vcswatch reports that
this package seems to have new commits in its VCS but has
not yet updated debian/changelog. You should consider updating
the Debian changelog and uploading this new version into the archive.
Here are the relevant commit logs:
commit b06228fb0d098e26be91f2d3bbfea1f30a8afb6f
Merge: 326f712ab 180ce7576
Author: Enrico Zini <enrico@debian.org>
Date: Thu Nov 12 08:10:07 2026 +0000
Added a way to stream the activity of one work request to debusine client (MR !3461)
This is part of #967
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3461
commit 180ce757625f5120fcd66038ed740898fd8c6031
Author: Enrico Zini <enrico@enricozini.org>
Date: Tue Nov 10 19:09:24 2026 +0100
Added a way to stream the activity of one work request to debusine client
commit 9bd09339a1f8aa3818c30caafef41fa41994cc54
Author: Enrico Zini <enrico@enricozini.org>
Date: Tue Nov 10 18:36:06 2026 +0100
Deal with configured API URLs that end in slashes
commit 326f712ab3ab3532ace373988abb9db4a799cc78
Merge: 355639375 4a8406f56
Author: Enrico Zini <enrico@debian.org>
Date: Tue Nov 10 14:37:41 2026 +0000
Added a mock worker that can be used to interactively simulate task execution (#967) (MR !3459)
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3459
commit 3556393751b28f299fb9c78f391e63e1fd03e941
Merge: 88bd18104 e9c338962
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Nov 10 14:20:56 2026 +0000
Expose the "Expires at" field in user token views (MR !3458)
Part of #873.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3458
commit 4a8406f5615302e7291ea5f9e73f81c5561851c0
Author: Enrico Zini <enrico@enricozini.org>
Date: Tue Nov 10 14:38:05 2026 +0100
Added a mock runner that can be used to interactively simulate task execution
commit e9c338962b1f1cd530b5ba7f9eb463e94214530b
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Nov 10 12:59:23 2026 +0000
Expose the "Expires at" field in user token views
Part of #873.
commit ba1431de776fcba026ab1ec7c26a306376fad704
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Nov 10 10:51:31 2026 +0000
Refactor token list to use a table
commit cc0e2a0a9585e9c915c5cb2dd2290dc0d0dd028f
Author: Enrico Zini <enrico@enricozini.org>
Date: Tue Nov 10 10:57:21 2026 +0100
Tweaked incus executor class hierarchy and added missing @override
commit 88bd1810454299accb66ddc6ec1af7454db77486
Author: Enrico Zini <enrico@enricozini.org>
Date: Mon Nov 9 18:32:57 2026 +0100
Pass tzinfo to datetime.combine
commit 51ab15d752437eb54aaa52f78085a7f270f5f93e
Merge: 8759d6c6b 396923ffc
Author: Enrico Zini <enrico@debian.org>
Date: Mon Nov 9 15:48:10 2026 +0000
Implemented filtering of workspaces in scope page. Fixes: #1528 (MR !3455)
Closes #1528
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3455
commit 396923ffc8121c2cf82cda4a30846db59d52f60d
Author: Enrico Zini <enrico@enricozini.org>
Date: Mon Nov 9 16:00:59 2026 +0100
Implemented filtering of workspaces in scope page. Fixes: #1528
commit 8759d6c6b94f1eb7908a18dbf2251a6e2d7b407f
Merge: c4e58c7ef a84f46e62
Author: Enrico Zini <enrico@debian.org>
Date: Mon Nov 9 08:41:51 2026 +0000
Added `debusine workspace task-history` to query task history entries (#1550) (MR !3454)
You can try this out:
1. checkout the `uery-task-history` branch
2. `python3 -m debusine.client setup`
3. Add a new server, with URL `https://playground-3454.aws.debusine.dev/api/` and default workspace `Playground`
4. Obtain a token, make it the default server if you want
At that point, `python3 -m debusine.client workspace task-history` will be able query the playground workspace in the test server, and you can filter by time and subject
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3454
commit a84f46e62a28920e902d332e023fff6a82ba7337
Author: Enrico Zini <enrico@enricozini.org>
Date: Fri Nov 6 16:14:02 2026 +0100
Added `debusine workspace task-history` to query task history entries
commit c4e58c7efc3de5b8da98bbdb945b5fbb5f61c114
Merge: 7d8524730 4a0b6ded8
Author: Enrico Zini <enrico@debian.org>
Date: Thu Nov 5 16:57:08 2026 +0000
Implement inviting external people to scopes/groups (fixes: #754) (MR !3405)
Visible at https://playground-3405.aws.debusine.dev/debusine/ after logging in as `playground-scope`.
