> --overwrite does not trust debian/changelog

Looking at this bug (after much time, sorry) I am confused.  I think
what --overwrite does is precisely to trust the changelog.  Maybe you
meant to say "dgit does not trust ..." which is accurate.  Then the
rest of your message makes sense.  So, let me reply to that:

The reason dgit doesn't trust the changelog by default is that it is
not reliable.  It is quite easy to accidentally create git commits
that mention "1.2.3-1" in the changelog, but which weren't the
actually uploaded "1.2.3-1".  Many maintainer changelog management
workflows do so.  In such a situation, forgetting to pull from the
main branch on salsa might result dgit accidentally overwriting later
changes, if it simply trusts the changelog.

Many maintainers (especially of native packages) who use dgit don't
need --overwrite: as a maintainer you can merge the dgit .dsc import
into your own history.  Then git operates normally and your pushes are
always ff.  This workflow is much less at risk of accidentally
clobbering changes.

In line with dgit's philosophy of trying to help the user avoid
mistakes, and encouraging safer (less error-prone) workflows, I don't
think making --overwrite the default would be a good idea.

In #1050713 I am proposing to add a --trust-changelog option, that
works like --overwrite (without a version).  This will hopefully make
it less scary-sounding and encourage more people to use it rather than
worry.

Does this all make sense ?

Thanks,
Ian.

-- 
Ian Jackson <ijack...@chiark.greenend.org.uk>   These opinions are my own.  

Pronouns: they/he.  If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.

Reply via email to