Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1281667 > unrolled thread

Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue?

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue? Simon Josefsson <simon@josefsson.org> - 2026-02-11 12:40 +0100
    Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue? Ian Jackson <ijackson@chiark.greenend.org.uk> - 2026-02-11 13:30 +0100
    Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue? Simon Josefsson <simon@josefsson.org> - 2026-02-15 21:00 +0100
      Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue? Ian Jackson <ijackson@chiark.greenend.org.uk> - 2026-02-15 22:00 +0100
        Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue? Simon Josefsson <simon@josefsson.org> - 2026-02-15 22:10 +0100
          Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue? Ian Jackson <ijackson@chiark.greenend.org.uk> - 2026-02-15 23:20 +0100
            Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue? Simon Josefsson <simon@josefsson.org> - 2026-02-16 15:30 +0100
              Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue? Ian Jackson <ijackson@chiark.greenend.org.uk> - 2026-02-21 17:30 +0100

#1281667 — Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue?

[Multipart message — attachments visible in raw view] — view raw

Package: dgit
Version: 14.7~bpo13+1

I wanted to do a NEW upload so I built a package and ran this:

jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new -Cgolang-filippo-nistec_0.0.4-2_amd64.changes 
Format `3.0 (quilt)', need to check/update patch stack
canonical suite name for unstable is sid
kex_exchange_identification: read: Connection reset by peer
Connection reset by 82.195.75.78 port 22
dgit: failed command: ssh 'dgit@push.dgit.debian.org' ': dgit debian git-check golang-filippo-nistec ; set -e; cd /dgit/debian/repos; if test -d golang-filippo-nistec.git; then echo 1; else echo 0; fi'

dgit: error: subprocess failed with error exit status 255
! Push failed, while checking state of the archive.
! You can retry the push, after fixing the problem, if you like.
jas@frallan:~/dpkg/golang-filippo-nistec$


I retried and got the same error, then retried again and got this:


jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new -Cgolang-filippo-nistec_0.0.4-2_amd64.changes 
Format `3.0 (quilt)', need to check/update patch stack
canonical suite name for unstable is sid
no version available from the archive
nothing quilty to commit, ok.
checking that golang-filippo-nistec_0.0.4-2.dsc corresponds to HEAD
dpkg-source: varning: extraherar osignerat källkodspaket (/home/jas/dpkg/golang-filippo-nistec/../golang-filippo-nistec_0.0.4-2.dsc)
dpkg-source: info: extraherar golang-filippo-nistec i unpacked
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4.orig.tar.gz
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4-2.debian.tar.xz
kex_exchange_identification: read: Connection reset by peer
Connection reset by 82.195.75.78 port 22
dgit: failed command: ssh 'dgit@push.dgit.debian.org' ': dgit debian policy-client-query golang-filippo-nistec tainted-objects sid ; true'

dgit: error: subprocess failed with error exit status 255
! Push failed, while preparing your push.
! You can retry the push, after fixing the problem, if you like.
jas@frallan:~/dpkg/golang-filippo-nistec$ 


So I retried again:


jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new -Cgolang-filippo-nistec_0.0.4-2_amd64.changes 
Format `3.0 (quilt)', need to check/update patch stack
canonical suite name for unstable is sid
no version available from the archive
nothing quilty to commit, ok.
checking that golang-filippo-nistec_0.0.4-2.dsc corresponds to HEAD
dpkg-source: varning: extraherar osignerat källkodspaket (/home/jas/dpkg/golang-filippo-nistec/../golang-filippo-nistec_0.0.4-2.dsc)
dpkg-source: info: extraherar golang-filippo-nistec i unpacked
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4.orig.tar.gz
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4-2.debian.tar.xz

History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
Taint recorded at time 2026-02-11 00:43:10 Z for any package
Reason: tag archive/debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
Could perhaps be forced using --deliberately.  Consult documentation.

History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
Taint recorded at time 2026-02-11 00:43:10 Z for any package
Reason: tag debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
Could perhaps be forced using --deliberately.  Consult documentation.

dgit: error: pushing tainted objects (which server would reject)
! Push failed, while preparing your push.
! You can retry the push, after fixing the problem, if you like.
jas@frallan:~/dpkg/golang-filippo-nistec$


I'm not sure if the --deliberately suggestion was targetted at me, but
it didn't work:

jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new -Cgolang-filippo-nistec_0.0.4-2_amd64.changes --deliberately
dgit: unknown long option `--deliberately'

As far as I can tell, the package is now stuck.