The menu "Options / Invite users" will lead to the list of invites, where one can create, display, and edit them.
Thanks to !3421, salsa signon now works for https://playground-3405.aws.debusine.dev/ and invites can be generated and tested. The playground VM cannot send email, though, so all generated invites are marked as "Unsent", but you can get the link from the UI, log out and try it out
Closes #754
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3405
commit 4a0b6ded8df20b01405c61d5a6617e52a2d67370
Author: Enrico Zini <enrico@enricozini.org>
Date: Mon Oct 12 12:40:52 2026 +0200
Allow to activate invites for existing users
commit 8314ebdd9c795059d30f004affd663cf5fe383f7
Author: Enrico Zini <enrico@enricozini.org>
Date: Mon Oct 12 12:15:59 2026 +0200
Added a way to revoke an invite instead of activating it
commit 10bf81df7adbab4e406c90be267658af56e31340
Author: Enrico Zini <enrico@enricozini.org>
Date: Thu Oct 8 14:33:41 2026 +0200
Added signon code to activate invites
commit f2a8b6227e5979897898bb1123fdc4419e7903a7
Author: Enrico Zini <enrico@enricozini.org>
Date: Thu Oct 8 15:33:48 2026 +0200
Added UI to manage invites
commit d17cb01583e5a120825d862a219f1cbff37e363f
Author: Enrico Zini <enrico@enricozini.org>
Date: Thu Oct 8 15:13:25 2026 +0200
Do not require coverage for code skipping running abstract test cases
commit 4abc03c473e7e91c1a051be2b87fd9b69edda45f
Author: Enrico Zini <enrico@enricozini.org>
Date: Mon Sep 28 12:05:43 2026 +0200
Added a ScopeInvite model, and a mechanism to generate and validate URLs for it
commit 7d85247301b8ac84bf009fdac09eefc1edc50952
Merge: f595c8b2c f725882d5
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Nov 5 12:45:00 2026 +0000
quick-setup: Install deps of mypy pre-commit hook (MR !3453)
The mypy pre-commit hook installs systemd-python from PyPI. It has no
wheels, so pip builds it from source, which needs a C compiler,
pkg-config, and the libsystemd and Python headers. The code-linting CI
job installs these explicitly, but bin/quick-setup.sh did not, so
`make check` failed in a fresh development environment with:
FileNotFoundError: [Errno 2] No such file or directory: 'pkg-config'
Add them to the dev extra in pyproject.toml so quick-setup installs
them.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3453
commit f595c8b2cbcae89569c0356125eb57fe3ac3580c
Merge: f22e3450d ca6abec30
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Nov 5 12:14:37 2026 +0000
Pass the server's certificate chain on to environments (MR !3449)
As long as the worker's trust store allows verifying the server's
certificate, this means that environments will be able to use Debusine
repositories over HTTPS even if they have a less complete trust store.
Part of #1160. We don't yet require workers to use HTTPS for
communicating with the server, but this paves the way for doing so.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3449
commit f725882d5f559e52578392115c63bb91dcad4c8b
Author: Loïc Minier <loic.minier@oss.qualcomm.com>
Date: Thu Nov 5 12:52:15 2026 +0100
quick-setup: Install deps of mypy pre-commit hook
The mypy pre-commit hook installs systemd-python from PyPI. It has no
wheels, so pip builds it from source, which needs a C compiler,
pkg-config, and the libsystemd and Python headers. The code-linting CI
job installs these explicitly, but bin/quick-setup.sh did not, so
`make check` failed in a fresh development environment with:
FileNotFoundError: [Errno 2] No such file or directory: 'pkg-config'
Add them to the dev extra in pyproject.toml so quick-setup installs
them.
