debusine - Debian Package Tracker

general

source: debusine (main)
version: 0.16.2
maintainer: Raphaël Hertzog (DMD)
uploaders: Colin Watson [DMD] – Stefano Rivera [DMD]
arch: all
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

old-bpo: 0.11.3~bpo12+1
stable: 0.11.3+deb13u1
stable-bpo: 0.16.2~bpo13+1
testing: 0.16.2
unstable: 0.16.2

versioned links

0.11.3~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.11.3+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.16.1~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.16.2~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.16.2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

debusine-client
debusine-doc
debusine-server (1 bugs: 0, 1, 0, 0)
debusine-signing
debusine-worker
python3-debusine (1 bugs: 0, 0, 1, 0)
python3-debusine-server
python3-debusine-signing

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:29:42
Last run: 2026-06-25T12:34:03.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:24:31
Last run: 2026-10-18T10:45:26.000Z
Previous status: unknown

stable: fail (log)
The tests ran in 1:25:41
Last run: 2026-11-01T05:52:28.000Z
Previous status: unknown

Created: 2026-10-17 Last update: 2026-11-02 20:01

Marked for autoremoval on 22 November due to debugpy, ipykernel, ipython, jupyter-console, jupyter-server-terminals, mkdocs-macros-plugin, python-aiobotocore, python-botocore, python-django, python-django-postgres-extra, python-hypothesis, python-readme-renderer, python-syrupy, python-testfixtures: #1126323, #1145153, #1145330, #1145439, #1145458, #1146361, #1146434, #1147441, #1149388, #1149942, #1150176, #1151257, #1151398, #1151541, #1151829 high

Version 0.16.2 of debusine is marked for autoremoval from testing on Sun 22 Nov 2026. It depends (transitively) on debugpy, ipykernel, ipython, jupyter-console, jupyter-server-terminals, mkdocs-macros-plugin, python-aiobotocore, python-botocore, python-django, python-django-postgres-extra, python-hypothesis, python-readme-renderer, python-syrupy, python-testfixtures, affected by #1126323, #1145153, #1145330, #1145439, #1145458, #1146361, #1146434, #1147441, #1149388, #1149942, #1150176, #1151257, #1151398, #1151541, #1151829. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-10-23 Last update: 2026-11-02 19:33

27 open merge requests in Salsa normal

There are 27 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-11-02 Last update: 2026-11-02 18:01

33 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 9d578b1bb7d153f2b9b92f491e694874d06fe438
Merge: f4a8ce16d e7c00486a
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Nov 2 15:57:35 2026 +0000

    Add support for autopkgtest_variant (MR !3446)
    
    This allows running the latest code from autopkgtest's development
    branch rather than the packaged version.  Since this allows running code
    cloned from a remote branch outside any containment, we use scheduler
    tags to restrict tasks using this parameter to run only on workers that
    have been specifically configured to accept them.
    
    Fixes: #1363
    
    Closes #1363
    
    Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3446

commit e7c00486a6b90d9de8d381d1f8f4b47773884841
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Nov 2 14:50:45 2026 +0000

    Fix typo in scheduler tags documentation

commit a4560ae7bf32d95fb988044661d695a20eb5ea38
Author: Colin Watson <cjwatson@debian.org>
Date:   Fri Oct 30 15:34:56 2026 +0000

    Add support for autopkgtest_variant
    
    This allows running the latest code from autopkgtest's development
    branch rather than the packaged version.  Since this allows running code
    cloned from a remote branch outside any containment, we use scheduler
    tags to restrict tasks using this parameter to run only on workers that
    have been specifically configured to accept them.
    
    Fixes: #1363

commit f4a8ce16d05a5f75d78bde4e67f05fe8111e6e0f
Merge: fe3139671 d1ff131aa
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Nov 2 14:24:52 2026 +0000

    Fix most test warnings on forky (MR !3448)
    
    There are a few left due to a minor bug in dput-ng, which I just fixed
    in version 1.47.
    
    Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3448

commit fe31396713f057aa53b46ea5df31c2ee4e1c8831
Merge: 7b35e806f 00a946a60
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Nov 2 14:04:07 2026 +0000

    docs: Describe how to use AWS KMS with Debusine (MR !3444)
    
    Part of #1657.
    
    Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3444

commit 7b35e806f4b85c18345b3dd75735377e481230c3
Merge: c8edc6168 f888e534e
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Nov 2 13:54:38 2026 +0000

    signing: Add a move_key command (MR !3443)
    
    Now that we support storing some keys in AWS KMS, instance
    administrators may want to move existing keys from software encryption
    into KMS.  This was possible beforehand, but involved a considerable
    amount of manual and error-prone work, so automate it.
    
