Path: csiph.com!newsfeed.xs4all.nl!newsfeed9.news.xs4all.nl!news.dns-netz.com!news.freedyn.net!aioe.org!bofh.it!news.nic.it!robomod From: =?UTF-8?Q?Louis-Philippe_V=c3=a9ronneau?= Newsgroups: linux.debian.maint.python Subject: Re: Newcomers project: DPMT/PAPT pristine-tar verification Date: Tue, 06 Oct 2020 18:10:02 +0200 Message-ID: References: X-Original-To: debian-python@lists.debian.org X-Mailbox-Line: From debian-python-request@lists.debian.org Tue Oct 6 16:08:07 2020 Old-Return-Path: X-Amavis-Spam-Status: No, score=-11.098 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, BODY_8BITS=1.5, FOURLA=0.1, LDO_WHITELIST=-5, PGPSIGNATURE=-5, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate:hard: -4.6 X-Riseup-User-ID: CD3000F9C0A8AE50A3103DCE80FFC74019ED6EE317847B9332E778FAC84391D7 Autocrypt: addr=pollo@debian.org; prefer-encrypt=mutual; keydata= mQINBFSX1NABEADH76idoFsToCSwRrCJAqoZMPFWNGdK5+lMpxfVxb3GQYzEmxexkqq2ga/N oUlEs1jKY7F513uDARm2IVsE4ypq3TqYYZtSIr+27NvWUCAleFTBcTRvlo6pdBwaF9bENRgg uoMuHdY8OkNxg1jhwiq0kWpImD1K91NokKiX/9GebCIsr3J5ETafJ+pcHc6N3v8BIC2C8QAu c+fh5Atb9qZglNdFQ9orFkvCDKvaa6ZOymwpAW27JLY1NjSj8S+bLle2XKC3mNq2jtVN0vX0 V9UrNEOHpXokuFLXQFoGZGdqyQBBG3Hj9q0+NAJxMmNbBcOroOIDLyuyVFTWngaoU7m+Tlsm enB0T38ifOV5oefO9B+X8kqi0G3OdhNR/m4NC50q5QXkhis6195f4tdlBZQtipLygAOoeenx XRnxbKNoNA2PUz5FRBzPytsNnmkW80tY0eleZ6lXmO1Kuas3jaQOtBMl2HuBO6wn0QAhFmze qfq5gbexu4iCZYlnUkqCYsiFkrjyPUo+o/bDMTGz7sSrrv9W1Rg4lTiaAiysaPZ3HeSBGTF8 feHXPkwfCZiimFU7ojildMqkq6ZWIAdoMdYi8CGYCxg+xtapXASsTeXJ7Om6R+TBaaV9WNBy WOHhOLCI57bm0dQ8HwqB/rNufYooGXyRDDLMcbLGhu64iPYN1wARAQABtDVMb3Vpcy1QaGls aXBwZSBWw6lyb25uZWF1IChkZWJpYW4pIDxwb2xsb0BkZWJpYW4ub3JnPokCVAQTAQoAPgIb IwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBGd/VPH6hoGtjsC85nrqxOxqqgqXBQJe1qOQ BQkMIAIwAAoJEHrqxOxqqgqXpMIP/2wnDQ6nskKgCx04r+WnZ4yL9N7ibYA3x9XgEeRJMCgZ 2Am1CMYwNLgRoMveX5AuRr2NoBtVZxBKd7Fkt6BXSXVWLVoFBQOoeoM8Ey7LcVCkjhetSKS1 F8VDgi7NllA58k91dCXYomtaPuHLrHHTjMqKnKolKJywqZWQ+7yGo4nUH6ZiAFPGaIXmQlrq GyNmQVCtIa6XXkaqrmPCMgPo2j260OX8MWxitnMltKqUQgvj9P2TaXI+N+jj6NRzQ/4nuEh2 AqfoWB2DpMVEWW9WZcHf1p2C+J5sJkRyM0ImV1f2eo/XGJl99+jceVsQ/Ljb3pm77Ywu5/zN fCNmjfVcnnPRyln46A3A1lWAKN3zYNECgFa6L1reOm08LL2NDHFzg0jg5Q1fg4NRct4JFPN1 +7ifBDAIO5Mi0AaR0ygw+ImSVQs54ufmcGlLA1UwXgU1lkOL4exrmivqGiutkrYU0O/17Eyf a9bjILuqGQP2YrjJCvT6xtNSWeDOS/uPTMBT/pjM1VbgruBesHZ8jCwzfDI5GYsipT2HELst fS0YNg6yt5WqUDil+wTmieluoTJaaEmx+pSRRjdl7sUKk2D7o6dNyoQL4ijRBHAOk2x2HkJh EaYbidcbfopTbxgc8zYrC8ilg92HMXWtrzL85S66lkLrtD5a2Zxp41q3p+y6g1m9uQINBFSX 1NABEAC28f43K11snkvXvQsDKKyCELMeCzh4CkQ/QvalGns6ALo/SnJ+XjtaTQz1Ubx7T4Be 6Xlp7I069bv/xhV/1GrvbAE6UUJE9VF0iry2AkHr7Ug4pIqVcelMQkSYaMVUKYrGtyxOxvjn zJ4++kvzpo5cqELeywVnSdYo3ApZqDZbirEqLzehj/WyMk2kAQYdhtZDOlPmroQBRH8VvRZd u6IqOjME5T2AlG1D4YGm/tQsQl4mcK40BPGeyOECnKRD2dCfO5BJaEO91B1lYtiXqJd/e1dU Oj2vetvMmIPhYyJJHWOK7dANM/sleaygplVfCbICCM5StvBVV5k4Zu94gg+3N/DU2rOOPnMg