Bug#827814: [uscan] Please always download the newest of all versions if more than one main upstream tarball is listed (i.e. consider it a feature, not a problem)

[Axel Beckert]

Package: devscripts
Version: 2.16.5
Severity: wishlist
File: /usr/bin/uscan

Hi,

I've got several upstreams which have several places where they publish tar
balls.

There are at least three kinds of cases:

1. Not that seldom it's a combination of sometimes less reliable (but
   earlier filled) developer-maintained/-centric primary server and a
   reliable mirror network.

   (More or less) example: screen

   https://ftp.gnu.org/gnu/screen/screen-([\d\.]+)\.tar\.gz
   http://download.savannah.gnu.org/releases/screen/screen-([\d\.]+)\.tar\.gz

2. Another case are beta releases and final releases being in
   different directories, but I want to track both.

   Example: zsh

   http://www.zsh.org/pub/zsh-(\d[^\sd]*)\.(?:tgz|tbz2|txz|tar\.(?:gz|bz2|xz))
   http://www.zsh.org/pub/development/zsh-(\d[^\sd]*)\.(?:tgz|tbz2|txz|tar\.(?:gz|bz2|xz))

3. A third case are upstreams which sometimes forget to upload
   manually build tar balls to Github, but have already tagged their
   new upstream release.

   Example (from a recent NMU of mine, still waiting in DELAYED/10): flashbake

   http://github.com/commandline/flashbake/releases /commandline/flashbake/archive/(.*)\.tar\.gz
   http://github.com/commandline/flashbake/downloads /downloads/commandline/flashbake/flashbake-(.*)\.tar\.gz

>From my point of view, these are all perfectly sane usages of more
than one main upstream tarballs.

Unfortunately, at least in the 2rd case, if the first line finds a
newer version, an even newer version from the second line is ignored
and not the newest version is downloaded.

So please fully support such setups, always download the newest
version over all download sites specificed and don't emit "uscan warn:
more than one main upstream tarballs listed." about such setups
anymore.

Additionally, such watch files cause false positives in PTS and
Tracker because this warning is considered to be an error by PTS and
Tracker and shows up there as TODO. Examples:

  https://packages.qa.debian.org/s/screen.html
  https://tracker.debian.org/pkg/screen
  https://packages.qa.debian.org/z/zsh.html
  https://tracker.debian.org/pkg/zsh
  https://packages.qa.debian.org/f/flashbake.html
  https://tracker.debian.org/pkg/flashbake

-- Package-specific info:

--- /etc/devscripts.conf ---

--- ~/.devscripts ---
DEBUILD_DPKG_BUILDPACKAGE_OPTS="-k2FF9CD59612616B5 -i"
DSCVERIFY_KEYRINGS=/home/abe/.gnupg/pubring.gpg
DEBUILD_LINTIAN_OPTS="-iIE --pedantic"

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (990, 'unstable'), (600, 'testing'), (500, 'unstable-debug'), (500, 'buildd-unstable'), (400, 'stable'), (110, 'experimental'), (1, 'experimental-debug'), (1, 'buildd-experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.5.0-trunk-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages devscripts depends on:
ii  dpkg-dev     1.18.7
ii  libc6        2.22-12
ii  perl         5.22.2-1
pn  python3:any  <none>

Versions of packages devscripts recommends:
ii  apt                         1.2.13
pn  at                          <none>
ii  curl                        7.47.0-1
ii  dctrl-tools                 2.24-2
ii  debian-keyring              2016.06.19
ii  dput-ng [dput]              1.10
ii  dupload                     2.7.0
ii  equivs                      2.0.9+nmu1
ii  fakeroot                    1.20.2-2
ii  file                        1:5.25-2
ii  gnupg                       1.4.20-6
ii  gnupg2                      2.1.11-7
ii  libdistro-info-perl         0.14
ii  libencode-locale-perl       1.05-1
ii  liblwp-protocol-https-perl  6.06-2
ii  libsoap-lite-perl           1.19-1
ii  liburi-perl                 1.71-1
ii  libwww-perl                 6.15-1
ii  lintian                     2.5.45
ii  man-db                      2.7.5-1
ii  patch                       2.7.5-1
ii  patchutils                  0.3.4-1
ii  pseudo [fakeroot]           1.7.5-5
ii  python3-debian              0.1.28
ii  python3-magic               1:5.25-2
ii  sensible-utils              0.0.9
ii  strace                      4.12-3
ii  unzip                       6.0-20
ii  wdiff                       1.2.2-1+b1
ii  wget                        1.18-1
ii  xz-utils                    5.1.1alpha+20120614-2.1

Versions of packages devscripts suggests:
ii  bsd-mailx [mailx]            8.1.2-0.20160123cvs-3
ii  build-essential              12.2
ii  cvs-buildpackage             5.26
ii  devscripts-el                35.12
ii  diffoscope                   54
pn  dose-extra                   <none>
ii  gnuplot                      5.0.3+dfsg3-7
ii  gpgv                         1.4.20-6
ii  gpgv2                        2.1.11-7
ii  libauthen-sasl-perl          2.1600-1
ii  libfile-desktopentry-perl    0.22-1
ii  libnet-smtp-ssl-perl         1.03-1
ii  libterm-size-perl            0.207-1+b3
ii  libtimedate-perl             2.3000-2
ii  libyaml-syck-perl            1.29-1+b1
ii  mozilla-devscripts           0.45.1
ii  mutt                         1.6.0-1
ii  openssh-client [ssh-client]  1:7.2p2-5
ii  s-nail [mailx]               14.8.8-1
ii  svn-buildpackage             0.8.5+nmu1
ii  w3m                          0.5.3-28

-- no debconf information