How would I recover from this situation and upload using dgit?

Meanwhile I reverted to debsign+dput, but wanted to report this to have
a solution for next time.

/Simon

[toc] | [next] | [standalone]

#1281675

Simon Josefsson writes ("Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue?"):
> Could perhaps be forced using --deliberately.  Consult documentation.

Firstly, I'm sorry that this arrangement you're experiencing is rather
clumsy.

> I'm not sure if the --deliberately suggestion was targetted at me, but
> it didn't work:

Yes, it is targeted at you.  It says to consult the documentation.
Which documentation did you consult?

The option isn't `--deliberately`.  It's `--deliberate-something`.
The system needs to get you to make a choice, and the choice is
explained in the documentation.

  https://manpages.debian.org/testing/dgit/dgit.1.en.html#deliberately-

We should perhaps have it say "Consult dgit(1)" rather than the vaguer
"documentation" and also saying just --deliberately should produce a
bespoke error message.

> jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new -Cgolang-filippo-nistec_0.0.4-2_amd64.changes --deliberately
> dgit: unknown long option `--deliberately'
> 
> As far as I can tell, the package is now stuck.

This situation will indeed persist until the history is untainted.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1127470
is kind of related.

Ian.

-- 
Ian Jackson <ijackson@chiark.greenend.org.uk>   These opinions are my own.  

Pronouns: they/he.  If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.

[toc] | [prev] | [next] | [standalone]

#1282312

[Multipart message — attachments visible in raw view] — view raw

Ian Jackson <ijackson@chiark.greenend.org.uk> writes:

>> History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
>> Taint recorded at time 2026-02-11 00:43:10 Z for any package
>> Reason: tag debian/0.0.4-1 referred to this object in git tree but
>> all previously pushed versions were found to have been removed from
>> NEW (ie, rejected) (or never arrived)
>> Could perhaps be forced using --deliberately.  Consult documentation.
>
> This message was unhelpful.  We have improved it.  (dgit 14.8, which
> is not yet deployed but will be in the forthcoming weeks.)
>
>> How would I recover from this situation and upload using dgit?
>
> You probably wanted --deliberately-include-questionable-history.
> The new output will make more helpful suggestions.

My reading of the man page is that --deliberately-not-fast-forward is
the relevant parameter for this situation, but it fails (I'm still on
14.7~bpo13+1) when I try it now (fortunately for this bug report the
package was REJECTED again so I got to retry this).  I will hold off
upload until I can retry with 14.8 to see if it behaves different.

The package was REJECTED for copyright reasons and the man page says:

       --deliberately-not-fast-forward
...
              When pushing to Debian, use this only when you are making  a  re‐
              newed  upload  of  an  entirely new source package whose previous
              version was not accepted for release from NEW because of problems
              with copyright or redistributibility; or, exceptionally, for  the
              very first upload with dgit.

It warns me to not use the following for this situation:

       --deliberately-include-questionable-history
              Declare  that  you are deliberately including, in the git history
              of your current push, history which contains a previously-submit‐
              ted version of this package which was not approved  (or  has  not
              yet  been  approved)  by the ftpmasters.  When pushing to Debian,
              only use this option after verifying that: none of the  rejected-
              from-NEW  (or never-accepted) versions in the git history of your
              current push, were rejected by ftpmaster for copyright or  redis‐
              tributability reasons.

/Simon

jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new --deliberately-not-fast-forward -Cgolang-filippo-nistec_0.0.4-3_amd64.changes
Format `3.0 (quilt)', need to check/update patch stack
canonical suite name for unstable is sid
no version available from the archive
nothing quilty to commit, ok.
checking that golang-filippo-nistec_0.0.4-3.dsc corresponds to HEAD
dpkg-source: varning: extraherar osignerat källkodspaket (/home/jas/dpkg/golang-filippo-nistec/../golang-filippo-nistec_0.0.4-3.dsc)
dpkg-source: info: extraherar golang-filippo-nistec i unpacked
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4.orig.tar.gz
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4-3.debian.tar.xz

History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
Taint recorded at time 2026-02-11 00:43:10 Z for any package
Reason: tag archive/debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
Could perhaps be forced using --deliberately.  Consult documentation.