eO2MG63qSGR2A8Id2f0/zL6rBrvOQxXRyI62qWPzwHksDxOXCId/OlUcUf5iejNouubRrnNA 8Z4J88wcdQ6sjW0FlaPp2YCeq2z2OLb/iTxgZrMYn6cOhZqDNB3pGh2l/dCxmfOm6dB5dvAL Fv1XjNEJIr6NgcZusMS2YoPDDNv1dIzf3EIEDpLR1zuTsTXhqUfinPrrJsFWLo1/lay2t+1c mobPKJgEzESKG5260Jv6pltc/jM3FSYAUgvaSO2/Rmyt7tfBnreBDPS5HUqQSdyh5/1lbkuZ +7zU+ikFdSa5lQIammrYePDxPgX5rlqSAUghaFFqHQARAQABiQI8BBgBCgAmAhsMFiEEZ39U 8fqGga2OwLzmeurE7GqqCpcFAl7Wo5AFCQwgAkAACgkQeurE7GqqCpc8qw/+IGLlNcdqmeFv shT0l1iXOxLZGkkA6Iousf0jbtKIVShAffcA+Wi2yg0N9P8zXQc463RSsyNpWbxqzlAUgFp5 x0BoC1nWbFif1WtrSroQYQI3TfAHeJAL3uKTf0+vp+OySujplsPKM+13XtjMxf2nZvtwvf6N QCFfDnf3OFD0yNkdYrB1vl5FQUShzCSyLDVLevmEITDCEEvdogyaQWjC7qTZ4yIBd1oeztx9 ydAcCvuKcMgLuhhGtpfMiwgLH8yLBEh2nzs9j0RdHf6HqRGFRFkmxiVdOIsphSfTssqsGUiT JuJ8W2yBR4MeU8EMfLvA/Sear1TraQ71nr85fV17e7CskOJRnPwHjHBjmETCAp81n/l/9WiM p2RZ/Q7hTlQsps2xLgiP5oMA/ftAZianXhxALL5+0H6bsDtVrfynKWWsiMNwzjsiaDP6DSQC R8U2obul/KXIKM+w4CMphzuJsq9bSjFWINOF6Etn7bJAZxvAGJ3O0SIlS1DAQ+4Gk+VOEI0Z 40aJvBRHlWYQhqFgV40RXqNiPkWknR9XL2FWHRa8wAzvfcbuMfJshviZ9vVpprEdm1ii6TQM XmhN2gedZrYCQFeciDE/h6nbmMXic4TbrQzlsKp3ogBI/CLC+6/cvX10BrswdjY9nwiN9EHq SiSO38HQlglbq920nym73XQ= MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="OfRVrBUJHy16yPvxTDOyTjEfSiXcf5j1v" X-Mailing-List: archive/latest/18688 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/85853c9e-0111-4194-4537-d3e26022e5a6@debian.org Approved: robomod@news.nic.it Lines: 116 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Tue, 6 Oct 2020 12:07:43 -0400 X-Original-Message-ID: <85853c9e-0111-4194-4537-d3e26022e5a6@debian.org> X-Original-References: Xref: csiph.com linux.debian.maint.python:12929 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --OfRVrBUJHy16yPvxTDOyTjEfSiXcf5j1v Content-Type: multipart/mixed; boundary="wwaXbvIFJFiUQDFoYChUYWJEoDtX8CLLR" --wwaXbvIFJFiUQDFoYChUYWJEoDtX8CLLR Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 2020-10-03 15 h 35, Sandro Tosi wrote: > attached the dd-list of the packages missing the pristine-tar branch (s= ome > may have been moved/removed, but these are actual repos in DPT) >=20 > On Fri, Jul 10, 2020 at 12:38 AM Sandro Tosi wrote: >=20 >> Hello, >> i would like to propose a project to make sure our teams (DPMT/PAPT) >> repos are using pristine-tar properly. >> >> The checks i have in mind for now, are: >> >> * pristine-tar branch must exist, if not -> it's a bug >> * pristine-tar + upstream branch must produce the same tarball as >> downloaded from the archive, if not -> it's a bug >> * bonus point: fix the repo if it doesn't generate the right tarball >> and or the branch is missing. >> * bonus point: make this into a service that runs regularly (not >> strictly necessary to be limited to us) >> >> i guess we should have a brief discussion about additional checks >> and/or procedures before "assigning" it to a volunteer. let's say up >> to 2 weeks of discussion, and during the same period volunteers can >> nominate