Bug#920763: lintian: orig-tarball-missing-upstream-signature interacts poorly with mode=git,pgpmode=gittag

[Daniel Kahn Gillmor <dkg@fifthhorseman.net>]

On Tue 2019-02-26 16:36:05 -0500, Chris Lamb wrote:
> I'm afraid it would, and would not be visible on lintian.d.o, and
> would also give different results in different environments. Whilst
> there is no strict written policy about this anywhere, this just
> feels "kinda" wrong, alas.

gotcha, thanks for the explanation and scope of what is in-bounds for
lintian.

I guess if we wanted some version of lintian to be able to check on the
git tag, we need to have some sort of export (git shallow
something-or-other?) that could be included in debian/ to recreate a git
repo that would be sufficient to verify the contents of the files and
confirm the git signature.  I don't know how to do that yet though :/

        --dkg