    The unit tests do their best to check things by running the required
    cryptography in reverse, but ultimately the only real test is to run
    this against AWS; even the `moto` library doesn't yet cover importing
    keys.  Using this code, I was able to generate a key stored with
    software encryption, move it to KMS, and sign a `Release` file using it.
    
    I anticipate that this will be useful for other kinds of moves in future
    when we support more storage types, so I made the command general enough
    to be able to handle that.
    
    Part of #1657.
    
    Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3443

commit c8edc6168e34545b120220106b9c086f1cddc0db
Merge: dd2fdf81b e79d563fb
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Nov 2 12:55:02 2026 +0000

    Add `debusine-signing register_aws_kms_key` (MR !3442)
    
    This is useful if you have manually created a key in AWS KMS (perhaps
    because Debusine's built-in key generation isn't quite right for your
    needs) and then want to register it with Debusine.
    
    Part of #1657.
    
    Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3442

commit d1ff131aaf3a9ee5190e57d05ed1386c2fd41dd5
Author: Colin Watson <cjwatson@debian.org>
Date:   Fri Oct 30 17:20:09 2026 +0000

    Fix most test warnings on forky
    
    There are a few left due to a minor bug in dput-ng, which I just fixed
    in version 1.47.

commit dd2fdf81b15c27d539f57c8164970b8502ad34f3
Merge: 1571b8300 211b18d46
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Nov 2 11:55:05 2026 +0000

    Work around spurious coverage gaps in forky (MR !3447)
    
    We run into https://github.com/coveragepy/coveragepy/issues/1987 ("3.14:
    branch coverage incorrect with triple-nested context manager") in
    several places, causing spurious coverage gaps.  I filed a bug asking
    the python-coverage maintainer to upgrade to 7.17.0, but this is easy
    enough to work around in the meantime.
    
    Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3447

commit 00a946a60ba6726e3ae91aa2598c62afd5d06324
Author: Colin Watson <cjwatson@debian.org>
Date:   Thu Oct 29 17:06:41 2026 +0000

    docs: Describe how to use AWS KMS with Debusine
    
    Part of #1657.

commit 1571b8300d553cfc2669d57c386155435bf6e130
Merge: 40cfd6fe5 eb8238f5d
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Nov 2 11:41:58 2026 +0000

    update_suites: Honour signing_key_storage field on archives (MR !3441)
    
    Part of #1657.
    
    Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3441

commit f888e534efe0774f18d64e341c4ed2e6d2fa08cf
Author: Colin Watson <cjwatson@debian.org>
Date:   Thu Oct 29 16:48:40 2026 +0000

    signing: Add a move_key command
    
    Now that we support storing some keys in AWS KMS, instance
    administrators may want to move existing keys from software encryption
    into KMS.  This was possible beforehand, but involved a considerable
    amount of manual and error-prone work, so automate it.
    
    The unit tests do their best to check things by running the required
    cryptography in reverse, but ultimately the only real test is to run
    this against AWS; even the `moto` library doesn't yet cover importing
    keys.  Using this code, I was able to generate a key stored with
    software encryption, move it to KMS, and sign a `Release` file using it.
    
    I anticipate that this will be useful for other kinds of moves in future
    when we support more storage types, so I made the command general enough
    to be able to handle that.
    
    Part of #1657.

commit e79d563fbf6a20b5924a84474f9dc85b921cb6f9
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 28 15:30:19 2026 +0000

    Add `debusine-signing register_aws_kms_key`
    
    This is useful if you have manually created a key in AWS KMS (perhaps
    because Debusine's built-in key generation isn't quite right for your
    needs) and then want to register it with Debusine.
    
    Part of #1657.

commit 211b18d4611cb7807760ee27fc0a623db11f3279
Author: Colin Watson <cjwatson@debian.org>
Date:   Fri Oct 30 16:35:13 2026 +0000

    Work around spurious coverage gaps in forky
    
    We run into https://github.com/coveragepy/coveragepy/issues/1987 ("3.14:
    branch coverage incorrect with triple-nested context manager") in
    several places, causing spurious coverage gaps.  I filed a bug asking
    the python-coverage maintainer to upgrade to 7.17.0, but this is easy
    enough to work around in the meantime.

