Debian Bug report logs - #10253
dpkg-dev: dpkg-buildpackage signs using the value for Maintainer:

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Herbert Xu <herbert@greathan.apana.org.au>

To: submit@bugs.debian.org

Subject: dpkg-dev: dpkg-buildpackage signs using the value for Maintainer:

Date: Sun, 1 Jun 1997 10:55:24 +1000

Package: dpkg-dev
Version: 1.4.0.17

This causes a lot of trouble for me since my pgp key includes my own email
address which differs from the one in Maintainer.  Previous versions of
dpkg-dev did not do this.  There should be an option to either revert to the
old behaviour or to specify the key to use.

-- System Information
Debian Release: 1.3
Kernel Version: Linux greathan 2.0.29 #1 Wed Apr 9 08:02:37 EST 1997 i586 unknown

Message #10 received at 10253@bugs.debian.org (full text, mbox, reply):

From: "Christian Hudon" <chudon@ee.mcgill.ca>

To: Herbert Xu <herbert@greathan.apana.org.au>, 10253@bugs.debian.org

Subject: Re: Bug#10253: dpkg-dev: dpkg-buildpackage signs using the value for Maintainer:

Date: Sun, 1 Jun 1997 00:55:18 +0000

[Message part 1 (text/plain, inline)]

On Jun 1, Herbert Xu wrote
> Package: dpkg-dev
> Version: 1.4.0.17
> 
> This causes a lot of trouble for me since my pgp key includes my own email
> address which differs from the one in Maintainer.  Previous versions of
> dpkg-dev did not do this.  There should be an option to either revert to the
> old behaviour or to specify the key to use.

You can have more than one email address attached to a given key. Why don't
you just add your Debian email address to your private key?

  Christian

[Message part 2 (application/pgp-signature, inline)]

Message #15 received at 10253@bugs.debian.org (full text, mbox, reply):

From: Roman Hodek <rnhodek@faui22c.informatik.uni-erlangen.de>

To: 10253@bugs.debian.org

Subject: Re: Bug#10253: dpkg-dev: dpkg-buildpackage signs using the value for Maintainer:

Date: Wed, 18 Jun 1997 17:03:27 +0200

> > This causes a lot of trouble for me since my pgp key includes my
> own email > address which differs from the one in Maintainer.
> Previous versions of > dpkg-dev did not do this. There should be an
> option to either revert to the > old behaviour or to specify the key
> to use.
> 
> You can have more than one email address attached to a given key.
> Why don't you just add your Debian email address to your private
> key?

I also have problem with this behaviour: If someone compiles packages
for another architecture (binary only), he now has to use the -m
option to get the .changes signed. Otherwise, dpkg-buildpackage tries
to sign with the key of the original maintainer, for which the one who
compiles probably doesn't have the secret key...

But this has the side effect that also dpkg-genchanges now uses the
address of the binary-only uploader in the .changes file in the
Maintainer: field, which is incorrect.

I strongly suggest to use two different option for the real maintainer
address and the pgp key selector to fix this. And if the pgp key name
is initialized with the maintainer address from the changelog (as it
currently is), it would also be nice if one can reset the name to pass
to pgp after -u can be empty. This way you still get the default
behaviour of pgp to sign with the last private key.

My preferred behaviour would be to pass -u to pgp only if some special
option is given. I guess not many people really need it...

Roman

Message #20 received at 10253@bugs.debian.org (full text, mbox, reply):

From: James Troup <J.J.Troup@comp.brad.ac.uk>

To: Roman.Hodek@informatik.uni-erlangen.de, 10253@bugs.debian.org

Subject: Re: Bug#10253: dpkg-dev: dpkg-buildpackage signs using the value for Maintainer:

Date: 21 Jun 1997 12:24:03 +0100

Roman Hodek <rnhodek@faui22c.informatik.uni-erlangen.de> writes:

> I also have problem with this behaviour: If someone compiles
> packages for another architecture (binary only), he now has to use
> the -m option to get the .changes signed. Otherwise,
> dpkg-buildpackage tries to sign with the key of the original
> maintainer, for which the one who compiles probably doesn't have the
> secret key...
> 
> But this has the side effect that also dpkg-genchanges now uses the
> address of the binary-only uploader in the .changes file in the
> Maintainer: field, which is incorrect.

Actually, IMO, this is debatable.  When I started building packages
for m68k, I wasn't pgp signing them, but I was using the -m option to
dpkg-buildpackge|dpkg-genchanges, because otherwise any installer
rejections of an upload get sent to the real maintainer and not the
arch-specific builder.  Before I started doing this some very confused
i386 maintainers were sent mail about my rejected m68k upload of their
package.

I don't think the Maintainer: field in the .changes file should be set
to the real maintainer, not unless the install process is improved
(somehow) to avoid the situation I described above.

-- 
James

Message #25 received at 10253@bugs.debian.org (full text, mbox, reply):

From: Roman Hodek <rnhodek@faui22c.informatik.uni-erlangen.de>

To: J.J.Troup@comp.brad.ac.uk, 10253@bugs.debian.org

Subject: Re: Bug#10253: dpkg-dev: dpkg-buildpackage signs using the value for Maintainer:

Date: Mon, 23 Jun 1997 10:11:19 +0200

James> Actually, IMO, this is debatable. When I started building
James> packages for m68k, I wasn't pgp signing them, but I was using
James> the -m option to dpkg-buildpackge|dpkg-genchanges, because
James> otherwise any installer rejections of an upload get sent to the
James> real maintainer and not the arch-specific builder. Before I
James> started doing this some very confused i386 maintainers were
James> sent mail about my rejected m68k upload of their package.
James> 
James> I don't think the Maintainer: field in the .changes file should
James> be set to the real maintainer, not unless the install process
James> is improved (somehow) to avoid the situation I described above.

Hmm... I see your point. Since the installer script uses the value of
the Maintainer: field for replies, it more seems like a misnomer...
should be Uploader: or something like that. (The real maintainer can
easily be extracted from the .deb or somewhere else.)

Roman

Send a report that this bug log contains spam.