Signed-off-by: Loïc Minier <loic.minier@oss.qualcomm.com>
commit ca6abec30425b5b9df09ca8519f17def5d77546a
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Nov 3 16:59:15 2026 +0000
Pass the server's certificate chain on to environments
As long as the worker's trust store allows verifying the server's
certificate, this means that environments will be able to use Debusine
repositories over HTTPS even if they have a less complete trust store.
Part of #1160. We don't yet require workers to use HTTPS for
communicating with the server, but this paves the way for doing so.
commit e7b099dcdf2fb674e0ad8bd8592707275b3d5d3c
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Nov 2 18:48:33 2026 +0000
Generalize code to inject files for extra repositories
commit a5d8601b7d7125a613cc0112585da0e77d138f80
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Nov 2 16:47:22 2026 +0000
Drop more bits of one-line sources.list entry support
These should have been dropped along with the other changes in
1b1bd31f5d6636618e9d282deb72c706fce98b80.
commit f22e3450df1058d4bd91cb4e753a28ceb32ffc7d
Merge: d421bb941 7f913a6cf
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Nov 5 08:25:28 2026 +0000
pre-commit: Update ruff, djlint, and mypy (MR !3452)
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3452
commit d421bb941fa6f978e310dc9c1267ec9769c9e438
Merge: 8922fd7b3 53739a252
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Nov 4 13:30:29 2026 +0000
Allow archives to skip building -dbgsym packages (MR !3402)
debian:archive collections can set build_debug_symbols to false. The sbuild workflow then adds noautodbgsym to each Sbuild task so Debian does not generate -dbgsym packages. Default remains true. This also implements build_options as a list of extra DEB_BUILD_OPTIONS values on the Sbuild task and sbuild workflow.
Fixes: #511, #1628
Closes #511 and #1628
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3402
commit 7f913a6cfab512c9d150d21927e653c8f667e8e6
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Nov 4 13:01:08 2026 +0000
pre-commit: Update ruff, djlint, and mypy
commit 53739a25214cd04b68b683d435fbd191ab2659b4
Author: DankJugal <ui22cs59@iiitsurat.ac.in>
Date: Thu Oct 1 00:24:12 2026 +0530
Allow archives to skip building -dbgsym packages
debian:archive collections can set build_debug_symbols to false. The
sbuild workflow then adds noautodbgsym to each Sbuild task so Debian
does not generate -dbgsym packages. Default remains true.
Fixes: #511, #1628
commit 8922fd7b3509c97f383be44c98ab191268fb2476
Merge: 33e1731ae 72f69fe2e
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Nov 3 21:30:13 2026 +0000
Narrow types on redis xread responses (MR !3451)
Allows `mypy` to pass again
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3451
commit 72f69fe2e2de2926f4066332cb63941b80e06393
Author: Stefano Rivera <stefano@freexian.com>
Date: Tue Nov 3 19:10:05 2026 +0000
Narrow types on redis xread responses
commit 33e1731ae3ff01e991d4ba8729ca54ac42a4a2f2
Merge: dcebf855b 0086dd9e5
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Nov 3 18:57:46 2026 +0000
Work around a tarfile bug which caused Incus failures (MR !3450)
Fixes: #1680
Closes #1680
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3450
commit 0086dd9e5e6474a19482ecb028a785c161897c09
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Nov 3 18:07:21 2026 +0000
Work around a tarfile bug which caused Incus failures
Fixes: #1680
commit dcebf855b45faf77ec2a63dfe1900045c05e58fe
Merge: 9d578b1bb bff978928
Author: Raphaël Hertzog <hertzog@debian.org>
Date: Tue Nov 3 09:04:07 2026 +0000
Clear stale output data when retrying workflow callbacks (MR !3445)
Fixes #1647.