commit 6e5068a36244c6683a56669ac0b3fe57eedce3b5
Author: Colin Watson <cjwatson@debian.org>
Date:   Thu Oct 29 16:51:57 2026 +0000

    doc: Update and fix manual registration instructions in configure-hsm

commit a20564f7b06597efc2220c4d63f192774fa7c467
Author: Colin Watson <cjwatson@debian.org>
Date:   Thu Oct 29 16:32:44 2026 +0000

    signing: Use PGPKey.userids rather than PGPKey._uids

commit 7d3df5f9c7d5cbc4634df2741a6a0dee119763a0
Author: Colin Watson <cjwatson@debian.org>
Date:   Thu Oct 29 16:29:42 2026 +0000

    signing: Factor out aws_kms_tags function

commit 26bd1a28f72929466d0b663696e54d324351b794
Author: Colin Watson <cjwatson@debian.org>
Date:   Thu Oct 29 16:16:51 2026 +0000

    signing: Make AvailableKeyFileSystem.key_path public
    
    Although this is the private key, the point of the
    `AvailableKeyFileSystem` context manager is to manage its availability
    on disk, so having this attribute be private was only a fig leaf anyway.
    The private attribute was already used from outside the module by
    `debusine.signing.gnupg`.

commit eb8238f5d3e8dbfada201470b586275b21104a9f
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 28 15:24:16 2026 +0000

    update_suites: Honour signing_key_storage field on archives
    
    Part of #1657.

commit 40cfd6fe514ece0cfa379632e36a1aef72176d14
Merge: 2dbca83cc 8a98059e8
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 28 14:59:46 2026 +0000

    signing: Support OpenPGP repository keys in AWS KMS (MR !3435)
    
    Part of #1657.
    
    Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3435

commit 2dbca83cc4cae9044bf57c2b5fc5fd82be83167a
Merge: 471616568 f75104f46
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 28 14:17:33 2026 +0000

    Move queries in scopes:file-storages to a statistics table (MR !3440)
    
    These are too slow to run inline in a web request.
    
    While it would probably be technically possible to track the maximum
    `FileInStore.id` for each store and keep the results completely up to
    date aside from deletions, I don't think it's worth it for a status web
    page.  I just added a note instead to say that the statistics are
    updated hourly.
    
    Part of #1602.
    
    Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3440

commit 8a98059e817cdf22ebee091e4bd95ec18b950976
Author: Colin Watson <cjwatson@debian.org>
Date:   Tue Oct 27 13:40:35 2026 +0000

    ci: Check that signing migrations are up to date

commit 76502081aa69f8f1dcc1b9b74c222363e45b946c
Author: Colin Watson <cjwatson@debian.org>
Date:   Tue Oct 27 13:39:51 2026 +0000

    Add AuditLog.storage field
    
    It seems useful to record which storage type events happened in.

commit f685ac4e0f5f11b4cd0c34f2bbf9f380f1689f5d
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Oct 26 16:28:51 2026 +0000

    Add news fragment

commit 0eac485aa848f7eb40aa9509ff84fb5d59b9c2b2
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Oct 26 16:27:28 2026 +0000

    GenerateKey: Allow storing OpenPGP repository keys in AWS KMS

commit fa2208f0c187d6f0240b1c18ef6fac9d52006a44
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Oct 26 13:02:23 2026 +0000

    signing: Add AWS KMS support to Key

commit d18a50221f8acf03f0953f39be261beef5f4fdfc
Author: Colin Watson <cjwatson@debian.org>
Date:   Tue Oct 27 12:17:44 2026 +0000

    signing: Test UEFI/PKCS11_STATIC signing cases

commit 6556540a9e893cf38db85337ae39347bf6496582
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Oct 26 12:49:23 2026 +0000

    signing: Add OpenPGP generate/sign logic using AWS KMS
    
    This only supports Ed25519 keys for now, but that's also true for our
    GnuPG-based implementation.

commit 900969e7a8f138a74301618a8346b19fd8799bc5
Author: Colin Watson <cjwatson@debian.org>
Date:   Mon Oct 26 12:36:35 2026 +0000

    signing: Make BaseAvailableKey.certificate_path public
    
    The certificate is the public half of the key, so this does no harm.

commit 471616568a0607927f3a191ed6b3151d7245d5cd
Merge: 4786d938e 874238272
Author: Stefano Rivera <stefanor@debian.org>
Date:   Wed Oct 28 14:06:37 2026 +0000

    Release 0.16.2 (MR !3438)
    
    
    Merge-Request: https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3438

commit f75104f462a6d726715ce724a8e2598a8fef08b4
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 28 02:05:53 2026 +0000

    Optimize "Referenced by artifact relations" query on file stores
    
    This is a similar problem to the one I fixed in
    https://salsa.debian.org/freexian-team/debusine/-/merge_requests/1945:
    pulling the IDs of artifacts to keep back into Python before asking
    PostgreSQL for the files referenced by them avoids a catastrophically
    bad query plan, and while this is conceptually inelegant it only takes a
    few seconds in practice.
    
