Bug#742552: marked as done (developers-reference should encourage verification of upstream cryptographic signatures)

This is a multi-part message in MIME format...

------------=_1779559502-108184-0
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

Your message dated Sat, 23 May 2026 18:03:54 +0000
with message-id <[email protected]>
and subject line Bug#742552: fixed in developers-reference 14.10
has caused the Debian Bug report #742552,
regarding developers-reference should encourage verification of upstream cr=
yptographic signatures
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


--=20
742552: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D742552
Debian Bug Tracking System
Contact [email protected] with problems

------------=_1779559502-108184-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at submit) by bugs.debian.org; 18 Dec 2013 04:22:45 +0000
X-Spam-Checker-Version: SpamAssassin 3.3.2-bugs.debian.org_2005_01_02
	(2011-06-06) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-14.0 required=4.0 tests=BAYES_00,DIGITS_LETTERS,
	HAS_PACKAGE,MURPHY_DRUGS_REL8,T_RP_MATCHES_RCVD,XMAILER_REPORTBUG,
	X_DEBBUGS_CC autolearn=ham version=3.3.2-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 13; hammy, 149; neutral, 62; spammy,
	2. spammytokens:0.959-+--H*r:bugs.debian.org, 0.951-+--offers
	hammytokens:0.000-+--H*x:6.4.4, 0.000-+--H*UA:6.4.4, 0.000-+--H*M:reportbug,
	0.000-+--H*MI:reportbug, 0.000-+--H*x:reportbug
Return-path: <[email protected]>
Received: from lair.fifthhorseman.net ([108.58.6.98] helo=alice.fifthhorseman.net)
	by buxtehude.debian.org with esmtp (Exim 4.80)
	(envelope-from <[email protected]>)
	id 1Vt8ej-0006RF-3Y
	for [email protected]; Wed, 18 Dec 2013 04:22:45 +0000
Content-Type: multipart/mixed; boundary="===============6610739544215013163=="
MIME-Version: 1.0
From: Daniel Kahn Gillmor <[email protected]>
To: Debian Bug Tracking System <[email protected]>
Subject: debian-policy should encourage verification of upstream cryptographic
 signaturse
Message-ID: <[email protected]>
X-Mailer: reportbug 6.4.4
Date: Tue, 17 Dec 2013 23:22:38 -0500
X-Debbugs-Cc: [email protected]
Delivered-To: [email protected]

This is a multi-part MIME message sent by reportbug.


--===============6610739544215013163==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Package: debian-policy
Severity: normal
Tags: patch

debian-policy should encourage verification of upstream cryptographic
signatures.


Since devscripts 2.13.3 (see #610712), uscan has supported the ability
to automatically verify upstream's cryptographic signatures if the
signing key and URL to the signature is well-known.
 
debian-policy should recommend that package maintainers regularly
verify these signatures for new versions, and mention the files used.

A proposed patch for debian-policy is attached.

--===============6610739544215013163==
Content-Type: text/x-diff; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="policy-upstream-verification.diff"

commit f267cc2134197533bce3af8152aef15217967813
Author: Daniel Kahn Gillmor <[email protected]>
Date:   Tue Dec 17 23:15:08 2013 -0500

    Encourage verification of upstream cryptographic signatures
    
    Since devscripts 2.13.3 (see #610712), uscan has supported the ability
    to automatically verify upstream's cryptographic signatures if the
    signing key and URL to the signature is well-known.
    
    debian-policy should recommend that package maintainers regularly
    verify these signatures for new versions, and mention the files used.

diff --git a/policy.sgml b/policy.sgml
index dad8d23..ebe486f 100644
--- a/policy.sgml
+++ b/policy.sgml
@@ -2373,8 +2373,31 @@ endif
           distribution as a whole.
         </p>
 
-      </sect>
+	<p>
+	  If the package's upstream source offers detached
+	  cryptographic signatures of their source, it is recommended
+	  to use the <tt>pgpsigurlmangle</tt> option to locate the
+	  upstream signature file
+	  and <qref id="debianupstreamsigningkey"><tt>debian/usptream-signing-key.pgp</tt></qref>
+	  to indicate the acceptable signing key
+	  (see <manref name="uscan" section="1"> for details).
+	</p>
 