Retrying a workflow callback could leave output data from its previous execution intact, including errors. This could cause stale results or errors to persist after the callback was retried.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3445
commit bff97892820d57f8ff96408a99ca5d26221181de
Author: Mokshith Gowda <mokshy468@gmail.com>
Date: Tue Nov 3 14:34:07 2026 +0530
Clear output data when retrying workflow callbacks
commit 9d578b1bb7d153f2b9b92f491e694874d06fe438
Merge: f4a8ce16d e7c00486a
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Nov 2 15:57:35 2026 +0000
Add support for autopkgtest_variant (MR !3446)
This allows running the latest code from autopkgtest's development
branch rather than the packaged version. Since this allows running code
cloned from a remote branch outside any containment, we use scheduler
tags to restrict tasks using this parameter to run only on workers that
have been specifically configured to accept them.
Fixes: #1363
Closes #1363
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3446
commit e7c00486a6b90d9de8d381d1f8f4b47773884841
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Nov 2 14:50:45 2026 +0000
Fix typo in scheduler tags documentation
commit a4560ae7bf32d95fb988044661d695a20eb5ea38
Author: Colin Watson <cjwatson@debian.org>
Date: Fri Oct 30 15:34:56 2026 +0000
Add support for autopkgtest_variant
This allows running the latest code from autopkgtest's development
branch rather than the packaged version. Since this allows running code
cloned from a remote branch outside any containment, we use scheduler
tags to restrict tasks using this parameter to run only on workers that
have been specifically configured to accept them.
Fixes: #1363
commit f4a8ce16d05a5f75d78bde4e67f05fe8111e6e0f
Merge: fe3139671 d1ff131aa
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Nov 2 14:24:52 2026 +0000
Fix most test warnings on forky (MR !3448)
There are a few left due to a minor bug in dput-ng, which I just fixed
in version 1.47.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3448
commit fe31396713f057aa53b46ea5df31c2ee4e1c8831
Merge: 7b35e806f 00a946a60
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Nov 2 14:04:07 2026 +0000
docs: Describe how to use AWS KMS with Debusine (MR !3444)
Part of #1657.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3444
commit 7b35e806f4b85c18345b3dd75735377e481230c3
Merge: c8edc6168 f888e534e
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Nov 2 13:54:38 2026 +0000
signing: Add a move_key command (MR !3443)
Now that we support storing some keys in AWS KMS, instance
administrators may want to move existing keys from software encryption
into KMS. This was possible beforehand, but involved a considerable
amount of manual and error-prone work, so automate it.
The unit tests do their best to check things by running the required
cryptography in reverse, but ultimately the only real test is to run
this against AWS; even the `moto` library doesn't yet cover importing
keys. Using this code, I was able to generate a key stored with
software encryption, move it to KMS, and sign a `Release` file using it.
I anticipate that this will be useful for other kinds of moves in future
when we support more storage types, so I made the command general enough
to be able to handle that.
Part of #1657.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3443
commit c8edc6168e34545b120220106b9c086f1cddc0db
Merge: dd2fdf81b e79d563fb
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Nov 2 12:55:02 2026 +0000
Add `debusine-signing register_aws_kms_key` (MR !3442)
This is useful if you have manually created a key in AWS KMS (perhaps
because Debusine's built-in key generation isn't quite right for your
needs) and then want to register it with Debusine.