    In fact, this will use much less memory than the corresponding code in
    `debusine-admin delete_expired`, because we're only interested in the
    artifacts that are indirectly kept due to relations, not those that are
    directly kept due to expiry times or references from collections.  On
    debusine.debian.net, this indirect keep count is currently about 5% of
    the total keep count.

commit 61b032601f99824631a1db5b878e6520dada0a86
Author: Colin Watson <cjwatson@debian.org>
Date:   Tue Oct 27 22:39:46 2026 +0000

    Move queries in scopes:file-storages to a statistics table
    
    These are too slow to run inline in a web request.
    
    While it would probably be technically possible to track the maximum
    `FileInStore.id` for each store and keep the results completely up to
    date aside from deletions, I don't think it's worth it for a status web
    page.  I just added a note instead to say that the statistics are
    updated hourly.
    
    Part of #1602.

commit 6a553be3a6c957fb896bf6efa6962007307c493f
Author: Colin Watson <cjwatson@debian.org>
Date:   Tue Oct 27 21:49:29 2026 +0000

    Give part_of_collection_with_retains_artifacts a shorter name

Created: 2026-09-24 Last update: 2026-11-02 18:01

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-10-29 Last update: 2026-10-29 12:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-10-28 15:20

news

[rss feed]

[2026-11-02] Accepted debusine 0.16.2~bpo13+1 (source) into stable-backports (Colin Watson)
[2026-10-28] Accepted debusine 0.16.1~bpo13+1 (source) into stable-backports (Colin Watson)
[2026-10-28] Accepted debusine 0.16.2 (source) into unstable (Stefano Rivera)
[2026-10-18] debusine 0.16.1 MIGRATED to testing (Debian testing watch)
[2026-10-12] Accepted debusine 0.16.1 (source) into unstable (Colin Watson)
[2026-09-30] debusine 0.16.0 MIGRATED to testing (Debian testing watch)
[2026-09-29] Accepted debusine 0.16.0~bpo13+1 (source) into stable-backports (Stefano Rivera)
[2026-09-23] Accepted debusine 0.16.0 (source) into unstable (Stefano Rivera)
[2026-07-30] Accepted debusine 0.15.0~bpo13+1 (source) into stable-backports (Colin Watson)
[2026-07-30] debusine 0.15.0 MIGRATED to testing (Debian testing watch)
[2026-07-21] Accepted debusine 0.15.0 (source) into unstable (Colin Watson)
[2026-06-30] Accepted debusine 0.11.3+deb13u1 (source) into proposed-updates (Debian FTP Masters)
[2026-06-28] debusine 0.14.10 MIGRATED to testing (Debian testing watch)
[2026-06-27] Accepted debusine 0.14.10~bpo13+1 (source) into stable-backports (Stefano Rivera)
[2026-06-22] Accepted debusine 0.14.10 (source) into unstable (Stefano Rivera)
[2026-06-05] Accepted debusine 0.14.9~bpo13+1 (source) into stable-backports (Colin Watson)
[2026-06-05] debusine 0.14.9 MIGRATED to testing (Debian testing watch)
[2026-06-02] Accepted debusine 0.14.9 (source) into unstable (Stefano Rivera)
[2026-05-31] debusine 0.14.8 MIGRATED to testing (Debian testing watch)
[2026-05-31] Accepted debusine 0.14.8~bpo13+1 (source) into stable-backports (Stefano Rivera)
[2026-05-25] Accepted debusine 0.14.8 (source) into unstable (Stefano Rivera)
[2026-04-27] Accepted debusine 0.14.7~bpo13+1 (source) into stable-backports (Colin Watson)
[2026-04-27] debusine 0.14.7 MIGRATED to testing (Debian testing watch)
[2026-04-22] Accepted debusine 0.14.7 (source) into unstable (Stefano Rivera)
[2026-03-29] Accepted debusine 0.14.6 (source) into unstable (Stefano Rivera)
[2026-03-03] Accepted debusine 0.14.5~bpo13+1 (source) into stable-backports (Stefano Rivera)
[2026-03-03] debusine 0.14.5 MIGRATED to testing (Debian testing watch)
[2026-02-24] Accepted debusine 0.14.5 (source) into unstable (Stefano Rivera)
[2026-02-05] debusine 0.14.4 MIGRATED to testing (Debian testing watch)
[2026-01-30] Accepted debusine 0.14.4 (source) into unstable (Stefano Rivera)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 2)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
l10n (100, -)
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.15.0