History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
Taint recorded at time 2026-02-11 00:43:10 Z for any package
Reason: tag debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
Could perhaps be forced using --deliberately.  Consult documentation.

dgit: error: pushing tainted objects (which server would reject)
! Push failed, while preparing your push.
! You can retry the push, after fixing the problem, if you like.
jas@frallan:~/dpkg/golang-filippo-nistec$ 

[toc] | [prev] | [next] | [standalone]

#1282317

Simon Josefsson writes ("Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue?"):
> My reading of the man page is that --deliberately-not-fast-forward is
> the relevant parameter for this situation, but it fails (I'm still on
> 14.7~bpo13+1) when I try it now (fortunately for this bug report the
> package was REJECTED again so I got to retry this).

> The package was REJECTED for copyright reasons and the man page says:

Thanks for your careful approach.

We may need to update the documentation.

Did you in fact rewind history to no longer include the REJECT-worthy
material ?

>        --deliberately-not-fast-forward
>
>               When pushing to Debian, use this only when you are
>               making a re‐ newed upload of an entirely new source
>               package whose previous version was not accepted for
>               release from NEW because of problems with copyright or
>               redistributibility; or, exceptionally, for the very
>               first upload with dgit.

This really ought to say that this is only applicable if you actually
rewound the history!  But I think you probably didn't ?

> It warns me to not use the following for this situation:
> 
>        --deliberately-include-questionable-history
>
>               Declare that you are deliberately including, in the
>               git history of your current push, history which
>               contains a previously-submit‐ ted version of this
>               package which was not approved (or has not yet been
>               approved) by the ftpmasters.  When pushing to Debian,
>               only use this option after verifying that: none of the
>               rejected- from-NEW (or never-accepted) versions in the
>               git history of your current push, were rejected by
>               ftpmaster for copyright or redis‐ tributability
>               reasons.

This message is overly cautious.

I see that this package is on Salsa at
  https://salsa.debian.org/go-team/packages/golang-filippo-nistec

I assume that the REJECTed material is included in the history you're
publishing there ?  In which case it is fine to have it on dgit-repos
too, just not your Debianised package.

>  I will hold off upload until I can retry with 14.8 to see if it
> behaves different.

dgit 14.8 won't do anything meaningfully differnet, and neither will
the server software when we update it - the fixes are just to
messages, not to behaviour.

So you may as well go ahead, but presumably we should finish this
conversation (and decide how to fix the docs!) first.

Regards,
Ian.

[toc] | [prev] | [next] | [standalone]

#1282323

[Multipart message — attachments visible in raw view] — view raw

Ian Jackson <ijackson@chiark.greenend.org.uk> writes:

> Simon Josefsson writes ("Bug#1127666: how to recover from intermittent
> SSH push.dgit.d.o issue?"):
>> My reading of the man page is that --deliberately-not-fast-forward is
>> the relevant parameter for this situation, but it fails (I'm still on
>> 14.7~bpo13+1) when I try it now (fortunately for this bug report the
>> package was REJECTED again so I got to retry this).
>
>> The package was REJECTED for copyright reasons and the man page says:
>
> Thanks for your careful approach.
>
> We may need to update the documentation.
>
> Did you in fact rewind history to no longer include the REJECT-worthy
> material ?

No.  Where is rewinding discussed?  I see nothing relevant in dgit(1).

What do you actually mean by "rewind history"?  Is that a
well-established term for anything specific?

> I see that this package is on Salsa at
>   https://salsa.debian.org/go-team/packages/golang-filippo-nistec
>
> I assume that the REJECTed material is included in the history you're
> publishing there ?

Yes.  The copyright REJECTs were because d/copyright had bugs, not
because the content is undistributable.  This seems like common
scenario.

> In which case it is fine to have it on dgit-repos too, just not your
> Debianised package.

Yeah, I don't see the point of force-pushing anything to Salsa to cover
up my mistakes.

>>  I will hold off upload until I can retry with 14.8 to see if it
>> behaves different.
>
> dgit 14.8 won't do anything meaningfully differnet, and neither will
> the server software when we update it - the fixes are just to
> messages, not to behaviour.
>
> So you may as well go ahead, but presumably we should finish this
> conversation (and decide how to fix the docs!) first.

