Package: devscripts
Version: 2.26.12
Severity: normal
X-Debbugs-Cc: [email protected]
Dear Maintainer,
I’ve tried to use the Metacpan template for the libfinance-quote-perl package,
using the following minimal debian/watch:
Version: 5
Template: Metacpan
Dist: Finance::Quote
But uscan then returns an incorrect (and nonexistent) version. Here is an
exceprt:
uscan info: Scan watch files in .
uscan info: Check debian/watch and debian/changelog in .
uscan info: package="libfinance-quote-perl" version="1.71-1" (as seen in
debian/changelog)
uscan info: package="libfinance-quote-perl" version="1.71" (no epoch/revision)
uscan info: ./debian/changelog sets package="libfinance-quote-perl"
version="1.71"
uscan info: Process watch file at: debian/watch
package = libfinance-quote-perl
version = 1.71
pkg_dir = .
uscan info: Parsing mode: metacpan
uscan info: Parsing pgpmode: none
uscan info: Parsing uversionmangle:
s/\d\K[_.+-]?((?i)dev|pre|alpha|beta|rc)[.-]?/~$1/
uscan info: Parsing versiontype: (?:[-_]?[Vv]?(\d[\-+\.:\~\da-zA-Z]*))
uscan info: Last orig.tar.* tarball version (from debian/changelog): 1.71
uscan info: Last orig.tar.* tarball version (dversionmangled): 1.71
uscan info: Searching versions of Finance-Quote
uscan info: Found the following matching files on the web page (newest first):
https://cpan.metacpan.org/authors/id/B/BP/BPSCHUCK/Finance-Quote-1.5402.tar.gz
(1.5402) index=1.5402-1
https://cpan.metacpan.org/authors/id/B/BP/BPSCHUCK/Finance-Quote-1.5401.tar.gz
(1.5401) index=1.5401-1
https://cpan.metacpan.org/authors/id/B/BP/BPSCHUCK/Finance-Quote-1.5301.tar.gz
(1.5301) index=1.5301-1
https://cpan.metacpan.org/authors/id/B/BP/BPSCHUCK/Finance-Quote-1.71.tar.gz
(1.71) index=1.71-1
https://cpan.metacpan.org/authors/id/B/BP/BPSCHUCK/Finance-Quote-1.70.tar.gz
(1.70) index=1.70-1
https://cpan.metacpan.org/authors/id/B/BP/BPSCHUCK/Finance-Quote-1.69.tar.gz
(1.69) index=1.69-1
https://cpan.metacpan.org/authors/id/B/BP/BPSCHUCK/Finance-Quote-1.68.tar.gz
(1.68) index=1.68-1
[…]
https://cpan.metacpan.org/authors/id/P/PJ/PJF/Finance-Quote-1.04.tar.gz
(1.04) index=1.04-1
uscan info: uscan parser results:
$base = Finance-Quote
$filepattern =
https://cpan.metacpan.org/.*Finance-Quote-(?:[-_]?[Vv]?(\d[\-+\.:\~\da-zA-Z]*))(?i)(?:\.(?:tar\.xz|tar\.bz2|tar\.gz|tar\.zstd?|zip|tgz|tbz|txz))
$newfile =
https://cpan.metacpan.org/authors/id/B/BP/BPSCHUCK/Finance-Quote-1.5402.tar.gz
$mangled_newversion = 1.5402
$newversion = 1.5402
$lastversion = 1.71
uscan info: Upstream URL(+tag) to download is identified as
https://cpan.metacpan.org/authors/id/B/BP/BPSCHUCK/Finance-Quote-1.5402.tar.gz
uscan info: Filename (filenamemangled) for downloaded file:
Finance-Quote-1.5402.tar.gz
Newest version of libfinance-quote-perl on remote site is 1.5402, local version
is 1.71
=> Newer package available from:
=>
https://cpan.metacpan.org/authors/id/B/BP/BPSCHUCK/Finance-Quote-1.5402.tar.gz
uscan info: Scan finished
As you can see, it detects 1.5402 as being the most recent version, instead of
the correct 1.71 (since 1.5402 > 1.71 using standard version ordering rules).
I reported this problem to upstream and to CPAN people, see this GitHub issue:
https://github.com/metacpan/metacpan-web/issues/3735
Apparently this is related to a so-called Backpan directory, which keeps old
deleted versions. Several suggestions were made in the GitHub issue on how to
fix this in uscan, and some additional unrelated issues were also reported. I
copy the relevant comments here for completeness:
> Two things I would suggest are filtering the query by
> https://metacpan.org/pod/MetaCPAN::Client::Release#status (filtering out
> backpan, but "latest" is meant to point to the latest stable authorized
> version as indicated by the CPAN index if there is one). And secondly parsing
> the ->version result with version.pm to get a comparable object (my $vobj =
> version->parse($version)), which you can call the ->normal method to get a
> vX.Y.Z format that will compare the way you expect (you would also have to
> normalize the existing versions you're comparing to).
> The "database" cannot be cleaned, because it is correct; these releases are
> in the backpan, and it's easily conceivable that such mis-ordered (to
> downstream incorrect comparisons) releases exist in non-deleted releases
> across many distributions, though I strongly recommend methods to avoid that
> situation in my guide to Perl module versions ("Versions for Vendors").
> As a side note, that code also doesn't check authorized; anyone can upload a
> tarball called Finance-Quote-9001.tar.gz, and even put a lib/Finance/Quote.pm
> in it, but if they don't have CPAN permissions for that module it won't be
> indexed by PAUSE and marked authorized.
Thanks for your work,
--
⢀⣴⠾⠻⢶⣦⠀ Sébastien Villemot
⣾⠁⢠⠒⠀⣿⡁ Debian Developer
⢿⡄⠘⠷⠚⠋⠀ https://sebastien.villemot.name
⠈⠳⣄⠀⠀⠀⠀ https://www.debian.org
