[Bug 523093] [NEW] private e-mail address gets stuffed into and published in changes file

[Launchpad Bug Tracker]

You have been subscribed to a public bug by nico (nicolas-pourcelot):

I sign all my Debian and Ubuntu packages with my debian.tormod at ...
address (for which I have a GPG key). Since I use this address for all
public Debian work it is fully disclosed and I have to live with the
spam coming in on it.

After a Debian package of mine got synced into Ubuntu, the changes file
on http://launchpadlibrarian.net (which does not have e-mail addresses
scrambled like on the launchpad package page) includes my *launchpad*
mail account which is a different one. This e-mail address is one I do
not want to publish and is supposed to be between launchpad and me
(although there are other leaks like in bug 111147).

Why is my public e-mail address in the Debian package being replaced by
my launchpad contact address?

For this example, see the
https://launchpad.net/ubuntu/lucid/+source/radeontool/1.6.0-1 page and
click on "View changes file".

EDIT: It seems that whoever files a sync request will get his private
e-mail address disclosed in the resulting changes file. IMO, this should
be changed to leave the Debian uploader address or the address of the
Ubuntu guy who performs the sync.

** Affects: launchpad
     Importance: Low
         Status: Triaged


** Tags: lp-soyuz soyuz-core sync
-- 
private e-mail address gets stuffed into and published in changes file
https://bugs.launchpad.net/bugs/523093
You received this bug notification because you are a member of Ubuntu Sponsors Team, which is subscribed to the bug report.