Hi, Quoting Stefano Rivera (2026-07-01 22:19:01) > When people generate source-only uploads with "sbuild --source-only-changes", > the _source.changes file includes an _amd64.buildinfo file (for example). > This would then fail to merge with an _amd64.buildinfo file from the amd64 > binary build, that would include an identically named buildinfo file with > likely different contents. > > See: https://salsa.debian.org/freexian-team/debusine/-/work_items/1488 > > The Debian archive doesn't seem to care about this, at present. But it > also doesn't actually do anything with .buildinfo files itself, it > pushes them all off to buildinfos.debian.net. I don't see any special > handling in there, so I don't know if these are handled or thrown away. > Reproducible Builds people CCed. > > Debusine took the stance of dissallowing .buildinfo files that are not > named _source.buildinfo, in source-only uploads. I stand by that choice, > but obviously it has some impact for users who were using toolchains > that produced such things. > > I would suggest that when called with --source-only-changes, sbuild copy > the .buildinfo file to _source.buildinfo and include *that* in the > _source.changes instead. > > pbuilder has the same issue, I'll file a similar bug there.
the command which includes the *_${BUILD_ARCH}.changes into *_source.changes is
"dpkg-genchanges --build=source".
I think that a *_source.changes *should* include a *_${BUILD_ARCH}.changes
because the architecture-specific buildinfo file serves as a proof that build
artifacts *were* produced and then we apply the existing naming rules for
buildinfo files to that (using the $DEB_BUILD_ARCH in the filename).
What are you using to merge the .changes files? I regularly use the
mergechanges tool from devscripts to merge a *_source.changes with a
*_${BUILD_ARCH}.changes just fine.
In any case, I don't think sbuild should have much of a say in the naming. If
you want to change the naming then I think that change has to happen in dpkg
(and of course in collaboration with the reproducibile builds team). This would
also mean that you don't have to file a bug against every package builder out
there (like for pbuilder as you suggested).
If you agree, please re-assign this bug to dpkg.
Thanks!
cheers, josch
signature.asc
Description: signature