I have tried with 14.8 now.  Naive attempt:

jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new -Cgolang-filippo-nistec_0.0.4-3_amd64.changes
Format `3.0 (quilt)', need to check/update patch stack
canonical suite name for unstable is sid
no version available from the archive
nothing quilty to commit, ok.
checking that golang-filippo-nistec_0.0.4-3.dsc corresponds to HEAD
dpkg-source: varning: extraherar osignerat källkodspaket (/home/jas/dpkg/golang-filippo-nistec/../golang-filippo-nistec_0.0.4-3.dsc)
dpkg-source: info: extraherar golang-filippo-nistec i unpacked
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4.orig.tar.gz
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4-3.debian.tar.xz

History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
Taint recorded at time 2026-02-11 00:43:10 Z for any package
Reason: tag archive/debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
Could perhaps be forced using --deliberately-<something>.  See dgit(1).

History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
Taint recorded at time 2026-02-11 00:43:10 Z for any package
Reason: tag debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
Could perhaps be forced using --deliberately-<something>.  See dgit(1).

dgit: error: pushing tainted objects (which server would reject)
! Push failed, while preparing your push.
! You can retry the push, after fixing the problem, if you like.
jas@frallan:~/dpkg/golang-filippo-nistec$


So a bit better error message, thank you!

Let's follow what I did earlier:


jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new --deliberately-not-fast-forward -Cgolang-filippo-nistec_0.0.4-3_amd64.changes
Format `3.0 (quilt)', need to check/update patch stack
canonical suite name for unstable is sid
no version available from the archive
nothing quilty to commit, ok.
checking that golang-filippo-nistec_0.0.4-3.dsc corresponds to HEAD
dpkg-source: varning: extraherar osignerat källkodspaket (/home/jas/dpkg/golang-filippo-nistec/../golang-filippo-nistec_0.0.4-3.dsc)
dpkg-source: info: extraherar golang-filippo-nistec i unpacked
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4.orig.tar.gz
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4-3.debian.tar.xz

History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
Taint recorded at time 2026-02-11 00:43:10 Z for any package
Reason: tag archive/debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
Could perhaps be forced using --deliberately-<something>.  See dgit(1).

History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
Taint recorded at time 2026-02-11 00:43:10 Z for any package
Reason: tag debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
Could perhaps be forced using --deliberately-<something>.  See dgit(1).

dgit: error: pushing tainted objects (which server would reject)
! Push failed, while preparing your push.
! You can retry the push, after fixing the problem, if you like.
jas@frallan:~/dpkg/golang-filippo-nistec$ 


I can't say that I understand what happened, or why that didn't work,
but I changed approach:


jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new --deliberately-include-questionable-history -Cgolang-filippo-nistec_0.0.4-3_amd64.changes
Format `3.0 (quilt)', need to check/update patch stack
canonical suite name for unstable is sid
no version available from the archive
nothing quilty to commit, ok.
checking that golang-filippo-nistec_0.0.4-3.dsc corresponds to HEAD
dpkg-source: varning: extraherar osignerat källkodspaket (/home/jas/dpkg/golang-filippo-nistec/../golang-filippo-nistec_0.0.4-3.dsc)
dpkg-source: info: extraherar golang-filippo-nistec i unpacked
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4.orig.tar.gz
dpkg-source: info: packar upp golang-filippo-nistec_0.0.4-3.debian.tar.xz
../golang-filippo-nistec_0.0.4-3_amd64.changes already has appropriate .orig(s) (if any)
gpg: VARNING: mottagare (-r) angivna utan att använda publik nyckel-kryptering
gpg: WARNING: server 'gpg-agent' is older than us (2.4.7 < 2.4.8)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.
gpg: VARNING: mottagare (-r) angivna utan att använda publik nyckel-kryptering
gpg: WARNING: server 'gpg-agent' is older than us (2.4.7 < 2.4.8)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.
gpg: Signatur gjord sön 15 feb 2026 21:56:37 CET
gpg:              med EDDSA-nyckeln A3CC9C870B9D310ABAD4CF2F51722B08FE4745A2
gpg:                issuer "simon@josefsson.org"
gpg: Korrekt signatur från "Simon Josefsson <simon@josefsson.org>" [förbehållslös]
gpg: Signatur gjord sön 15 feb 2026 21:56:37 CET
gpg:              med EDDSA-nyckeln A3CC9C870B9D310ABAD4CF2F51722B08FE4745A2
gpg:                issuer "simon@josefsson.org"
gpg: Korrekt signatur från "Simon Josefsson <simon@josefsson.org>" [förbehållslös]
varning: Du verkar ha klonat ett tomt arkiv.
Räknar upp objekt: 1221, klart.
Räknar objekt: 100% (1221/1221), klart.
Deltakomprimering använder upp till 24 trådar
Komprimerar objekt: 100% (356/356), klart.
Skriver objekt: 100% (1221/1221), 1,10 MiB | 225,36 MiB/s, klart.
Totalt 1221 (delta 649), återanvände 1169 (delta 615), paket-återanvända 0 (från 0)
remote: Analyserar delta: 100% (649/649), klart.
remote: To /srv/dgit.debian.org/dispatch-dir/distro=debian/repos/_tmp/golang-filippo-nistec_prospective
remote:  * [new reference]   cb29ed950a89fb3cb77ef97487812cc25c73dfb1 -> refs/dgit/sid
remote:  * [new tag]         3f5b8c87f00b3a78ca8a154b312382a0443274d4 -> archive/debian/0.0.4-3
remote:  * [new tag]         1f2a2966b81dd60e9d6e52f98fc47ad24a3345d8 -> debian/0.0.4-3
remote: To /srv/dgit.debian.org/dispatch-dir/distro=debian/repos/_tmp/golang-filippo-nistec_prospective
remote:  * [new branch]      cb29ed950a89fb3cb77ef97487812cc25c73dfb1 -> master
remote: 
remote: History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
remote: Taint recorded at time 2026-02-11 00:43:10 Z for package golang-filippo-nistec
remote: Reason: tag archive/debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
remote: Uncorrectable error.  If confused, consult administrator.
remote: 
remote: History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
remote: Taint recorded at time 2026-02-11 00:43:10 Z for package golang-filippo-nistec
remote: Reason: tag debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
remote: Uncorrectable error.  If confused, consult administrator.
To git+ssh://push.dgit.debian.org/dgit/debian/repos/golang-filippo-nistec.git
 * [new reference]   cb29ed950a89fb3cb77ef97487812cc25c73dfb1 -> refs/dgit/sid
 * [new tag]         archive/debian/0.0.4-3 -> archive/debian/0.0.4-3
 * [new tag]         debian/0.0.4-3 -> debian/0.0.4-3
 signfile dsc ../golang-filippo-nistec_0.0.4-3.dsc Simon Josefsson <simon@josefsson.org>
gpg: VARNING: mottagare (-r) angivna utan att använda publik nyckel-kryptering
gpg: WARNING: server 'gpg-agent' is older than us (2.4.7 < 2.4.8)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.

 fixup_buildinfo ../golang-filippo-nistec_0.0.4-3.dsc ../golang-filippo-nistec_0.0.4-3_amd64.buildinfo
 signfile buildinfo ../golang-filippo-nistec_0.0.4-3_amd64.buildinfo Simon Josefsson <simon@josefsson.org>
gpg: VARNING: mottagare (-r) angivna utan att använda publik nyckel-kryptering
gpg: WARNING: server 'gpg-agent' is older than us (2.4.7 < 2.4.8)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.

 fixup_changes dsc ../golang-filippo-nistec_0.0.4-3.dsc ../golang-filippo-nistec_0.0.4-3_amd64.changes
 fixup_changes buildinfo ../golang-filippo-nistec_0.0.4-3_amd64.buildinfo ../golang-filippo-nistec_0.0.4-3_amd64.changes
 signfile changes ../golang-filippo-nistec_0.0.4-3_amd64.changes Simon Josefsson <simon@josefsson.org>
gpg: VARNING: mottagare (-r) angivna utan att använda publik nyckel-kryptering
gpg: WARNING: server 'gpg-agent' is older than us (2.4.7 < 2.4.8)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.

