Hi Lucas,

I'll answer your first few questions:

> Source packag name

It's called arm-trusted-firmware-s32 as it's a fork of arm-trusted-firmware with added support for the NXP S32 family of SoCs. This fork is incompatible with (and a different version to) the arm-trusted-firmware package already present in the archives.

> here is also a typo in the filenamemangle option

Thanks for catching that - I've changed it.

> When trying to run uscan to download the version your are packaging it fails 

This works fine for me (after fixing the filenamemangle):

$ uscan --verbose --download-version 2.5-bsp37.0
uscan info: uscan (version 2.22.1ubuntu1) See uscan(1) for help
uscan info: Scan watch files in .
uscan info: Check debian/watch and debian/changelog in .
uscan info: package="arm-trusted-firmware-s32" version="2.5-bsp37.0-8" (as seen in debian/changelog)
uscan info: package="arm-trusted-firmware-s32" version="2.5-bsp37.0" (no epoch/revision)
uscan info: ./debian/changelog sets package="arm-trusted-firmware-s32" version="2.5-bsp37.0"
uscan info: Process watch file at: debian/watch
    package = arm-trusted-firmware-s32
    version = 2.5-bsp37.0
    pkg_dir = .
uscan info: opts: filenamemangle=s/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz/arm-trusted-firmware-s32-$2-$1\.tar\.gz/,uversionmangle=s/(bsp\d+\.\d+).(\d+\.\d+)/$2-$1/,
uscan info: line: https://github.com/nxp-auto-linux/arm-trusted-firmware/tags .*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz
uscan info: Parsing filenamemangle=s/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz/arm-trusted-firmware-s32-$2-$1\.tar\.gz/
uscan info: Parsing uversionmangle=s/(bsp\d+\.\d+).(\d+\.\d+)/$2-$1/
uscan info: line: https://github.com/nxp-auto-linux/arm-trusted-firmware/tags .*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz
uscan info: Last orig.tar.* tarball version (from debian/changelog): 2.5-bsp37.0
uscan info: Download the --download-version specified version: 2.5-bsp37.0
uscan info: Requesting URL:
   https://github.com/nxp-auto-linux/arm-trusted-firmware/tags
uscan info: Matching pattern:
   (?:(?:https://github.com)?\/nxp\-auto\-linux\/arm\-trusted\-firmware\/)?.*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz
uscan info: Found the following matching hrefs on the web page (newest first):
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp38.0-2.5.tar.gz (2.5-bsp38.0) index=2.5-bsp38.0-1
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp38.0-2.5.tar.gz (2.5-bsp38.0) index=2.5-bsp38.0-1
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp37.0-2.5.tar.gz (2.5-bsp37.0) index=2.5-bsp37.0-1 matched with the download version
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp37.0-2.5.tar.gz (2.5-bsp37.0) index=2.5-bsp37.0-1 matched with the download version
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp36.0-2.5.tar.gz (2.5-bsp36.0) index=2.5-bsp36.0-1
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp36.0-2.5.tar.gz (2.5-bsp36.0) index=2.5-bsp36.0-1
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp35.0-2.5.tar.gz (2.5-bsp35.0) index=2.5-bsp35.0-1
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp35.0-2.5.tar.gz (2.5-bsp35.0) index=2.5-bsp35.0-1
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp34.2-2.5.tar.gz (2.5-bsp34.2) index=2.5-bsp34.2-1
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp34.2-2.5.tar.gz (2.5-bsp34.2) index=2.5-bsp34.2-1
uscan info: Looking at $base = https://github.com/nxp-auto-linux/arm-trusted-firmware/tags with
    $filepattern = .*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz found
    $newfile     = https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp37.0-2.5.tar.gz
    $newversion  = 2.5-bsp37.0
    $lastversion = 2.5-bsp37.0
uscan info: Matching target for downloadurlmangle: https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp37.0-2.5.tar.gz
uscan info: Upstream URL(+tag) to download is identified as    https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp37.0-2.5.tar.gz
uscan info: Matching target for filenamemangle: https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp37.0-2.5.tar.gz
uscan info: Filename (filenamemangled) for downloaded file: arm-trusted-firmware-s32-2.5-bsp37.0.tar.gz
uscan: Newest version of arm-trusted-firmware-s32 on remote site is 2.5-bsp37.0, specified download version is 2.5-bsp37.0
uscan info: Downloading upstream package: bsp37.0-2.5.tar.gz
uscan info: Requesting URL:
   https://github.com/nxp-auto-linux/arm-trusted-firmware/archive/refs/tags/bsp37.0-2.5.tar.gz
uscan info: Successfully downloaded upstream package: bsp37.0-2.5.tar.gz
uscan info: Renamed upstream package to: arm-trusted-firmware-s32-2.5-bsp37.0.tar.gz
uscan info: Start checking for common possible upstream OpenPGP signature files
uscan info: End checking for common possible upstream OpenPGP signature files
uscan info: Missing OpenPGP signature.
uscan info: New orig.tar.* tarball version (oversionmangled): 2.5-bsp37.0
uscan info: Launch mk-origtargz with options:
   --package arm-trusted-firmware-s32 --version 2.5-bsp37.0 --compression default --directory .. --copyright-file debian/copyright ../arm-trusted-firmware-s32-2.5-bsp37.0.tar.gz
Successfully symlinked ../arm-trusted-firmware-s32-2.5-bsp37.0.tar.gz to ../arm-trusted-firmware-s32_2.5-bsp37.0.orig.tar.gz.
uscan info: New orig.tar.* tarball version (after mk-origtargz): 2.5-bsp37.0
uscan info: Scan finished


I'll fix up the other things you mentioned now.

Cheers,
Isaac