themselves. >> >> I marked this project as newcomers as it doesn't require to be a DD/DM= >> to work on it, you just need a salsa account and access to our teams. >> a handy tool to retrieve all our repos is at >> >> https://salsa.debian.org/python-team/tools/python-modules >> https://salsa.debian.org/python-team/tools/python-apps >> >> that contains a config file for `mr` and a `checkout` script to fetch >> the repos registered in that config file. >> >> Please feel free to discuss this project now :) I had a chat with folks in #debian-qa last night, as I agree such checks would be nice to have. 1. Lintian is not suited for that kind of checks, as it does not have network access. Frankensteining lintian to do that kind of stuff would surely be met with fierce opposition. 2. The vcswatch script [1] from the QA team already does something akin to what we would want. It's written in Perl [2], but doesn't look terribly complicated. When a check doesn't pass, it issues an action-item like this one [3]. I think the first step would be modifying vcswatcher to issue warnings fo= r: * the absence of pristine-tar branches * missing git tags * repositories using 'master' instead of 'debian/master' as the main bran= ch Once these are flagged, we can easily script a way to fix them, maybe even using lintian-brush? As for the problem of pristine-tar and the upstream branch not producing the same tarballs, I think it would be best to have that done in another script altogether. Cheers, [1]: https://qa.debian.org/cgi-bin/vcswatch [2]: https://salsa.debian.org/qa/qa/-/blob/master/cgi-bin/vcswatch [3]: https://tracker.debian.org/action-items/1469895 --=20 =E2=A2=80=E2=A3=B4=E2=A0=BE=E2=A0=BB=E2=A2=B6=E2=A3=A6=E2=A0=80 =E2=A3=BE=E2=A0=81=E2=A2=A0=E2=A0=92=E2=A0=80=E2=A3=BF=E2=A1=81 Louis-= Philippe V=C3=A9ronneau =E2=A2=BF=E2=A1=84=E2=A0=98=E2=A0=B7=E2=A0=9A=E2=A0=8B pollo@debian.o= rg / veronneau.org =E2=A0=88=E2=A0=B3=E2=A3=84 --wwaXbvIFJFiUQDFoYChUYWJEoDtX8CLLR-- --OfRVrBUJHy16yPvxTDOyTjEfSiXcf5j1v Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEZ39U8fqGga2OwLzmeurE7GqqCpcFAl98lk8ACgkQeurE7Gqq Cpf7gRAAovN6mCONZzN8sLQ2qxm+O8yadHKUcZs+nWRNaGuzgzwNs2BfLeIp1z9m 2oXpE5+5voo8y5DHt2ctItZg3t+XQTtjWh+Jv4YapH+j+Wl3ey9qyF6YgD4OeiOo yKiK4KyljJUI2QMgKeXjLIEGFZgwrQTi8+o1mEpIEx/nVVF7yL1XxslYKw/V46W1 mQO9RqHe9aWhBtMfMeQyonJPPWjOkM66yn9H4B3lXxLH8/bmyQavfyPo5BlXM5vM Hr7tAgsFmtzR63jJuazajIzwopJ+qjODUPWuQekNJpy/T/OeHPeCY+ecqFE4e8H/ 2AHVLp0tICKvZEUvDeN13n0E2tyXBe3QiyXaudp80JUZeSS7DHKdXDrfTP0j275E UVX/W1rAZo+qkQ8E7B0g5qJmDCgEPiAJxgTKQ0id7OXSRT2dMG6y7WdEj0qa4UBf Y1Pl3knvyiFMza6hOlEtDGgVi+7ivSgTiDQJ0DUSzby9w91aEnqFaImFG52Wr/Av 988TJJf2LTe1SdmkquJtV1LF7tB0dR5TnRb3RrTrZML5qDEMjH60++31vqm9jeGn TGBRRwnr3KiiWS3LxtW7kUnbb7gAPGDgOrmhTbfE6Pl0DgLfGrGd0gUS1fvSjHSg iFG5MjFdGZxpDBjT6W3qUWCHew4v7Se23u5El98muwRAnTH5bLI= =0n1J -----END PGP SIGNATURE----- --OfRVrBUJHy16yPvxTDOyTjEfSiXcf5j1v--