingerprint])?

    I would suggest grabbing /etc/ssh/known_hosts from a Debian host for
    which you already have the host key cached.

    --
    Sean Whitton

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Simon Josefsson@21:1/5 to Sean Whitton on Wed Mar 19 00:30:01 2025
    Sean Whitton <spwhitton@spwhitton.name> writes:

    That should be enough! If you were able to do at least one upload using 'dgit push-source' for each package to confirm everything is okay, that
    would be great.

    I'll try. I got a SSH push warning on first use -- how would I verify
    this host SSH key? What's the risk uploaders getting MITM'ed here?

    The authenticity of host 'push.dgit.debian.org (2001:41b8:202:deb::311:78)' can't be established.
    ED25519 key fingerprint is SHA256:O4i2PPFELuj49wYZSwLt+a2r356sB19KMCFhrUKkYiM. This key is not known by any other names.
    Are you sure you want to continue connecting (yes/no/[fingerprint])?

    /Simon

    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iQNoBAEWCAMQFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmfaAOkUHHNpbW9uQGpv c2Vmc3Nvbi5vcmfCHCYAmDMEXJLOtBYJKwYBBAHaRw8BAQdACIcrZIvhrxDBkK9f V+QlTmXxo2naObDuGtw58YaxlOu0JVNpbW9uIEpvc2Vmc3NvbiA8c2ltb25Aam9z ZWZzc29uLm9yZz6IlgQTFggAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYh BLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XQkBQkNZGbwAAoJENc89jjFPAa+BtIA /iR73CfBurG9y8pASh3cbGOMHpDZfMAtosu6jbpO69GHAP4p7l57d+iVty2VQMsx +3TCSAvZkpr4P/FuTzZ8JZe8BrgzBFySz4EWCSsGAQQB2kcPAQEHQOxTCIOaeXAx I2hIX4HK9bQTpNVei708oNr1Klm8qCGKiPUEGBYIACYCGwIWIQSx0r0Tdb7LeEz0 +MTXPPY4xTwGvgUCZ9F0SgUJDWRmSQCBdiAEGRYIAB0WIQSjzJyHC50xCrrUzy9R cisI/kdFogUCXJLPgQAKCRBRcisI/kdFoqdMAQCgH45aseZgIrwKOvUOA9QfsmeE 8GZHYNuFHmM9FEQS6AD6A4x5aYvoY6lo98pgtw2HPDhmcCXFItjXCrV4A0GmJA4J ENc89jjFPAa+wUUBAO64fbZek6FPlRK0DrlWsrjCXuLi6PUxyzCAY6lG2nhUAQC6 qobB9mkZlZ0qihy1x4JRtflqFcqqT9n7iUZkCDIiDbg4BFySz2oSCisGAQQBl1UB BQEBB0AxlRumDW6nZY7A+VCfek9VpEx6PJmdJyYPt3lNHMd6HAMBCAeIfgQYFggA JgIbDBYhBLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XTSBQkNZGboAAoJENc89jjF PAa+0M0BAPPRq73kLnHYNDMniVBOzUdi2XeF32idjEWWfjvyIJUOAP4wZ+ALxIeh is3Uw2BzGZE6ttXQ2Q+DeCJO3TPpIqaXDAAKCRBRcisI/kdFojC7AQCj7WxzLm/e 9NzZB5M3kMBGxVHBQ5RnFrN3ZYzb7odcHAEA0s2grh5J7WBWYq9uVn7LEd/VKBWV 82zSiolJ22n2Gw8=Pq/e
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Sean Whitton@21:1/5 to Simon Josefsson on Wed Mar 19 01:20:01 2025
    Hello,

    On Wed 19 Mar 2025 at 12:58am +01, Simon Josefsson wrote:

    Sean Whitton <spwhitton@spwhitton.name> writes:

    Packages (for example): libntlm, cppi, git2cl, guile-fibers

    That should be enough! If you were able to do at least one upload using
    'dgit push-source' for each package to confirm everything is okay, that
    would be great.