+      </sect>
+      <sect id="debianupstreamsigningkey">
+        <heading>Upstream signing key: <file>debian/upstream-signing-key.pgp</file></heading>
+	<p>
+	  If the package's upstream offers cryptographic signatures of
+	  their source, this optional, recommended file should contain
+	  a binary OpenPGP (RFC 4880) keyring consisting of all
+	  OpenPGP keys that the package maintainer considers
+	  acceptable to sign new upstream releases of the software
+	  (see <qref id="debianwatch"><tt>pgpsigurlmangle</tt>
+	  from <tt>debian/watch</tt></qref> for instructions on how to
+	  tell <tt>uscan</tt> how to find the signatures themselves
+	  when new versions are available).
+	</p>
+      </sect>
       <sect id="debianfiles">
 	<heading>Generated files list: <file>debian/files</file></heading>
 

--===============6610739544215013163==--

------------=_1779559502-108184-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at 742552-close) by bugs.debian.org; 23 May 2026 18:03:56 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00,
	DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FUZZY_CPILL,
	FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,
	USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 89; hammy, 150; neutral, 125; spammy,
	0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK,
	0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload,
	0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo
Return-path: <[email protected]>
Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:38352)
	by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wQqhY-000S47-13
	for [email protected];
	Sat, 23 May 2026 18:03:56 +0000
Received: via submission
	from C=NA,ST=NA,L=Ankh Morpork,O=Debian SMTP,OU=Debian SMTP CA,CN=fasolo.debian.org,[email protected] (verified)
	by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wQqhY-000FgE-0C
	for [email protected];
	Sat, 23 May 2026 18:03:55 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type:
	Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID
	:Content-Description:In-Reply-To:References;
	bh=QIZeuKNUFF5LjHdPIze5ew1H4aLqggKCJIx+sLeod2c=; b=r3NXcQOkCV6cUQ60VS8QcthkRs
	UcaMYnO/bDcDrrJfm7B2M5gOLjzcUbLbzINQ9xvIL/+EdYkqrairNQI5GeCnvPLkE9XlslOllG3tt
	cxNYyDiOktg7e/M1ZiXK6pBCD7uxGlSzMz+gANhKiaQ/4N3tDMecEtGSiXaxwAzUimCxT2zVKbbYL
	iG5roDhbKc1PB8r4N3PrRlonUxdz2Fy/5TLqd7APB/Jmp4hWwsIW8mROav0O3ASNiXBw8YRbu4EZB
	t02JlYgGqkmfroBvCG2j+XisOK/JXcAtP8Oys0ubblK1Tr5sJPaymCl5uvo+k01QtBSR+u6FxlZHq
	2RPQlqUQ==;
Received: from dak by fasolo.debian.org with local (Exim 4.98.2)
	(envelope-from <[email protected]>)
	id 1wQqhW-0000000CdZN-2dmx;
	Sat, 23 May 2026 18:03:54 +0000
From: Debian FTP Masters <[email protected]>
Reply-To: Holger Levsen <[email protected]>
To: [email protected]
X-DAK: dak process-upload
X-Debian: DAK
X-Debian-Package: developers-reference
Debian: DAK
Debian-Changes: developers-reference_14.10_source.changes
Debian-Source: developers-reference
Debian-Version: 14.10
Debian-Architecture: source
Debian-Suite: unstable
Debian-Archive-Action: accept
MIME-Version: 1.0
Subject: Bug#742552: fixed in developers-reference 14.10
Content-Type: multipart/signed; micalg="pgp-sha256";
 protocol="application/pgp-signature";
 boundary="===============5361183592404849310=="
Message-Id: <[email protected]>
Date: Sat, 23 May 2026 18:03:54 +0000

--===============5361183592404849310==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Source: developers-reference
Source-Version: 14.10
Done: Holger Levsen <[email protected]>