Part of #1657.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3442
commit d1ff131aaf3a9ee5190e57d05ed1386c2fd41dd5
Author: Colin Watson <cjwatson@debian.org>
Date: Fri Oct 30 17:20:09 2026 +0000
Fix most test warnings on forky
There are a few left due to a minor bug in dput-ng, which I just fixed
in version 1.47.
commit dd2fdf81b15c27d539f57c8164970b8502ad34f3
Merge: 1571b8300 211b18d46
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Nov 2 11:55:05 2026 +0000
Work around spurious coverage gaps in forky (MR !3447)
We run into https://github.com/coveragepy/coveragepy/issues/1987 ("3.14:
branch coverage incorrect with triple-nested context manager") in
several places, causing spurious coverage gaps. I filed a bug asking
the python-coverage maintainer to upgrade to 7.17.0, but this is easy
enough to work around in the meantime.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3447
commit 00a946a60ba6726e3ae91aa2598c62afd5d06324
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Oct 29 17:06:41 2026 +0000
docs: Describe how to use AWS KMS with Debusine
Part of #1657.
commit 1571b8300d553cfc2669d57c386155435bf6e130
Merge: 40cfd6fe5 eb8238f5d
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Nov 2 11:41:58 2026 +0000
update_suites: Honour signing_key_storage field on archives (MR !3441)
Part of #1657.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3441
commit f888e534efe0774f18d64e341c4ed2e6d2fa08cf
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Oct 29 16:48:40 2026 +0000
signing: Add a move_key command
Now that we support storing some keys in AWS KMS, instance
administrators may want to move existing keys from software encryption
into KMS. This was possible beforehand, but involved a considerable
amount of manual and error-prone work, so automate it.
The unit tests do their best to check things by running the required
cryptography in reverse, but ultimately the only real test is to run
this against AWS; even the `moto` library doesn't yet cover importing
keys. Using this code, I was able to generate a key stored with
software encryption, move it to KMS, and sign a `Release` file using it.
I anticipate that this will be useful for other kinds of moves in future
when we support more storage types, so I made the command general enough
to be able to handle that.
Part of #1657.
commit e79d563fbf6a20b5924a84474f9dc85b921cb6f9
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Oct 28 15:30:19 2026 +0000
Add `debusine-signing register_aws_kms_key`
This is useful if you have manually created a key in AWS KMS (perhaps
because Debusine's built-in key generation isn't quite right for your
needs) and then want to register it with Debusine.
Part of #1657.
commit 211b18d4611cb7807760ee27fc0a623db11f3279
Author: Colin Watson <cjwatson@debian.org>
Date: Fri Oct 30 16:35:13 2026 +0000
Work around spurious coverage gaps in forky
We run into https://github.com/coveragepy/coveragepy/issues/1987 ("3.14:
branch coverage incorrect with triple-nested context manager") in
several places, causing spurious coverage gaps. I filed a bug asking
the python-coverage maintainer to upgrade to 7.17.0, but this is easy
enough to work around in the meantime.
commit 6e5068a36244c6683a56669ac0b3fe57eedce3b5
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Oct 29 16:51:57 2026 +0000
doc: Update and fix manual registration instructions in configure-hsm
commit a20564f7b06597efc2220c4d63f192774fa7c467
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Oct 29 16:32:44 2026 +0000
signing: Use PGPKey.userids rather than PGPKey._uids
commit 7d3df5f9c7d5cbc4634df2741a6a0dee119763a0
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Oct 29 16:29:42 2026 +0000
signing: Factor out aws_kms_tags function
commit 26bd1a28f72929466d0b663696e54d324351b794
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Oct 29 16:16:51 2026 +0000
signing: Make AvailableKeyFileSystem.key_path public
Although this is the private key, the point of the
`AvailableKeyFileSystem` context manager is to manage its availability
on disk, so having this attribute be private was only a fig leaf anyway.
The private attribute was already used from outside the module by
`debusine.signing.gnupg`.
commit eb8238f5d3e8dbfada201470b586275b21104a9f
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Oct 28 15:24:16 2026 +0000
update_suites: Honour signing_key_storage field on archives
Part of #1657.
commit 40cfd6fe514ece0cfa379632e36a1aef72176d14
Merge: 2dbca83cc 8a98059e8
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Oct 28 14:59:46 2026 +0000
signing: Support OpenPGP repository keys in AWS KMS (MR !3435)
Part of #1657.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3435
commit 2dbca83cc4cae9044bf57c2b5fc5fd82be83167a
Merge: 471616568 f75104f46
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Oct 28 14:17:33 2026 +0000
Move queries in scopes:file-storages to a statistics table (MR !3440)
These are too slow to run inline in a web request.
