[Bug 2165173] [NEW] the DFSG repack is invisible: no repacksuffix in d/watch

[Renan Rodrigo]

Public bug reported:

Ubuntu repacks the ceph upstream tarball via `Files-Excluded:`, but
`debian/watch` sets no `repacksuffix` and the version carries no `+dfsg`/`+ds`
marker. A repacked orig and a pristine orig are therefore indistinguishable by
version, and the only visible difference is the file extension (gz vs xz).

This causes confusion when someone ships a new upstream version.
If `uscan` could add a suffix, uploaders/sponsors could have a hint on which source is being used.

The lack of a suffix has caused at least one incorrect upload to stonking, where the pristine tarball from upstream was used instead of the repacked one: https://launchpad.net/ubuntu/+source/ceph/20.2.1-0ubuntu1 
(yes it was me, I'm sorry).

We could:
1. Move `debian/watch` to `version=4`.
2. Add `repacksuffix=+dfsg` (or `+ds`) and fix `dversionmangle` to match.
3. Document in `debian/README.source` that the orig is repacked and that
   `uscan` must be used (not a manual download from download.ceph.com).
4. (not in packaging but worth it) update internal Ceph team docs to refer to this, so backports are smoother.

** Affects: ceph (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to ceph in Ubuntu.
https://bugs.launchpad.net/bugs/2165173

Title:
  the DFSG repack is invisible: no repacksuffix in d/watch

Status in ceph package in Ubuntu:
  New

Bug description:
  Ubuntu repacks the ceph upstream tarball via `Files-Excluded:`, but
  `debian/watch` sets no `repacksuffix` and the version carries no `+dfsg`/`+ds`
  marker. A repacked orig and a pristine orig are therefore indistinguishable by
  version, and the only visible difference is the file extension (gz vs xz).

  This causes confusion when someone ships a new upstream version.
  If `uscan` could add a suffix, uploaders/sponsors could have a hint on which source is being used.

  The lack of a suffix has caused at least one incorrect upload to stonking, where the pristine tarball from upstream was used instead of the repacked one: https://launchpad.net/ubuntu/+source/ceph/20.2.1-0ubuntu1 
  (yes it was me, I'm sorry).

  We could:
  1. Move `debian/watch` to `version=4`.
  2. Add `repacksuffix=+dfsg` (or `+ds`) and fix `dversionmangle` to match.
  3. Document in `debian/README.source` that the orig is repacked and that
     `uscan` must be used (not a manual download from download.ceph.com).
  4. (not in packaging but worth it) update internal Ceph team docs to refer to this, so backports are smoother.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/2165173/+subscriptions