Successfully signed dsc, buildinfo, changes files
Uploading golang-filippo-nistec using ftp to ftp-master (host: ftp.upload.debian.org; directory: /pub/UploadQueue/)
running allowed-distribution: check whether a local profile permits uploads to the target distribution
running protected-distribution: warn before uploading to distributions where a special policy applies
running checksum: verify checksums before uploading
running suite-mismatch: check the target distribution for common errors
running gpg: check GnuPG signatures before the upload
Uploading golang-filippo-nistec_0.0.4-3.dsc
Uploading golang-filippo-nistec_0.0.4.orig.tar.gz
Uploading golang-filippo-nistec_0.0.4-3.debian.tar.xz
Uploading golang-filippo-nistec-dev_0.0.4-3_all.deb
Uploading golang-filippo-nistec_0.0.4-3_amd64.buildinfo
Uploading golang-filippo-nistec_0.0.4-3_amd64.changes
dgit ok: pushed and uploaded 0.0.4-3
jas@frallan:~/dpkg/golang-filippo-nistec$ 

I'm not sure if I should hope for ACCEPT or REJECT now...

/Simon

[toc] | [prev] | [next] | [standalone]

#1282331

Control: reopen -1
Control: retitle -1 Docs and messages about NEW/REJECT need overhaul

Simon Josefsson writes ("Re: Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue?"):
> Ian Jackson <ijackson@chiark.greenend.org.uk> writes:
> > Did you in fact rewind history to no longer include the REJECT-worthy
> > material ?
> 
> No.  Where is rewinding discussed?  I see nothing relevant in dgit(1).

Indeed, it's not discussed explicitly.  It's implied by the option
name, but the option doesn't say *what* it's not fast forward from.

> What do you actually mean by "rewind history"?  Is that a
> well-established term for anything specific?

Yes.  Err.  As an experienced git user you must surely be familiar
with this concept.  You must know it by a different name.  The kind of
thing that results in a force push.

If the problematic package had legally dnagerous files, then we would
have to not ship them at all ever, even in git history on Salsa.  So
you'd then need to filter them out (with git-filter-branch or
something maybe, or discarding upstream history entirely, or
something) and the you'd force push to all your Salsa branches.

That.

If you had done that, then you'd need to pass
  --deliberately-not-fast-forward
to tell the dgit git server that yes, you are deliberately force
pushing.  (Normally that's not even allowed by the server; but this
NEW/REJECT state is exceptional.)

But that's not what you've done, and I think it's not what you ought
to have done.

> > I assume that the REJECTed material is included in the history you're
> > publishing there ?
> 
> Yes.  The copyright REJECTs were because d/copyright had bugs, not
> because the content is undistributable.  This seems like common
> scenario.

Right.  --deliberately-include-questionable-history is precisely
right, then.

The system doesn't know what the nature of the problem is.  You just
need to reassure it that your previous commits were merely wrong or
incomplete, rather than legally dangerous.

> Could perhaps be forced using --deliberately-<something>.  See dgit(1).
> 
> dgit: error: pushing tainted objects (which server would reject)
> ! Push failed, while preparing your push.
> ! You can retry the push, after fixing the problem, if you like.
> jas@frallan:~/dpkg/golang-filippo-nistec$
> 
> So a bit better error message, thank you!

When we deploy the server side you'll get a more on-point suggestion
mentioning both these options.

> jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new --deliberately-not-fast-forward -Cgolang-filippo-nistec_0.0.4-3_amd64.changes
...
> History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
> Taint recorded at time 2026-02-11 00:43:10 Z for any package
> Reason: tag archive/debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)
> Could perhaps be forced using --deliberately-<something>.  See dgit(1).

This is expected.  The system doesn't know that that commit wasn't
legally dangerous, and you haven't reassured it.

> I can't say that I understand what happened, or why that didn't work,
> but I changed approach:
> 
> 
> jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new --deliberately-include-questionable-history -Cgolang-filippo-nistec_0.0.4-3_amd64.changes
...
> remote: History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
> remote: Taint recorded at time 2026-02-11 00:43:10 Z for package golang-filippo-nistec
> remote: Reason: tag archive/debian/0.0.4-1 referred to this object in git tree but all previously pushed versions were found to have been removed from NEW (ie, rejected) (or never arrived)

This is expected.

> remote: Uncorrectable error.  If confused, consult administrator.

This message is a lie.  That's #1127378, which is fixed in git but not
deployed it.  It should have printed

  Forcing due to --deliberately-include-questionable-history

The bug is purely to the message - it does in fact continue:

> dgit ok: pushed and uploaded 0.0.4-3
> jas@frallan:~/dpkg/golang-filippo-nistec$ 
> 
> I'm not sure if I should hope for ACCEPT or REJECT now...