While it would probably be technically possible to track the maximum
`FileInStore.id` for each store and keep the results completely up to
date aside from deletions, I don't think it's worth it for a status web
page. I just added a note instead to say that the statistics are
updated hourly.
Part of #1602.
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3440
commit 8a98059e817cdf22ebee091e4bd95ec18b950976
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Oct 27 13:40:35 2026 +0000
ci: Check that signing migrations are up to date
commit 76502081aa69f8f1dcc1b9b74c222363e45b946c
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Oct 27 13:39:51 2026 +0000
Add AuditLog.storage field
It seems useful to record which storage type events happened in.
commit f685ac4e0f5f11b4cd0c34f2bbf9f380f1689f5d
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Oct 26 16:28:51 2026 +0000
Add news fragment
commit 0eac485aa848f7eb40aa9509ff84fb5d59b9c2b2
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Oct 26 16:27:28 2026 +0000
GenerateKey: Allow storing OpenPGP repository keys in AWS KMS
commit fa2208f0c187d6f0240b1c18ef6fac9d52006a44
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Oct 26 13:02:23 2026 +0000
signing: Add AWS KMS support to Key
commit d18a50221f8acf03f0953f39be261beef5f4fdfc
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Oct 27 12:17:44 2026 +0000
signing: Test UEFI/PKCS11_STATIC signing cases
commit 6556540a9e893cf38db85337ae39347bf6496582
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Oct 26 12:49:23 2026 +0000
signing: Add OpenPGP generate/sign logic using AWS KMS
This only supports Ed25519 keys for now, but that's also true for our
GnuPG-based implementation.
commit 900969e7a8f138a74301618a8346b19fd8799bc5
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Oct 26 12:36:35 2026 +0000
signing: Make BaseAvailableKey.certificate_path public
The certificate is the public half of the key, so this does no harm.
commit 471616568a0607927f3a191ed6b3151d7245d5cd
Merge: 4786d938e 874238272
Author: Stefano Rivera <stefanor@debian.org>
Date: Wed Oct 28 14:06:37 2026 +0000
Release 0.16.2 (MR !3438)
Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3438
commit f75104f462a6d726715ce724a8e2598a8fef08b4
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Oct 28 02:05:53 2026 +0000
Optimize "Referenced by artifact relations" query on file stores
This is a similar problem to the one I fixed in
https://salsa.debian.org/freexian-team/debusine/-/merge_requests/1945:
pulling the IDs of artifacts to keep back into Python before asking
PostgreSQL for the files referenced by them avoids a catastrophically
bad query plan, and while this is conceptually inelegant it only takes a
few seconds in practice.
In fact, this will use much less memory than the corresponding code in
`debusine-admin delete_expired`, because we're only interested in the
artifacts that are indirectly kept due to relations, not those that are
directly kept due to expiry times or references from collections. On
debusine.debian.net, this indirect keep count is currently about 5% of
the total keep count.
commit 61b032601f99824631a1db5b878e6520dada0a86
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Oct 27 22:39:46 2026 +0000
Move queries in scopes:file-storages to a statistics table
These are too slow to run inline in a web request.
While it would probably be technically possible to track the maximum
`FileInStore.id` for each store and keep the results completely up to
date aside from deletions, I don't think it's worth it for a status web
page. I just added a note instead to say that the statistics are
updated hourly.
Part of #1602.
commit 6a553be3a6c957fb896bf6efa6962007307c493f
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Oct 27 21:49:29 2026 +0000
Give part_of_collection_with_retains_artifacts a shorter name
![[bug history graph]](https://qa.debian.org/data/bts/graphs/d/debusine.png){kind=link}