Debian Package Tracker
Register | Log in
Subscribe

devscripts

scripts to make the life of a Debian Package maintainer easier

Choose email to subscribe with

general
  • source: devscripts (main)
  • version: 2.25.27
  • maintainer: Devscripts Maintainers (DMD)
  • uploaders: Holger Levsen [DMD] – Benjamin Drung [DMD] – Mattia Rizzolo [DMD]
  • arch: all
  • std-ver: 4.7.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 2.21.3+deb11u1
  • oldstable: 2.23.4+deb12u2
  • old-bpo: 2.25.15~bpo12+1
  • stable: 2.25.15+deb13u1
  • stable-bpo: 2.25.22~bpo13+1
  • testing: 2.25.27
  • unstable: 2.25.27
versioned links
  • 2.21.3+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.23.4+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.25.15~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.25.15+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.25.22~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.25.27: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • devscripts (538 bugs: 0, 217, 321, 0)
action needed
1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:
  • CVE-2025-8454: It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.
Created: 2025-07-14 Last update: 2025-11-25 06:16
1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:
  • CVE-2025-8454: It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.
Created: 2025-08-09 Last update: 2025-11-25 06:16
Depends on packages which need a new maintainer normal
The packages that devscripts depends on which need a new maintainer are:
  • docbook-xsl (#802370)
    • Build-Depends: docbook-xsl
  • svn-buildpackage (#726770)
    • Suggests: svn-buildpackage
Created: 2019-11-22 Last update: 2025-11-30 01:31
4 bugs tagged help in the BTS normal
The BTS contains 4 bugs tagged help, please consider helping the maintainer in dealing with them.
Created: 2025-08-23 Last update: 2025-11-30 01:30
45 bugs tagged patch in the BTS normal
The BTS contains patches fixing 45 bugs (47 if counting merged bugs), consider including or untagging them.
Created: 2025-01-06 Last update: 2025-11-30 01:30
version in VCS is newer than in repository, is it time to upload? normal
vcswatch reports that this package seems to have a new changelog entry (version 2.25.28, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:
commit 344ebc98db24d26c884bc60db7c5e985f383c84a
Author: Yadd <yadd@debian.org>
Date:   Wed Nov 26 09:37:59 2025 +0100

    Fix regex
    
    Gbp-Dch: ignore

commit a5071671c152e31e0df42e18d815765d9df2713f
Author: Yadd <yadd@debian.org>
Date:   Wed Nov 26 07:57:20 2025 +0100

    Improve default Uversion-Mangle to cover trailing dot or dash and uppercase (thanks to Jonas Smedegaard)
    
    Closes: #1112452

commit cf0b521e8f6e5a5a84576092576be3e224876209
Author: Yadd <yadd@debian.org>
Date:   Wed Nov 26 09:38:50 2025 +0100

    Fix perl format of bts.pl
    
    Gbp-Dch: ignore

commit 0ff1d85300639ee63203bb6899bb65a19dcb1186
Author: Yadd <yadd@debian.org>
Date:   Wed Nov 26 07:52:28 2025 +0100

    Update French translations

commit a67f6329032a20c8bea00f32441f34ccc8d90a4d
Author: Daniel Gröber <dxld@darkboxed.org>
Date:   Tue Nov 25 10:55:38 2025 +0100

    bts: browse: Fix background child inadvertently executing commands
    
    The child process must exit(), not return to processing remaining commands.
    
    (cherry picked from commit f0e3ba2b67548e5154cae4da6166f158269f4209)
    Signed-off-by: Holger Levsen <holger@layer-acht.org>

commit c96d139efed55b8a28ff878a363c9e7ccca48e9a
Author: Daniel Gröber <dxld@darkboxed.org>
Date:   Tue Nov 25 10:54:13 2025 +0100

    bts: browse: Fix background download with blocking browsers
    
    runbrowser() may block! Have to run it after fork()ing. Eg. first firefox
    call when no instance is running will block.
    
    (cherry picked from commit 11c68366ed1606b0a8f5f64da45e273e04a73d28)
    Signed-off-by: Holger Levsen <holger@layer-acht.org>

commit 8f27e5143741cc699480a7205fa4eee8fe0cc8c3
Author: Daniel Gröber <dxld@darkboxed.org>
Date:   Tue Nov 25 10:50:25 2025 +0100

    bts: browse: Push down $caching check (Closes: #1121335)
    
    Thanks for quick report gregor!
    
