Bug#740366: uscan: issues with PGP signature (re-)verification

[Thorsten Glaser]

Package: devscripts
Version: 2.14.1
Severity: minor

Hi developers,

I’ve ran into uscan issues with mediawiki’s new release today:

First off, I ran “uscan --verbose” as usual, which got me both
the distfile and its signature file downloaded, but checking it
failed because someone else from the Mediawiki team signed it.

Ok, I thought, then let’s “just” add their key to the upstream
signing key file, too (after some amount of gpg --check-sigs,
of course). But uscan just returned success without doing anything.

I then deleted the sig file. uscan still returned success
without doing anything, instead of, like dget, redownloading
the sig file and checking it. (This is what makes this bug’s
severity “minor” instead of “wishlist”.)

I literally had to delete and redo the *entire* download for
uscan to do its secondary job.

Really, if you add non-downloading functions to a downloading
tool, you ought to also include a mode in which it skips the
actual http download and just does these other things.


-- Package-specific info:

--- /etc/devscripts.conf ---

--- ~/.devscripts ---
DEBCHANGE_AUTO_NMU=no
DEBCHANGE_MAINTTRAILER=no
DEBCHANGE_MULTIMAINT_MERGE=yes
DEBCHANGE_RELEASE_HEURISTIC=log

-- System Information:
Debian Release: jessie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (100, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 3.13-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/lksh

Versions of packages devscripts depends on:
ii  dpkg-dev     1.17.6
ii  libc6        2.18-3
ii  perl         5.18.2-2
ii  python3      3.3.4-1
pn  python3:any  <none>

Versions of packages devscripts recommends:
ii  at                          3.1.14-1
ii  curl                        7.35.0-1
ii  dctrl-tools                 2.23
ii  debian-keyring              2014.01.31
ii  dput                        0.9.6.4
pn  equivs                      <none>
ii  fakeroot                    1.20-3
ii  gnupg                       1.4.16-1.1
pn  libdistro-info-perl         <none>
ii  libencode-locale-perl       1.03-1
ii  libjson-perl                2.61-1
ii  liblwp-protocol-https-perl  6.04-2
pn  libparse-debcontrol-perl    <none>
pn  libsoap-lite-perl           <none>
ii  liburi-perl                 1.60-1
ii  libwww-perl                 6.05-2
ii  lintian                     2.5.21
ii  man-db                      2.6.6-1
ii  patch                       2.7.1-4
ii  patchutils                  0.3.2-3
pn  python3-debian              <none>
pn  python3-magic               <none>
ii  sensible-utils              0.0.9
ii  strace                      4.5.20-2.3
ii  unzip                       6.0-10
ii  wdiff                       1.2.1-2
ii  wget                        1.15-1
ii  xz-utils                    5.1.1alpha+20120614-2

Versions of packages devscripts suggests:
ii  bsd-mailx [mailx]            8.1.2-0.20131005cvs-1
ii  build-essential              11.6
pn  cvs-buildpackage             <none>
pn  devscripts-el                <none>
pn  gnuplot                      <none>
ii  gpgv                         1.4.16-1.1
pn  libauthen-sasl-perl          <none>
pn  libfile-desktopentry-perl    <none>
ii  libnet-smtp-ssl-perl         1.01-3
pn  libterm-size-perl            <none>
ii  libtimedate-perl             2.3000-1
pn  libyaml-syck-perl            <none>
pn  mutt                         <none>
ii  openssh-client [ssh-client]  1:6.5p1-4
pn  svn-buildpackage             <none>
ii  w3m                          0.5.3-15

-- Configuration Files:
/etc/bash_completion.d/devscripts.pkgnames [Errno 2] No such file or directory: u'/etc/bash_completion.d/devscripts.pkgnames'

-- no debconf information