So, I think you should hope for an ACCEPT.


I think this exchange demonstrates that our documentation (and perhaps
messages) need rather more work.  I'm reopening this bug.

Would you be willing to cast your eye over our revised docs/message
wording?  Eg by Assigning you Review on Salsa ?

Regards,
Ian.

-- 
Ian Jackson <ijackson@chiark.greenend.org.uk>   These opinions are my own.  

Pronouns: they/he.  If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.

[toc] | [prev] | [next] | [standalone]

#1282417

[Multipart message — attachments visible in raw view] — view raw

Ian Jackson <ijackson@chiark.greenend.org.uk> writes:

> Control: reopen -1
> Control: retitle -1 Docs and messages about NEW/REJECT need overhaul
>
> Simon Josefsson writes ("Re: Bug#1127666: how to recover from
> intermittent SSH push.dgit.d.o issue?"):
>> Ian Jackson <ijackson@chiark.greenend.org.uk> writes:
>> > Did you in fact rewind history to no longer include the REJECT-worthy
>> > material ?
>> 
>> No.  Where is rewinding discussed?  I see nothing relevant in dgit(1).
>
> Indeed, it's not discussed explicitly.  It's implied by the option
> name, but the option doesn't say *what* it's not fast forward from.
>
>> What do you actually mean by "rewind history"?  Is that a
>> well-established term for anything specific?
>
> Yes.  Err.  As an experienced git user you must surely be familiar
> with this concept.  You must know it by a different name.  The kind of
> thing that results in a force push.

Ah.  I think this may partially explain why I haven't understood what
--deliberately-* is about, and consequently have tried hard to avoid
understanding them.

If the documentation would explain what to actually DO in each of a
carefully explained siatuion, maybe that helps people understand better.
Right now I found the text theoretical and not practically relevant.

> If the problematic package had legally dnagerous files, then we would
> have to not ship them at all ever, even in git history on Salsa.  So
> you'd then need to filter them out (with git-filter-branch or
> something maybe, or discarding upstream history entirely, or
> something) and the you'd force push to all your Salsa branches.

Maybe that manual already says that, but I think that explains the
matter succintly in a way I didn't understand before.

I'm trying to ignore that I think this may be a controversial take, or
at least not clearly settled, and I think there are people who believe
storing verbatim upstream code on Salsa is okay even when it doesn't
pass DFSG tests.  But it is fine for tools to support this way of
working.  Encouraging the workflow doesn't have to be dgit(1)'s job.

> If you had done that, then you'd need to pass
>   --deliberately-not-fast-forward
> to tell the dgit git server that yes, you are deliberately force
> pushing.  (Normally that's not even allowed by the server; but this
> NEW/REJECT state is exceptional.)

It's not clear to me what the difference compared to
--deliberately-fresh-repo in practice would be.  In what situation is
that parameter applicable?

>> > I assume that the REJECTed material is included in the history you're
>> > publishing there ?
>> 
>> Yes.  The copyright REJECTs were because d/copyright had bugs, not
>> because the content is undistributable.  This seems like common
>> scenario.
>
> Right.  --deliberately-include-questionable-history is precisely
> right, then.

I think the current documentation in dgit(1) really doesn't say suggest
that, but instead actually says to not use it: "only use this option
after verifying that: none of the rejected-from-NEW ... versions in the
git history of your current push, were rejected by ftpmaster for
copyright ... reasons".  That was what happened here.

>> jas@frallan:~/dpkg/golang-filippo-nistec$ dgit push-built --new
>> --deliberately-not-fast-forward
>> -Cgolang-filippo-nistec_0.0.4-3_amd64.changes
> ...
>> History contains tainted commit 089445ef0355a294a39643e8f4d476fd88844fb5
>> Taint recorded at time 2026-02-11 00:43:10 Z for any package
>> Reason: tag archive/debian/0.0.4-1 referred to this object in git
>> tree but all previously pushed versions were found to have been
>> removed from NEW (ie, rejected) (or never arrived)
>> Could perhaps be forced using --deliberately-<something>.  See dgit(1).
>
> This is expected.  The system doesn't know that that commit wasn't
> legally dangerous, and you haven't reassured it.