    (cherry picked from commit 2d334098bab3f3dd661111c445eda78d65b14c7b)
    Signed-off-by: Holger Levsen <holger@layer-acht.org>

commit bbf587176e3604ccc11ab33a5242aed73aca8976
Author: Guillem Jover <guillem@debian.org>
Date:   Sun Nov 23 22:38:13 2025 +0100

    Pass also no_check to Dpkg::IPC spawn() and wait_child()
    
    With the upcoming dpkg 1.23.0, the "nocheck" option is deprecated and
    emits a warning to that effect, which is replaced by the "no_check"
    option.
    
    To ease in the migration and to avoid making code not backportable,
    the deprecated option is accepted with no warning if the new option is
    passed as well, so that both old and new dpkg modules can be used.
    Only after 1.24.0 the old option will be obsoleted and unconditionally
    start generating warnings or errors.
    
    (cherry picked from commit a29e2bfac521f30cfaf56c99e98842010fce91e7)
    Signed-off-by: Holger Levsen <holger@layer-acht.org>

commit 82caebaee2382c7befe6128ba1de7de73217faee
Author: Yadd <yadd@debian.org>
Date:   Thu Nov 6 06:36:09 2025 +0100

    uscan: accept also "Dist" into Github template like other templates

commit 66360fb767d0bd6a3960cc9ba0cbb135c3d18666
Author: Hugh McMaster <hmc@debian.org>
Date:   Sun Nov 23 22:05:52 2025 +1100

    uscan/Git.pm: Call 'show-ref' and 'ls-remote' with '--tags'

commit 017e3a20fef4d36f99bb8d91b2011b03d966b330
Author: Hugh McMaster <hmc@debian.org>
Date:   Thu Nov 20 23:50:55 2025 +1100

    uscan/WatchSource.pm: Update some output messages

commit 1af9a714002dca9a485ffb106ab37f570eae5dff
Author: Hugh McMaster <hmc@debian.org>
Date:   Thu Nov 20 23:27:08 2025 +1100

    uscan/Git.pm: Set $newfile as a remote reference in upstream mode
    
    Closes: #1120533

commit 3a308a31b3089afeb5909b321c43eb0d1ca0dc91
Author: Hugh McMaster <hmc@debian.org>
Date:   Wed Nov 19 23:11:59 2025 +1100

    uscan/Git.pm: Update 'git upstream' code path and debug output

commit 581a30cfea4feaa4bdc6dda3a6d58ab7839c67be
Author: Hugh McMaster <hmc@debian.org>
Date:   Wed Nov 19 23:01:21 2025 +1100

    uscan/Git.pm: Remove 'eval' wrapper

commit cdde301c8b797e4c68821b3a16b2cd9f8bddc0d4
Author: Guillem Jover <guillem@debian.org>
Date:   Mon Dec 2 02:25:53 2024 +0100

    debdiff: Add support for new --no-check option
    
    The debdiff command can compare a couple of Debian source packages
    (.dsc), but it needs to unpack them first with dpkg-source. That
    command will check the checksums and the signatures.
    
    The problem is that letting dpkg-source verify the signatures can be
    confusing for users when we are sure the provenance of the .dsc is from
    a signed and verified Debian repository, as the signatures or the keys
    that made them might have expired, or been revoked, the keys might be
    using weak algorithms, or the keys might not even be present in the
    keyrings if the holders are no longer project members.
    
    In the context of a signed repository their primary purpose is to
    transfer the trust anchor from the uploader to the archive software,
    which can then handle metaindices resigning, key rotation, expiration,
    etc, which do not suffer from the problems with a one-time static
    signature.
    
    It would then be helpful to have an option that can be used to request
    passing --no-check (f.ex.) to dpkg-source so that it avoids doing such
    checks (when we can guarantee the safe provenance of the .dsc), in a
    similar way how apt passes it too on «apt source».
    
    This is a blocker to be able to fix #1016087 in apt-listdifferences.
    
    Closes: #1016135
    (cherry picked from commit 1d14413705286ca09e1f6e6adb16d9718dfbfd74)
    Signed-off-by: Holger Levsen <holger@layer-acht.org>

commit 506f96a06dd78ccb32c1b937141eeb33bd6d6b9d
Author: Holger Levsen <holger@layer-acht.org>
Date:   Sat Nov 22 19:09:56 2025 +0100

    Start 2.25.28 development.
    
    d/changelog entries will be written on release
    using the git commit messages.
    