    Should be done for libntlm, git2cl and guile-fibers now. Dgit didn't
    like cppi, doesn't it handle bare-debian/-style packaging? See: https://salsa.debian.org/debian/cppi

    It has --quilt=baredebian+git and --quilt=baredebian+tarball for this
    -- please give one of those a try.

    I used this command:

    dgit --gbp push-source --deliberately-not-fast-forward

    Based on my understanding of:

    https://manpages.debian.org/testing/dgit/dgit-maint-gbp.7.en.html#UPLOADING

    Great, thank you for reporting back!

    I'm doing this on a laptop running Trisquel aramo (Ubuntu 22.04 clone)
    with plenty of packages installed from Guix, including GnuPG, git and
    even dpkg. I was positively surprised dgit didn't blow up, good job!

    We run CI based on installing the latest git HEAD all the way back to
    buster :) Glad it is proving itself worthwhile.

    --
    Sean Whitton

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Simon Josefsson@21:1/5 to Sean Whitton on Wed Mar 19 01:30:01 2025
    Sean Whitton <spwhitton@spwhitton.name> writes:

    Should be done for libntlm, git2cl and guile-fibers now. Dgit didn't
    like cppi, doesn't it handle bare-debian/-style packaging? See:
    https://salsa.debian.org/debian/cppi

    It has --quilt=baredebian+git and --quilt=baredebian+tarball for this
    -- please give one of those a try.

    It worked, thank you! For reference:

    dgit --gbp push-source --quilt=baredebian+tarball --deliberately-not-fast-forward

    How do I make the next upload using tag2upload?

    /Simon

    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iQNoBAEWCAMQFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmfaDkcUHHNpbW9uQGpv c2Vmc3Nvbi5vcmfCHCYAmDMEXJLOtBYJKwYBBAHaRw8BAQdACIcrZIvhrxDBkK9f V+QlTmXxo2naObDuGtw58YaxlOu0JVNpbW9uIEpvc2Vmc3NvbiA8c2ltb25Aam9z ZWZzc29uLm9yZz6IlgQTFggAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYh BLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XQkBQkNZGbwAAoJENc89jjFPAa+BtIA /iR73CfBurG9y8pASh3cbGOMHpDZfMAtosu6jbpO69GHAP4p7l57d+iVty2VQMsx +3TCSAvZkpr4P/FuTzZ8JZe8BrgzBFySz4EWCSsGAQQB2kcPAQEHQOxTCIOaeXAx I2hIX4HK9bQTpNVei708oNr1Klm8qCGKiPUEGBYIACYCGwIWIQSx0r0Tdb7LeEz0 +MTXPPY4xTwGvgUCZ9F0SgUJDWRmSQCBdiAEGRYIAB0WIQSjzJyHC50xCrrUzy9R cisI/kdFogUCXJLPgQAKCRBRcisI/kdFoqdMAQCgH45aseZgIrwKOvUOA9QfsmeE 8GZHYNuFHmM9FEQS6AD6A4x5aYvoY6lo98pgtw2HPDhmcCXFItjXCrV4A0GmJA4J ENc89jjFPAa+wUUBAO64fbZek6FPlRK0DrlWsrjCXuLi6PUxyzCAY6lG2nhUAQC6 qobB9mkZlZ0qihy1x4JRtflqFcqqT9n7iUZkCDIiDbg4BFySz2oSCisGAQQBl1UB BQEBB0AxlRumDW6nZY7A+VCfek9VpEx6PJmdJyYPt3lNHMd6HAMBCAeIfgQYFggA JgIbDBYhBLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XTSBQkNZGboAAoJENc89jjF PAa+0M0BAPPRq73kLnHYNDMniVBOzUdi2XeF32idjEWWfjvyIJUOAP4wZ+ALxIeh is3Uw2BzGZE6ttXQ2Q+DeCJO3TPpIqaXDAAKCRBRcisI/kdFolr9AQCk6hUwD5po dXS+bT8XuY5QiArzWVBuDkFZI7lN0z8NjgEAt2uhT0QYG6wNZNJ/PjNtcRAh9l4K VGiAm1EqzR4gbwM=kjLa
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)