Import from Debian fails for source packages with included tarball .asc

[Jeremy Bícha]

SRU justification:

[Impact] Launchpad can't import some source packages from Debian unstable. The fix is to cherry-pick changes from unstable that support unpacking (but, for minimality, not creating) such source packages.
[Test Case] For the format 3.0 case, download the limnoria source package from Debian unstable and unpack it with "dpkg-source -x". For the format 1.0 case, there are no examples as yet in unstable, but it's easy to construct one: download a 1.0 package (e.g. makepasswd), sign its .orig.tar.gz with "gpg --armor --clearsign", rebuild the source package using unstable's toolchain, and then try to unpack it with "dpkg-source -x" in precise/trusty.
[Regression Potential] Confined to "dpkg-source -x", so it should be sufficient to check that unpacking packages without .orig.*.asc still works.

Original report follows:

https://launchpad.net/debian/+source/vlc/ is missing Debian branches for sid and stretch.

This then also breaks auto-sync of some of Debian's packages to Ubuntu's development branch.

This is apparently what broke the auto-import:

dpkg-source: error: unrecognized file for a v2.0 source package:
vlc_2.2.3.orig.tar.xz.asc

See this discussion about including .asc files in Debian source packages which requires dpkg to be updated:
https://lists.debian.org/debian-dpkg/2016/05/msg00041.html

Initial discussion:
http://irclogs.ubuntu.com/2016/05/31/%23ubuntu-devel.html#t22:44

[Colin Watson (cjwatson)]

In order to fix this, we'll need to cherry-pick the patches to allow extraction (but not building!) of such source packages back to precise/trusty/xenial dpkg.

[Colin Watson (cjwatson)]

... but note that we need to model the new source package files in Launchpad first.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r18083 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/18083>.

[Colin Watson (cjwatson)]

Can't test this properly until the dpkg backport is in place, but at least ordinary uploads still work fine.

[Jeremy Bícha (jbicha)]

vlc was auto-synced to yakkety because a new version was uploaded to Debian that did not include the .asc.

https://launchpad.net/debian/+source/limnoria is a good test case then.

[Mattia Rizzolo (mapreri)]

with dpkg's xenial I can happily `dpkg-source -x` a package with a .asc file. Indeed trusty and precise (?) need to be patched for them.

[Chris J Arges (arges)]

Hello Jeremy, or anyone else affected,

Accepted dpkg into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dpkg/1.17.5ubuntu5.7 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris J Arges (arges)]

Hello Jeremy, or anyone else affected,

Accepted dpkg into precise-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dpkg/1.16.1.2ubuntu7.8 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Colin Watson (cjwatson)]

All looks fine in both precise-proposed and trusty-proposed.

[Launchpad Janitor (janitor)]

This bug was fixed in the package dpkg - 1.16.1.2ubuntu7.8

---------------
dpkg (1.16.1.2ubuntu7.8) precise; urgency=medium

  * Backport from Debian (LP: #1587667):
    - Allow detached upstream signatures for upstream orig.tar files in the
      .dsc file. Suggested by Daniel Kahn Gillmor <email address hidden>.
      Closes: #759478
    - Allow detached upstream orig tarball signatures when extracting
      version 1.0 non-native source packages.

 -- Colin Watson <email address hidden> Tue, 14 Jun 2016 19:22:53 +0100

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for dpkg has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package dpkg - 1.17.5ubuntu5.7

---------------
dpkg (1.17.5ubuntu5.7) trusty; urgency=medium

  * Backport from Debian (LP: #1587667):
    - Allow detached upstream signatures for upstream orig.tar files in the
      .dsc file. Suggested by Daniel Kahn Gillmor <email address hidden>.
      Closes: #759478
    - Allow detached upstream orig tarball signatures when extracting
      version 1.0 non-native source packages.

 -- Colin Watson <email address hidden> Tue, 14 Jun 2016 19:31:28 +0100

[Jeremy Bícha (jbicha)]

limnoria has been imported to LP's Debian branch and successfully auto-synced to yakkety. Thank you!

[Mattia Rizzolo (mapreri)]

yay!
(limnoria maintainer)