We believe that the bug you reported is fixed in the latest version of
developers-reference, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Holger Levsen <[email protected]> (supplier of updated developers-reference p=
ackage)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 23 May 2026 19:12:16 +0200
Source: developers-reference
Architecture: source
Version: 14.10
Distribution: unstable
Urgency: medium
Maintainer: Developers Reference Maintainers <[email protected]>
Changed-By: Holger Levsen <[email protected]>
Closes: 742552 1136791
Changes:
 developers-reference (14.10) unstable; urgency=3Dmedium
 .
   [ Serafeim (Serafi) Zanikolas ]
   * pkgs, tools: update adequate section, and recommend it from "Testing the
     package". Closes: #1136791.
   * best-pkging-practices: encourage automatic verification of upstream rele=
ase
     signatures. Closes: #742552.
 .
   [ Holger Levsen ]
   * Update all .po files for changed strings in the English original.
Checksums-Sha1:
 08c4e60cc6aadc8098314276e63695a6beab2133 2526 developers-reference_14.10.dsc
 58cc0ba7d6b3bf988fc7d47aa5d977912d906642 583056 developers-reference_14.10.t=
ar.xz
 ffc2ac50e7bc002b03709412a8757e0908295846 8612 developers-reference_14.10_sou=
rce.buildinfo
Checksums-Sha256:
 68270436a70901f3c410af498086ad8d56cac6a9fa33da329e6c84b63e73c9d7 2526 develo=
pers-reference_14.10.dsc
 1c556487a5f851ad3ae6c024a9a900f677ef2bad07a47f0a4fd09b9021b5d240 583056 deve=
lopers-reference_14.10.tar.xz
 23c88156a286c231784710a800cdf635e61a1dfb1253aae99a3cda3c2ab1075d 8612 develo=
pers-reference_14.10_source.buildinfo
Files:
 0dc5feb51e7d18effb0d86025f1eddcb 2526 doc optional developers-reference_14.1=
0.dsc
 fe50b7ffa5c09b30a41dab7a5269d222 583056 doc optional developers-reference_14=
.10.tar.xz
 9b5113e3c9061ec47b6e802bdef85771 8612 doc optional developers-reference_14.1=
0_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEuL9UE3sJ01zwJv6dCRq4VgaaqhwFAmoR6l8ACgkQCRq4Vgaa
qhxrnRAAtV9KKUr7E3k3K8Tc2k1wPOmODAvIB+fKjot8NQzVfJIl8DjpKfnN4xxb
/abDeeFQrrTpw2a0JW6+MmGDssHqz835cYUdtCvsU8/Bm/onHdXTrBH1fPswyslr
TIQksCkOn7praVKkrDrR9W7wCaYVYWML9Mq8b7gAGeNroQkihjnqW44mmCDO5Rtk
Ivld2C8mKgR0EmiPBhNZ+OKKAa3RKzEX0GvGkUhTFasIasbdD0VwWOX+Kt10kBXh
kqAesbckPBEUEnWFUbH1vHbXJ9yEujWQqrTrxWaQL++ENu3TC+j4Ri/FDjCLf/0n
/pOTRgQ7x4jwD01GGbsjth/iBVuQECNYurNOU2z0omzgNRVn5VAw/paJ5AmJRv2u
u7mu/BwcuVTezz85Z8lmM8H708DBYyhfZisGjhJz7FW0ooeTSW+tKA0Q6FAK/v4W
8qA5VvQWVMDL1rl6xfLGElGp7kFVc8MLzp3Er3umPeKxc5+O4Vt5sfjTuCDx+H4y
WxuDLlhahDVCEtz4OQnXqi7eNtApm59TLEXZvYLVZJciNhGu8Kv+4L6AkxHPAVYk
hH8vWz5HdzDdXRfl/xgEghkVDNxTGoWikNUsTxrCasgdRTBtLo/aMm5TC09DbFxu
IS07Um9jueSZJCAb/+CGbfeZF8enffWph0rieqoVLtNUEcjglLM=3D
=3DK44P
-----END PGP SIGNATURE-----


--===============5361183592404849310==
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCahHsCgAKCRCb9qggYcy5
IcL9AQCbYLDmXxqMZ/uGa8xMYlIg96jNGih2rCX39HSGrSCqlgEAng0ROcZS9deX
xOiMROpxrVot0jbBePS80Sdp6zJDdwA=
=Ts2+
-----END PGP SIGNATURE-----

--===============5361183592404849310==--
------------=_1779559502-108184-0--