I did pass --deliberately-not-fast-forward, shouldn't that reassue it?
Maybe I still don't understand.

> I think this exchange demonstrates that our documentation (and perhaps
> messages) need rather more work.  I'm reopening this bug.
>
> Would you be willing to cast your eye over our revised docs/message
> wording?  Eg by Assigning you Review on Salsa ?

Feel free -- I will try to read and comment, but given that I don't yet
understand this it will be a rather weak review, but hopefully one that
will be useful for you as a "novice user without dgit developer mindset"
reaction.

/Simon

[toc] | [prev] | [next] | [standalone]

#1283012

Simon Josefsson writes ("Bug#1127666: how to recover from intermittent SSH push.dgit.d.o issue?"):
> Ah.  I think this may partially explain why I haven't understood what
> --deliberately-* is about, and consequently have tried hard to avoid
> understanding them.

Hah.  The real underlying mechanism has been ill-documented until now.

> If the documentation would explain what to actually DO in each of a
> carefully explained siatuion, maybe that helps people understand better.
> Right now I found the text theoretical and not practically relevant.

Yes.

I have made an MR dgit!425 which just changes the documentation.
There is a big new section in dgit(7) with it.

It is not very easy to read the groff diffs on salsa.  You can git
fetch the branch and stand in the dgit.git toplevel and say
  make dgit.7.view
If that's awkward for you I can email you a diff of the
rendered-to-text form.

> I'm trying to ignore that I think this may be a controversial take, or
> at least not clearly settled, and I think there are people who believe
> storing verbatim upstream code on Salsa is okay even when it doesn't
> pass DFSG tests.  But it is fine for tools to support this way of
> working.  Encouraging the workflow doesn't have to be dgit(1)'s job.

Yes, I think you are right.

Storing non-DFSG material in upstream git branches on Salsa, and
formerly on Alioth, has been permitted for a very long time.  We had
these conversations when moving from Alioth to the separate dgit git
server, and the conclusion was that that ship had sailed.  (Rightly so
IMO.)

This conclusion needs to be stated clearly in official documentation.

> > If you had done that, then you'd need to pass
> >   --deliberately-not-fast-forward
> > to tell the dgit git server that yes, you are deliberately force
> > pushing.  (Normally that's not even allowed by the server; but this
> > NEW/REJECT state is exceptional.)
> 
> It's not clear to me what the difference compared to
> --deliberately-fresh-repo in practice would be.  In what situation is
> that parameter applicable?

When you're pushing to a distro that isn't Debian.

> I think the current documentation in dgit(1) really doesn't say suggest
> that, but instead actually says to not use it: "only use this option
> after verifying that: none of the rejected-from-NEW ... versions in the
> git history of your current push, were rejected by ftpmaster for
> copyright ... reasons".  That was what happened here.

Yes.  This was overly cautious.

> > This is expected.  The system doesn't know that that commit wasn't
> > legally dangerous, and you haven't reassured it.
> 
> I did pass --deliberately-not-fast-forward, shouldn't that reassue it?
> Maybe I still don't understand.

I'm hoping the new docs I've written will help.

> > Would you be willing to cast your eye over our revised docs/message
> > wording?  Eg by Assigning you Review on Salsa ?
> 
> Feel free -- I will try to read and comment, but given that I don't yet
> understand this it will be a rather weak review, but hopefully one that
> will be useful for you as a "novice user without dgit developer mindset"
> reaction.

That is *precisely* the perspective I am looking for.  A willing
guinea pig who is already confused by all this and knows they don't
understand it :-).

You can tell us if it answers your questions.  Also, tell us if you
think a different structure would be better.  The actual
operationalisable "awht do I do now" is at the end of the section,
both because this is the dgit(7) reference manual so it has a tendency
to go from overview, through cases, to specifics - and because in
certain circumstances we might want to alert the user if they *didn't*
rewrite the branch but should have done.

The MR is here
  https://salsa.debian.org/dgit-team/dgit/-/merge_requests/425
Apparently I can't Request a Review from you because you're connected
enough to the dgit-team project.  I've done a gitlab CC as well as
this email.  I think you should be able to Start Review anyway;
if not please LMK.

Regards,
Ian.

-- 
Ian Jackson <ijackson@chiark.greenend.org.uk>   These opinions are my own.  

Pronouns: they/he.  If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web