    Use 'gbp dch --since v2.25.27 --multimaint-merge'
    to write d/changelog entries since that last release.
    
    Gbp-Dch: ignore
    Signed-off-by: Holger Levsen <holger@layer-acht.org>
Created: 2025-07-29 Last update: 2025-11-28 12:02
20 open merge requests in Salsa normal
There are 20 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.
Created: 2025-09-17 Last update: 2025-09-17 09:05
1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:
  • CVE-2025-8454: (needs triaging) It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-08-09 Last update: 2025-11-25 06:16
1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:
  • CVE-2025-8454: (needs triaging) It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-07-14 Last update: 2025-11-25 06:16
news
[rss feed]
  • [2025-11-25] devscripts 2.25.27 MIGRATED to testing (Debian testing watch)
  • [2025-11-22] Accepted devscripts 2.25.27 (source) into unstable (Holger Levsen)
  • [2025-11-22] devscripts 2.25.26 MIGRATED to testing (Debian testing watch)
  • [2025-11-19] Accepted devscripts 2.25.26 (source) into unstable (Jochen Sprickerhof)
  • [2025-11-08] devscripts 2.25.25 MIGRATED to testing (Debian testing watch)
  • [2025-11-06] Accepted devscripts 2.25.25 (source) into unstable (Holger Levsen)
  • [2025-11-05] Accepted devscripts 2.25.24 (source) into unstable (Holger Levsen)
  • [2025-11-04] devscripts 2.25.23 MIGRATED to testing (Debian testing watch)
  • [2025-11-02] Accepted devscripts 2.25.23 (source) into unstable (Holger Levsen)
  • [2025-10-30] devscripts 2.25.22 MIGRATED to testing (Debian testing watch)
  • [2025-10-29] Accepted devscripts 2.25.22~bpo13+1 (source) into stable-backports (Jochen Sprickerhof)
  • [2025-10-27] Accepted devscripts 2.25.22 (source) into unstable (Jochen Sprickerhof)
  • [2025-10-26] devscripts 2.25.21 MIGRATED to testing (Debian testing watch)
  • [2025-10-24] Accepted devscripts 2.25.21 (source) into unstable (Holger Levsen)
  • [2025-10-22] devscripts 2.25.20 MIGRATED to testing (Debian testing watch)
  • [2025-10-19] Accepted devscripts 2.25.20 (source) into unstable (Holger Levsen)
  • [2025-09-22] Accepted devscripts 2.25.19~bpo13+1 (source all) into stable-backports (Debian FTP Masters) (signed by: Roger Shimizu)
  • [2025-08-25] devscripts 2.25.19 MIGRATED to testing (Debian testing watch)
  • [2025-08-24] Accepted devscripts 2.25.15+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Sebastiaan Couwenberg)
  • [2025-08-23] Accepted devscripts 2.25.19 (source) into unstable (Yadd) (signed by: Xavier Guimard)
  • [2025-08-15] Accepted devscripts 2.25.18 (source) into unstable (Sean Whitton)
  • [2025-07-28] Accepted devscripts 2.25.17 (source) into experimental (Yadd) (signed by: Xavier Guimard)
  • [2025-07-20] Accepted devscripts 2.25.16 (source all) into experimental (Yadd) (signed by: Xavier Guimard)
  • [2025-07-11] Accepted devscripts 2.25.15~bpo12+1 (source) into stable-backports (Roger Shimizu)
  • [2025-06-21] devscripts 2.25.15 MIGRATED to testing (Debian testing watch)
  • [2025-06-16] Accepted devscripts 2.25.15 (source) into unstable (Holger Levsen)
  • [2025-06-01] devscripts 2.25.14 MIGRATED to testing (Debian testing watch)
  • [2025-05-26] Accepted devscripts 2.25.14 (source) into unstable (Holger Levsen)
  • [2025-05-22] Accepted devscripts 2.25.13 (source) into unstable (Holger Levsen)
  • [2025-05-20] devscripts 2.25.12 MIGRATED to testing (Debian testing watch)
  • 1
  • 2
bugs [bug history graph]
  • all: 528 543
  • RC: 0
  • I&N: 211 218
  • M&W: 316 324
  • F&P: 1
  • patch: 45 47
  • help: 4
  • NC: 3
links
  • lintian
  • buildd: logs, reproducibility
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • l10n (89, -)
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 2.25.27
  • 45 bugs (2 patches)

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing