.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.40) .\" .\" Standard preamble: .\" ======================================================================== .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' . ds C` . ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is >0, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .\" .\" Avoid warning from groff about undefined register 'F'. .de IX .. .nr rF 0 .if \n(.g .if rF .nr rF 1 .if (\n(rF:(\n(.g==0)) \{\ . if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{\ . nr % 0 . nr F 2 . \} . \} .\} .rr rF .\" ======================================================================== .\" .IX Title "USCAN 1" .TH USCAN 1 "2022-06-21" "Debian Utilities" " " .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH "NAME" uscan \- scan/watch upstream sources for new releases of software .SH "SYNOPSIS" .IX Header "SYNOPSIS" \&\fBuscan\fR [\fIoptions\fR] [\fIpath\fR] .SH "DESCRIPTION" .IX Header "DESCRIPTION" For basic usage, \fBuscan\fR is executed without any arguments from the root of the Debianized source tree where you see the \fIdebian/\fR directory, or a directory containing multiple source trees. .PP Unless \-\-watchfile is given, \fBuscan\fR looks recursively for valid source trees starting from the current directory (see the below section \&\*(L"Directory name checking\*(R" for details). .PP For each valid source tree found, typically the following happens: .IP "\(bu" 4 \&\fBuscan\fR reads the first entry in \fIdebian/changelog\fR to determine the source package name \fI\fR and the last upstream version. .IP "\(bu" 4 \&\fBuscan\fR process the watch lines \fIdebian/watch\fR from the top to the bottom in a single pass. .RS 4 .IP "\(bu" 4 \&\fBuscan\fR downloads a web page from the specified \fI\s-1URL\s0\fR in \&\fIdebian/watch\fR. .IP "\(bu" 4 \&\fBuscan\fR extracts hrefs pointing to the upstream tarball(s) from the web page using the specified \fImatching-pattern\fR in \fIdebian/watch\fR. .IP "\(bu" 4 \&\fBuscan\fR downloads the upstream tarball with the highest version newer than the last upstream version. .IP "\(bu" 4 \&\fBuscan\fR saves the downloaded tarball to the parent \fB../\fR directory: \&\fI../\-.tar.gz\fR .IP "\(bu" 4 \&\fBuscan\fR invokes \fBmk-origtargz\fR to create the source tarball: \fI../_.orig.tar.gz\fR .RS 4 .IP "\(bu" 4 For a multiple upstream tarball (\s-1MUT\s0) package, the secondary upstream tarball will instead be named \fI../_.orig\-.tar.gz\fR. .RE .RS 4 .RE .IP "\(bu" 4 Repeat until all lines in \fIdebian/watch\fR are processed. .RE .RS 4 .RE .IP "\(bu" 4 \&\fBuscan\fR invokes \fBuupdate\fR to create the Debianized source tree: \fI../\-/*\fR .PP Please note the following. .IP "\(bu" 4 For simplicity, the compression method used in examples is \fBgzip\fR with \&\fB.gz\fR suffix. Other methods such as \fBxz\fR, \fBbzip2\fR, and \fBlzma\fR with corresponding \fBxz\fR, \fBbz2\fR and \fBlzma\fR suffixes may also be used. .IP "\(bu" 4 The new \fBversion=4\fR enables handling of multiple upstream tarball (\s-1MUT\s0) packages but this is a rare case for Debian packaging. For a single upstream tarball package, there is only one watch line and no \fI../_.orig\-.tar.gz\fR . .IP "\(bu" 4 \&\fBuscan\fR with the \fB\-\-verbose\fR option produces a human readable report of \fBuscan\fR's execution. .IP "\(bu" 4 \&\fBuscan\fR with the \fB\-\-debug\fR option produces a human readable report of \&\fBuscan\fR's execution including internal variable states. .IP "\(bu" 4 \&\fBuscan\fR with the \fB\-\-extra\-debug\fR option produces a human readable report of \fBuscan\fR's execution including internal variable states and remote content during \*(L"search\*(R" step. .IP "\(bu" 4 \&\fBuscan\fR with the \fB\-\-dehs\fR option produces an upstream package status report in \s-1XML\s0 format for other programs such as the Debian External Health System. .IP "\(bu" 4 The primary objective of \fBuscan\fR is to help identify if the latest version upstream tarball is used or not; and to download the latest upstream tarball. The ordering of versions is decided by \fBdpkg \-\-compare\-versions\fR. .IP "\(bu" 4 \&\fBuscan\fR with the \fB\-\-safe\fR option limits the functionality of \fBuscan\fR to its primary objective. Both the repacking of downloaded files and updating of the source tree are skipped to avoid running unsafe scripts. This also changes the default to \fB\-\-no\-download\fR and \fB\-\-skip\-signature\fR. .SH "FORMAT OF THE WATCH FILE" .IX Header "FORMAT OF THE WATCH FILE" The current version 4 format of \fIdebian/watch\fR can be summarized as follows: .IP "\(bu" 4 Leading spaces and tabs are dropped. .IP "\(bu" 4 Empty lines are dropped. .IP "\(bu" 4 A line started by \fB#\fR (hash) is a comment line and dropped. .IP "\(bu" 4 A single \fB\e\fR (back slash) at the end of a line is dropped and the next line is concatenated after removing leading spaces and tabs. The concatenated line is parsed as a single line. (The existence or non-existence of the space before the tailing single \fB\e\fR is significant.) .IP "\(bu" 4 The first non-comment line is: .RS 4 .IP "\fBversion=4\fR" 4 .IX Item "version=4" .RE .RS 4 .Sp This is a required line and the recommended version number. .Sp If you use "\fBversion=3\fR" instead here, some features may not work as documented here. See \*(L"\s-1HISTORY AND UPGRADING\*(R"\s0. .RE .IP "\(bu" 4 The following non-comment lines (watch lines) specify the rules for the selection of the candidate upstream tarball URLs and are in one of the following three formats: .RS 4 .IP "\(bu" 4 \&\fBopts="\fR \fI...\fR \fB"\fR \fBhttp://\fR\fI\s-1URL\s0\fR \fImatching-pattern\fR [\fIversion\fR [\fIscript\fR]] .IP "\(bu" 4 \&\fBhttp://\fR\fI\s-1URL\s0\fR \fImatching-pattern\fR [\fIversion\fR [\fIscript\fR]] .IP "\(bu" 4 \&\fBopts="\fR \fI...\fR \fB"\fR .RE .RS 4 .Sp Here, .IP "\(bu" 4 \&\fBopts="\fR \fI...\fR \fB"\fR specifies the behavior of \fBuscan\fR. See \*(L"\s-1WATCH FILE OPTIONS\*(R"\s0. .IP "\(bu" 4 \&\fBhttp://\fR\fI\s-1URL\s0\fR specifies the web page where upstream publishes the link to the latest source archive. .RS 4 .IP "\(bu" 4 \&\fBhttps://\fR\fI\s-1URL\s0\fR may also be used, as may .IP "\(bu" 4 \&\fBftp://\fR\fI\s-1URL\s0\fR .IP "\(bu" 4 Some parts of \fI\s-1URL\s0\fR may be in the regex match pattern surrounded between \fB(\fR and \fB)\fR such as \fB/foo/bar\-([\e.\ed]+)/\fR. (If multiple directories match, the highest version is picked.) Otherwise, the \fI\s-1URL\s0\fR is taken as verbatim. .RE .RS 4 .RE .IP "\(bu" 4 \&\fImatching-pattern\fR specifies the full string matching pattern for hrefs in the web page. See \*(L"\s-1WATCH FILE EXAMPLES\*(R"\s0. .RS 4 .IP "\(bu" 4 All matching parts in \fB(\fR and \fB)\fR are concatenated with \fB.\fR (period) to form the upstream version. .IP "\(bu" 4 If the hrefs do not contain directories, you can combine this with the previous entry. I.e., \fBhttp://\fR\fI\s-1URL\s0\fR\fB/\fR\fImatching-pattern\fR . .RE .RS 4 .RE .IP "\(bu" 4 \&\fIversion\fR restricts the upstream tarball which may be downloaded. The newest available version is chosen in each case. .RS 4 .IP "\(bu" 4 \&\fBdebian\fR \fI(default)\fR requires the downloading upstream tarball to be newer than the version obtained from \fIdebian/changelog\fR. .IP "\(bu" 4 \&\fIversion-number\fR such as \fB12.5\fR requires the upstream tarball to be newer than the \fIversion-number\fR. .IP "\(bu" 4 \&\fBsame\fR requires the downloaded version of the secondary tarballs to be exactly the same as the one for the first upstream tarball downloaded. (Useful only for \s-1MUT\s0) .IP "\(bu" 4 \&\fBprevious\fR restricts the version of the signature file. (Used with pgpmode=previous) .IP "\(bu" 4 \&\fBignore\fR does not restrict the version of the secondary tarballs. (Maybe useful for \s-1MUT\s0) .IP "\(bu" 4 \&\fBgroup\fR requires the downloading upstream tarball to be newer than the version obtained from \fIdebian/changelog\fR. Package version is the concatenation of all \*(L"group\*(R" upstream version. .IP "\(bu" 4 \&\fBchecksum\fR requires the downloading upstream tarball to be newer than the version obtained from \fIdebian/changelog\fR. Package version is the concatenation of the version of the main tarball, followed by a checksum of all the tarballs using the \*(L"checksum\*(R" version system. At least the main upstream source has to be declared as \*(L"group\*(R". .RE .RS 4 .RE .IP "\(bu" 4 \&\fIscript\fR is executed at the end of \fBuscan\fR execution with appropriate arguments provided by \fBuscan\fR \fI(default: no action)\fR. .RS 4 .IP "\(bu" 4 The typical Debian package is a non-native package made from one upstream tarball. Only a single line of the watch line in one of the first two formats is usually used with its \fIversion\fR set to \fBdebian\fR and \fIscript\fR set to \fBuupdate\fR. .IP "\(bu" 4 A native package should not specify \fIscript\fR. .IP "\(bu" 4 A multiple upstream tarball (\s-1MUT\s0) package should specify \fBuupdate\fR as \fIscript\fR in the last watch line and should skip specifying \fIscript\fR in the rest of the watch lines. .RE .RS 4 .RE .IP "\(bu" 4 The last format of the watch line is useful to set the persistent parameters: \fBuser-agent\fR, \fBcompression\fR. If this format is used, this must be followed by the \fI\s-1URL\s0\fR defining watch line(s). .IP "\(bu" 4 [ and ] in the above format are there to mark the optional parts and should not be typed. .RE .RS 4 .RE .PP There are a few special strings which are substituted by \fBuscan\fR to make it easy to write the watch file. .IP "\fB\f(CB@PACKAGE\fB@\fR" 4 .IX Item "@PACKAGE@" This is substituted with the source package name found in the first line of the \&\fIdebian/changelog\fR file. .IP "\fB\f(CB@ANY_VERSION\fB@\fR" 4 .IX Item "@ANY_VERSION@" This is substituted by the legal upstream version regex (capturing). .Sp .Vb 1 \& [\-_]?(\ed[\e\-+\e.:\e~\eda\-zA\-Z]*) .Ve .IP "\fB\f(CB@ARCHIVE_EXT\fB@\fR" 4 .IX Item "@ARCHIVE_EXT@" This is substituted by the typical archive file extension regex (non-capturing). .Sp .Vb 1 \& (?i)(?:\e.(?:tar\e.xz|tar\e.bz2|tar\e.gz|tar\e.zstd?|zip|tgz|tbz|txz)) .Ve .IP "\fB\f(CB@SIGNATURE_EXT\fB@\fR" 4 .IX Item "@SIGNATURE_EXT@" This is substituted by the typical signature file extension regex (non-capturing). .Sp .Vb 1 \& (?i)(?:\e.(?:tar\e.xz|tar\e.bz2|tar\e.gz|tar\e.zstd?|zip|tgz|tbz|txz))\*(Aq(?:\e.(?:asc|pgp|gpg|sig|sign))\*(Aq .Ve .IP "\fB\f(CB@DEB_EXT\fB@\fR" 4 .IX Item "@DEB_EXT@" This is substituted by the typical Debian extension regexp (capturing). .Sp .Vb 1 \& [\e+~](debian|dfsg|ds|deb)(\e.)?(\ed+)?$ .Ve .PP Some file extensions are not included in the above intentionally to avoid false positives. You can still set such file extension patterns manually. .SH "WATCH FILE OPTIONS" .IX Header "WATCH FILE OPTIONS" \&\fBuscan\fR reads the watch options specified in \fBopts="\fR \fI...\fR \fB"\fR to customize its behavior. Multiple options \fIoption1\fR, \fIoption2\fR, \fIoption3\fR, \&... can be set as \fBopts="\fR\fIoption1\fR\fB,\fR \fIoption2\fR\fB,\fR \fIoption3\fR\fB,\fR \fI ... \&\fR\fB"\fR . The double quotes are necessary if options contain any spaces. .PP Unless otherwise noted as persistent, most options are valid only within their containing watch line. .PP The available watch options are: .IP "\fBcomponent=\fR\fIcomponent\fR" 4 .IX Item "component=component" Set the name of the secondary source tarball as \fI_.orig\-.tar.gz\fR for a \s-1MUT\s0 package. .IP "\fBctype=\fR\fIcomponent-type\fR" 4 .IX Item "ctype=component-type" Set the type of component \fI(only \*(L"nodejs\*(R" and \*(L"perl\*(R" are available for now)\fR. This will help uscan to find current version if component version is ignored. .Sp When using \fBctype=nodejs\fR, uscan tries to find a version in \f(CW\*(C`package.json\*(C'\fR, when using \fBctype=perl\fR, uscan tries to find a version in \f(CW\*(C`META.json\*(C'\fR. If a version is found, it is used as current version for this component, regardless version found in Debian version string. This permits a better change detection when using \fIignore\fR or \fIchecksum\fR as Debian version. .IP "\fBcompression=\fR\fImethod\fR" 4 .IX Item "compression=method" Set the compression \fImethod\fR when the tarball is repacked (persistent). .Sp Available \fImethod\fR values are what mk-origtargz supports, so \fBxz\fR, \fBgzip\fR (alias \fBgz\fR), \fBbzip2\fR (alias \fBbz2\fR), \fBlzma\fR, \fBdefault\fR. The default method is currently \fBxz\fR. When uscan is launched in a debian source repository which format is \*(L"1.0\*(R" or undefined, the method switches to \fBgzip\fR. .Sp Please note the repacking of the upstream tarballs by \fBmk-origtargz\fR happens only if one of the following conditions is satisfied: .RS 4 .IP "\(bu" 4 \&\fB\s-1USCAN_REPACK\s0\fR is set in the devscript configuration. See \*(L"\s-1DEVSCRIPT CONFIGURATION VARIABLES\*(R"\s0. .IP "\(bu" 4 \&\fB\-\-repack\fR is set on the commandline. See <\s-1COMMANDLINE OPTIONS\s0>. .IP "\(bu" 4 \&\fBrepack\fR is set in the watch line as \fBopts="repack,\fR\fI...\fR\fB"\fR. .IP "\(bu" 4 The upstream archive is of \fBzip\fR type including \fBjar\fR, \fBxpi\fR, ... .IP "\(bu" 4 The upstream archive is of \fBzstd\fR (Zstandard) type. .IP "\(bu" 4 \&\fBFiles-Excluded\fR or \fBFiles\-Excluded\-\fR\fIcomponent\fR stanzas are set in \&\fIdebian/copyright\fR to make \fBmk-origtargz\fR invoked from \fBuscan\fR remove files from the upstream tarball and repack it. See \*(L"\s-1COPYRIGHT FILE EXAMPLES\*(R"\s0 and \fBmk\-origtargz\fR\|(1). .RE .RS 4 .RE .IP "\fBrepack\fR" 4 .IX Item "repack" Force repacking of the upstream tarball using the compression \fImethod\fR. .IP "\fBrepacksuffix=\fR\fIsuffix\fR" 4 .IX Item "repacksuffix=suffix" Add \fIsuffix\fR to the Debian package upstream version only when the source tarball is repackaged. This rule should be used only for a single upstream tarball package. .IP "\fBmode=\fR\fImode\fR" 4 .IX Item "mode=mode" Set the archive download \fImode\fR. .RS 4 .IP "\fB\s-1LWP\s0\fR" 4 .IX Item "LWP" This mode is the default one which downloads the specified tarball from the archive \s-1URL\s0 on the web. Automatically internal \fBmode\fR value is updated to either \fBhttp\fR or \fBftp\fR by \s-1URL.\s0 .IP "\fBgit\fR" 4 .IX Item "git" This mode accesses the upstream git archive directly with the \fBgit\fR command and packs the source tree with the specified tag via \fImatching-pattern\fR into \&\fIspkg-version\fR\fB.tar.xz\fR. .Sp If the upstream publishes the released tarball via its web interface, please use it instead of using this mode. This mode is the last resort method. .Sp For git mode, \fImatching-pattern\fR specifies the full string matching pattern for tags instead of hrefs. If \fImatching-pattern\fR is set to \&\fBrefs/tags/\fR\fItag-matching-pattern\fR, \fBuscan\fR downloads source from the \&\fBrefs/tags/\fR\fImatched-tag\fR of the git repository. The upstream version is extracted from concatenating the matched parts in \fB(\fR ... \fB)\fR with \fB.\fR . See \&\*(L"\s-1WATCH FILE EXAMPLES\*(R"\s0. .Sp If \fImatching-pattern\fR is set to \fB\s-1HEAD\s0\fR, \fBuscan\fR downloads source from the \&\fB\s-1HEAD\s0\fR of the git repository and the pertinent \fIversion\fR is automatically generated with the date and hash of the \fB\s-1HEAD\s0\fR of the git repository. .Sp If \fImatching-pattern\fR is set to \fBrefs/heads/\fR\fIbranch\fR, \fBuscan\fR downloads source from the named \fIbranch\fR of the git repository. .Sp The local repository is temporarily created as a bare git repository directory under the destination directory where the downloaded archive is generated. This is normally erased after the \fBuscan\fR execution. This local repository is kept if \fB\-\-debug\fR option is used. .Sp If the current directory is a git repository and the searched repository is listed among the registered \*(L"remotes\*(R", then uscan will use it instead of cloning separately. The only local change is that uscan will run a \*(L"fetch\*(R" command to refresh the repository. .IP "\fBsvn\fR" 4 .IX Item "svn" This mode accesses the upstream Subversion archive directly with the \fBsvn\fR command and packs the source tree. .Sp For svn mode, \fImatching-pattern\fR specifies the full string matching pattern for directories under Subversion repository directory, specified via \s-1URL.\s0 The upstream version is extracted from concatenating the matched parts in \fB(\fR ... \&\fB)\fR with \fB.\fR . .Sp If \fImatching-pattern\fR is set to \fB\s-1HEAD\s0\fR, \fBuscan\fR downloads the latest source tree of the \s-1URL.\s0 The upstream version is then constructed by appending the last revision of the \s-1URL\s0 to \fB0.0~svn\fR. .Sp As commit signing is not possible with Subversion, the default \fBpgpmode\fR is set to \fBnone\fR when \fBmode=svn\fR. Settings of \fBpgpmode\fR other than \fBdefault\fR and \&\fBnone\fR are reported as errors. .RE .RS 4 .RE .IP "\fBpretty=\fR\fIrule\fR" 4 .IX Item "pretty=rule" Set the upstream version string to an arbitrary format as an optional \fBopts\fR argument when the \fImatching-pattern\fR is \fB\s-1HEAD\s0\fR or \fBheads/\fR\fIbranch\fR for \&\fBgit\fR mode. For the exact syntax, see the \fBgit-log\fR manpage under \fBtformat\fR. The default is \fBpretty=0.0~git%cd.%h\fR. No \fBuversionmangle\fR rules is applicable for this case. .Sp When \fBpretty=describe\fR is used, the upstream version string is the output of the "\fBgit describe \-\-tags | sed s/\-/./g\fR" command instead. For example, if the commit is the \fB5\fR\-th after the last tag \fBv2.17.12\fR and its short hash is \&\fBged992511\fR, then the string is \fBv2.17.12.5.ged992511\fR . For this case, it is good idea to add \fBuversionmangle=s/^/0.0~/\fR or \fBuversionmangle=s/^v//\fR to make the upstream version string compatible with Debian. \fBuversionmangle=s/^v//\fR may work as well. Please note that in order for \fBpretty=describe\fR to function well, upstream need to avoid tagging with random alphabetic tags. .Sp The \fBpretty=describe\fR forces to set \fBgitmode=full\fR to make a full local clone of the repository automatically. .IP "\fBdate=\fR\fIrule\fR" 4 .IX Item "date=rule" Set the date string used by the \fBpretty\fR option to an arbitrary format as an optional \fBopts\fR argument when the \fImatching-pattern\fR is \fB\s-1HEAD\s0\fR or \&\fBheads/\fR\fIbranch\fR for \fBgit\fR mode. For the exact syntax, see the \&\fBstrftime\fR manpage. The default is \fBdate=%Y%m%d\fR. .IP "\fBgitexport=\fR\fImode\fR" 4 .IX Item "gitexport=mode" Set the git archive export operation \fImode\fR. The default is \&\fBgitexport=default\fR. Set this to \fBgitexport=all\fR to include all files in the \&.orig.tar archive, ignoring any \fIexport-ignore\fR git attributes defined by the upstream. .Sp This option is valid only in git mode. .IP "\fBgitmode=\fR\fImode\fR" 4 .IX Item "gitmode=mode" Set the git clone operation \fImode\fR. The default is \fBgitmode=shallow\fR. For some dumb git server, you may need to manually set \fBgitmode=full\fR to force full clone operation. .Sp If the current directory is a git repository and the searched repository is listed among the registered \*(L"remotes\*(R", then uscan will use it instead of cloning separately. .IP "\fBpgpmode=\fR\fImode\fR" 4 .IX Item "pgpmode=mode" Set the \s-1PGP/GPG\s0 signature verification \fImode\fR. .RS 4 .IP "\fBauto\fR" 4 .IX Item "auto" \&\fBuscan\fR checks possible URLs for the signature file and autogenerates a \&\fBpgpsigurlmangle\fR rule to use it. .IP "\fBdefault\fR" 4 .IX Item "default" Use \fBpgpsigurlmangle=\fR\fIrules\fR to generate the candidate upstream signature file \s-1URL\s0 string from the upstream tarball \s-1URL.\s0 (default) .Sp If the specified \fBpgpsigurlmangle\fR is missing, \fBuscan\fR checks possible URLs for the signature file and suggests adding a \fBpgpsigurlmangle\fR rule. .IP "\fBmangle\fR" 4 .IX Item "mangle" Use \fBpgpsigurlmangle=\fR\fIrules\fR to generate the candidate upstream signature file \s-1URL\s0 string from the upstream tarball \s-1URL.\s0 .IP "\fBnext\fR" 4 .IX Item "next" Verify this downloaded tarball file with the signature file specified in the next watch line. The next watch line must be \fBpgpmode=previous\fR. Otherwise, no verification occurs. .IP "\fBprevious\fR" 4 .IX Item "previous" Verify the downloaded tarball file specified in the previous watch line with this signature file. The previous watch line must be \fBpgpmode=next\fR. .IP "\fBself\fR" 4 .IX Item "self" Verify the downloaded file \fIfoo.ext\fR with its self signature and extract its content tarball file as \fIfoo\fR. .IP "\fBgittag\fR" 4 .IX Item "gittag" Verify tag signature if \fBmode=git\fR. .IP "\fBnone\fR" 4 .IX Item "none" No signature available. (No warning.) .RE .RS 4 .RE .IP "\fBsearchmode=\fR\fImode\fR" 4 .IX Item "searchmode=mode" Set the parsing search mode. .RS 4 .ie n .IP "\fBhtml\fR \fI(default)\fR: search pattern in ""href"" parameter of \s-1HTML\s0 tags" 4 .el .IP "\fBhtml\fR \fI(default)\fR: search pattern in ``href'' parameter of \s-1HTML\s0 tags" 4 .IX Item "html (default): search pattern in href parameter of HTML tags" .PD 0 .IP "\fBplain\fR: search pattern in the full page" 4 .IX Item "plain: search pattern in the full page" .PD This is useful if page content is not \s-1HTML\s0 but \s-1JSON.\s0 Example with npmjs.com: .Sp .Vb 4 \& version=4 \& opts="searchmode=plain" \e \& https://registry.npmjs.org/aes\-js \e \& https://registry.npmjs.org/aes\-js/\-/aes\-js\-(\ed[\ed\e.]*)@ARCHIVE_EXT@ .Ve .RE .RS 4 .RE .IP "\fBdecompress\fR" 4 .IX Item "decompress" Decompress compressed archive before the pgp/gpg signature verification. .IP "\fBbare\fR" 4 .IX Item "bare" Disable all site specific special case code such as \s-1URL\s0 redirector uses and page content alterations. (persistent) .IP "\fBuser\-agent=\fR\fIuser-agent-string\fR" 4 .IX Item "user-agent=user-agent-string" Set the user-agent string used to contact the \s-1HTTP\s0(S) server as \&\fIuser-agent-string\fR. (persistent) .Sp \&\fBuser-agent\fR option should be specified by itself in the watch line without \&\fI\s-1URL\s0\fR, to allow using semicolons and commas in it. .IP "\fBpasv\fR, \fBpassive\fR" 4 .IX Item "pasv, passive" Use \s-1PASV\s0 mode for the \s-1FTP\s0 connection. .Sp If \s-1PASV\s0 mode is required due to the client side network environment, set \&\fBuscan\fR to use \s-1PASV\s0 mode via \*(L"\s-1COMMANDLINE OPTIONS\*(R"\s0 or \*(L"\s-1DEVSCRIPT CONFIGURATION VARIABLES\*(R"\s0 instead. .IP "\fBactive\fR, \fBnopasv\fR" 4 .IX Item "active, nopasv" Don't use \s-1PASV\s0 mode for the \s-1FTP\s0 connection. .IP "\fBunzipopt=\fR\fIoptions\fR" 4 .IX Item "unzipopt=options" Add the extra options to use with the \fBunzip\fR command, such as \fB\-a\fR, \fB\-aa\fR, and \fB\-b\fR, when executed by \fBmk-origtargz\fR. .IP "\fBdversionmangle=\fR\fIrules\fR" 4 .IX Item "dversionmangle=rules" Normalize the last upstream version string found in \fIdebian/changelog\fR to compare it to the available upstream tarball version. Removal of the Debian specific suffix such as \fBs/@DEB_EXT@//\fR is usually done here. .Sp You can also use \fBdversionmangle=auto\fR, this is exactly the same than \&\fBdversionmangle=s/@DEB_EXT@//\fR .IP "\fBdirversionmangle=\fR\fIrules\fR" 4 .IX Item "dirversionmangle=rules" Normalize the directory path string matching the regex in a set of parentheses of \fBhttp://\fR\fI\s-1URL\s0\fR as the sortable version index string. This is used as the directory path sorting index only. .Sp Substitution such as \fBs/PRE/~pre/; s/RC/~rc/\fR may help. .IP "\fBpagemangle=\fR\fIrules\fR" 4 .IX Item "pagemangle=rules" Normalize the downloaded web page string. (Don't use this unless this is absolutely needed. Generally, \fBg\fR flag is required for these \fIrules\fR.) .Sp This is handy if you wish to access Amazon \s-1AWS\s0 or Subversion repositories in which is not used. .IP "\fBuversionmangle=\fR\fIrules\fR" 4 .IX Item "uversionmangle=rules" Normalize the candidate upstream version strings extracted from hrefs in the source of the web page. This is used as the version sorting index when selecting the latest upstream version. .Sp Substitution such as \fBs/PRE/~pre/; s/RC/~rc/\fR may help. .IP "\fBversionmangle=\fR\fIrules\fR" 4 .IX Item "versionmangle=rules" Syntactic shorthand for \fBuversionmangle=\fR\fIrules\fR\fB, dversionmangle=\fR\fIrules\fR .IP "\fBhrefdecode=percent\-encoding\fR" 4 .IX Item "hrefdecode=percent-encoding" Convert the selected upstream tarball href string from the percent-encoded hexadecimal string to the decoded normal \s-1URL\s0 string for obfuscated web sites. Only \fBpercent-encoding\fR is available and it is decoded with \&\fBs/%([A\-Fa\-f\ed]{2})/chr hex \f(CB$1\fB/eg\fR. .IP "\fBdownloadurlmangle=\fR\fIrules\fR" 4 .IX Item "downloadurlmangle=rules" Convert the selected upstream tarball href string into the accessible \s-1URL\s0 for obfuscated web sites. This is run after \fBhrefdecode\fR. .IP "\fBfilenamemangle=\fR\fIrules\fR" 4 .IX Item "filenamemangle=rules" Generate the upstream tarball filename from the selected href string if \&\fImatching-pattern\fR can extract the latest upstream version \fI\fR from the selected href string. Otherwise, generate the upstream tarball filename from its full \s-1URL\s0 string and set the missing \fI\fR from the generated upstream tarball filename. .Sp Without this option, the default upstream tarball filename is generated by taking the last component of the \s-1URL\s0 and removing everything after any '?' or \&'#'. .IP "\fBpgpsigurlmangle=\fR\fIrules\fR" 4 .IX Item "pgpsigurlmangle=rules" Generate the candidate upstream signature file \s-1URL\s0 string from the upstream tarball \s-1URL.\s0 .IP "\fBoversionmangle=\fR\fIrules\fR" 4 .IX Item "oversionmangle=rules" Generate the version string \fI\fR of the source tarball \fI_.orig.tar.gz\fR from \fI\fR. This should be used to add a suffix such as \fB+dfsg1\fR to a \s-1MUT\s0 package. .PP Here, the mangling rules apply the \fIrules\fR to the pertinent string. Multiple rules can be specified in a mangling rule string by making a concatenated string of each mangling \fIrule\fR separated by \fB;\fR (semicolon). .PP Each mangling \fIrule\fR cannot contain \fB;\fR (semicolon), \fB,\fR (comma), or \fB"\fR (double quote). .PP Each mangling \fIrule\fR behaves as if a Perl command "\fI\f(CI$string\fI\fR \fB=~\fR \fIrule\fR" is executed. There are some notable details. .IP "\(bu" 4 \&\fIrule\fR may only use the \fBs\fR, \fBtr\fR, and \fBy\fR operations. .RS 4 .IP "\fBs/\fR\fIregex\fR\fB/\fR\fIreplacement\fR\fB/\fR\fIoptions\fR" 4 .IX Item "s/regex/replacement/options" Regex pattern match and replace the target string. Only the \fBg\fR, \fBi\fR and \&\fBx\fR flags are available. Use the \fB\f(CB$1\fB\fR syntax for back references (No \&\fB\e1\fR syntax). Code execution is not allowed (i.e. no \fB(?{})\fR or \fB(??{})\fR constructs). .IP "\fBy/\fR\fIsource\fR\fB/\fR\fIdest\fR\fB/\fR or \fBtr/\fR\fIsource\fR\fB/\fR\fIdest\fR\fB/\fR" 4 .IX Item "y/source/dest/ or tr/source/dest/" Transliterate the characters in the target string. .RE .RS 4 .RE .SH "EXAMPLE OF EXECUTION" .IX Header "EXAMPLE OF EXECUTION" \&\fBuscan\fR reads the first entry in \fIdebian/changelog\fR to determine the source package name and the last upstream version. .PP For example, if the first entry of \fIdebian/changelog\fR is: .IP "\(bu" 4 \&\fIbar\fR (\fB3:2.03+dfsg1\-4\fR) unstable; urgency=low .PP then, the source package name is \fIbar\fR and the last Debian package version is \fB3:2.03+dfsg1\-4\fR. .PP The last upstream version is normalized to \fB2.03+dfsg1\fR by removing the epoch and the Debian revision. .PP If the \fBdversionmangle\fR rule exists, the last upstream version is further normalized by applying this rule to it. For example, if the last upstream version is \fB2.03+dfsg1\fR indicating the source tarball is repackaged, the suffix \fB+dfsg1\fR is removed by the string substitution \fBs/\e+dfsg\ed*$//\fR to make the (dversionmangled) last upstream version \fB2.03\fR and it is compared to the candidate upstream tarball versions such as \fB2.03\fR, \fB2.04\fR, ... found in the remote site. Thus, set this rule as: .IP "\(bu" 4 \&\fBopts=\*(L"dversionmangle=s/\e+dfsg\ed*$//\*(R"\fR .PP \&\fBuscan\fR downloads a web page from \fBhttp://\fR\fI\s-1URL\s0\fR specified in \&\fIdebian/watch\fR. .IP "\(bu" 4 If the directory name part of \fI\s-1URL\s0\fR has no parentheses, \fB(\fR and \fB)\fR, it is taken as verbatim. .IP "\(bu" 4 If the directory name part of \fI\s-1URL\s0\fR has parentheses, \fB(\fR and \fB)\fR, then \fBuscan\fR recursively searches all possible directories to find a page for the newest version. If the \fBdirversionmangle\fR rule exists, the generated sorting index is used to find the newest version. If a specific version is specified for the download, the matching version string has priority over the newest version. .PP For example, this \fBhttp://\fR\fI\s-1URL\s0\fR may be specified as: .IP "\(bu" 4 \&\fBhttp://www.example.org/@ANY_VERSION@/\fR .PP Please note the trailing \fB/\fR in the above to make \fB\f(CB@ANY_VERSION\fB@\fR as the directory. .PP If the \fBpagemangle\fR rule exists, the whole downloaded web page as a string is normalized by applying this rule to it. This is very powerful tool and needs to be used with caution. If other mangling rules can be used to address your objective, do not use this rule. .PP The downloaded web page is scanned for hrefs defined in the \fB\fR tag to locate the candidate upstream tarball hrefs. These candidate upstream tarball hrefs are matched by the Perl regex pattern \&\fImatching-pattern\fR such as \fB\s-1DL\-\s0(?:[\ed\e.]+?)/foo\-(.+)\e.tar\e.gz\fR to narrow down the candidates. This pattern match needs to be anchored at the beginning and the end. For example, candidate hrefs may be: .IP "\(bu" 4 \&\fB\s-1DL\-2\s0.02/foo\-2.02.tar.gz\fR .IP "\(bu" 4 \&\fB\s-1DL\-2\s0.03/foo\-2.03.tar.gz\fR .IP "\(bu" 4 \&\fB\s-1DL\-2\s0.04/foo\-2.04.tar.gz\fR .PP Here the matching string of \fB(.+)\fR in \fImatching-pattern\fR is considered as the candidate upstream version. If there are multiple matching strings of capturing patterns in \fImatching-pattern\fR, they are all concatenated with \fB.\fR (period) to form the candidate upstream version. Make sure to use the non-capturing regex such as \fB(?:[\ed\e.]+?)\fR instead for the variable text matching part unrelated to the version. .PP Then, the candidate upstream versions are: .IP "\(bu" 4 \&\fB2.02\fR .IP "\(bu" 4 \&\fB2.03\fR .IP "\(bu" 4 \&\fB2.04\fR .PP The downloaded tarball filename is basically set to the same as the filename in the remote \s-1URL\s0 of the selected href. .PP If the \fBuversionmangle\fR rule exists, the candidate upstream versions are normalized by applying this rule to them. (This rule may be useful if the upstream version scheme doesn't sort correctly to identify the newest version.) .PP The upstream tarball href corresponding to the newest (uversionmangled) candidate upstream version newer than the (dversionmangled) last upstream version is selected. .PP If multiple upstream tarball hrefs corresponding to a single version with different extensions exist, the highest compression one is chosen. (Priority: \&\fBtar.xz > tar.lzma > tar.bz2 > tar.gz\fR.) .PP If the selected upstream tarball href is the relative \s-1URL,\s0 it is converted to the absolute \s-1URL\s0 using the base \s-1URL\s0 of the web page. If the \fB\fR tag exists in the web page, the selected upstream tarball href is converted to the absolute \s-1URL\s0 using the specified base \s-1URL\s0 in the base tag, instead. .PP If the \fBdownloadurlmangle\fR rule exists, the selected upstream tarball href is normalized by applying this rule to it. (This is useful for some sites with the obfuscated download \s-1URL.\s0) .PP If the \fBfilenamemangle\fR rule exists, the downloaded tarball filename is generated by applying this rule to the selected href if \fImatching-pattern\fR can extract the latest upstream version \fI\fR from the selected href string. Otherwise, generate the upstream tarball filename from its full \s-1URL\s0 string and set the missing \fI\fR from the generated upstream tarball filename. .PP Without the \fBfilenamemangle\fR rule, the default upstream tarball filename is generated by taking the last component of the \s-1URL\s0 and removing everything after any '?' or '#'. .PP \&\fBuscan\fR downloads the selected upstream tarball to the parent \fB../\fR directory. For example, the downloaded file may be: .IP "\(bu" 4 \&\fI../foo\-2.04.tar.gz\fR .PP Let's call this downloaded version \fB2.04\fR in the above example generically as \&\fI\fR in the following. .PP If the \fBpgpsigurlmangle\fR rule exists, the upstream signature file \s-1URL\s0 is generated by applying this rule to the (downloadurlmangled) selected upstream tarball href and the signature file is tried to be downloaded from it. .PP If the \fBpgpsigurlmangle\fR rule doesn't exist, \fBuscan\fR warns user if the matching upstream signature file is available from the same \s-1URL\s0 with their filename being suffixed by the 5 common suffix \fBasc\fR, \fBgpg\fR, \fBpgp\fR, \fBsig\fR and \fBsign\fR. (You can avoid this warning by setting \fBpgpmode=none\fR.) .PP If the signature file is downloaded, the downloaded upstream tarball is checked for its authenticity against the downloaded signature file using the armored keyring \&\fIdebian/upstream/signing\-key.asc\fR (see \*(L"\s-1KEYRING FILE EXAMPLES\*(R"\s0). If its signature is not valid, or not made by one of the listed keys, \fBuscan\fR will report an error. .PP If the \fBoversionmangle\fR rule exists, the source tarball version \fIoversion\fR is generated from the downloaded upstream version \fIuversion\fR by applying this rule. This rule is useful to add suffix such as \fB+dfsg1\fR to the version of all the source packages of the \s-1MUT\s0 package for which the repacksuffix mechanism doesn't work. .PP \&\fBuscan\fR invokes \fBmk-origtargz\fR to create the source tarball properly named for the source package with \fB.orig.\fR (or \fB.orig\-.\fR for the secondary tarballs) in its filename. .IP "case A: packaging of the upstream tarball as is" 4 .IX Item "case A: packaging of the upstream tarball as is" \&\fBmk-origtargz\fR creates a symlink \fI../bar_.orig.tar.gz\fR linked to the downloaded local upstream tarball. Here, \fIbar\fR is the source package name found in \fIdebian/changelog\fR. The generated symlink may be: .RS 4 .IP "\(bu" 4 \&\fI../bar_2.04.orig.tar.gz\fR \-> \fIfoo\-2.04.tar.gz\fR (as is) .RE .RS 4 .Sp Usually, there is no need to set up \fBopts="dversionmangle=\fR \fI...\fR \fB"\fR for this case. .RE .IP "case B: packaging of the upstream tarball after removing non-DFSG files" 4 .IX Item "case B: packaging of the upstream tarball after removing non-DFSG files" \&\fBmk-origtargz\fR checks the filename glob of the \fBFiles-Excluded\fR stanza in the first section of \fIdebian/copyright\fR, removes matching files to create a repacked upstream tarball. Normally, the repacked upstream tarball is renamed with \fIsuffix\fR to \fI../bar_.orig.tar.gz\fR using the \fBrepacksuffix\fR option for the single upstream package. Here \fI\fR is updated to be \fI\fR. .Sp The removal of files is required if files are not DFSG-compliant. For such case, \fB+dfsg1\fR is used as \fIsuffix\fR. .Sp So the combined options are set as \&\fBopts=\*(L"dversionmangle=s/\e+dfsg\ed*$// ,repacksuffix=+dfsg1\*(R"\fR, instead. .Sp For example, the repacked upstream tarball may be: .RS 4 .IP "\(bu" 4 \&\fI../bar_2.04+dfsg1.orig.tar.gz\fR (repackaged) .RE .RS 4 .RE .PP \&\fBuscan\fR normally invokes "\fBuupdate\fR \fB\-\-find \-\-upstream\-version\fR \fIoversion\fR " for the version=4 watch file. .PP Please note that \fB\-\-find\fR option is used here since \fBmk-origtargz\fR has been invoked to make \fB*.orig.tar.gz\fR file already. \fBuscan\fR picks \fIbar\fR from \&\fIdebian/changelog\fR. .PP It creates the new upstream source tree under the \fI../bar\-\fR directory and Debianize it leveraging the last package contents. .SH "WATCH FILE EXAMPLES" .IX Header "WATCH FILE EXAMPLES" When writing the watch file, you should rely on the latest upstream source announcement web page. You should not try to second guess the upstream archive structure if possible. Here are the typical \fIdebian/watch\fR files. .PP Please note that executing \fBuscan\fR with \fB\-v\fR or \fB\-vv\fR reveals what exactly happens internally. .PP The existence and non-existence of a space the before tailing \fB\e\fR (back slash) are significant. .PP Some undocumented shorter configuration strings are used in the below \s-1EXAMPLES\s0 to help you with typing. These are intentional ones. \fBuscan\fR is written to accept such common sense abbreviations but don't push the limit. .SS "\s-1HTTP\s0 site (basic)" .IX Subsection "HTTP site (basic)" Here is an example for the basic single upstream tarball. .PP .Vb 3 \& version=4 \& http://example.com/~user/release/@PACKAGE@.html \e \& files/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP Or without using the substitution strings (not recommended): http://example.com/~user/release/foo.html \e files/foo\-([\ed\e.]+)\e.tar\e.gz .PP .Vb 1 \& version=4 .Ve .PP For the upstream source package \fBfoo\-2.0.tar.gz\fR, this watch file downloads and creates the Debian \fBorig.tar\fR file \fBfoo_2.0.orig.tar.gz\fR. .SS "\s-1HTTP\s0 site (pgpsigurlmangle)" .IX Subsection "HTTP site (pgpsigurlmangle)" Here is an example for the basic single upstream tarball with the matching signature file in the same file path. .PP .Vb 3 \& version=4 \& opts="pgpsigurlmangle=s%$%.asc%" http://example.com/release/@PACKAGE@.html \e \& files/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP For the upstream source package \fBfoo\-2.0.tar.gz\fR and the upstream signature file \fBfoo\-2.0.tar.gz.asc\fR, this watch file downloads these files, verifies the authenticity using the keyring \fIdebian/upstream/signing\-key.asc\fR and creates the Debian \fBorig.tar\fR file \fBfoo_2.0.orig.tar.gz\fR. .PP Here is another example for the basic single upstream tarball with the matching signature file on decompressed tarball in the same file path. .PP .Vb 4 \& version=4 \& opts="pgpsigurlmangle=s%@ARCHIVE_EXT@$%.asc%,decompress" \e \& http://example.com/release/@PACKAGE@.html \e \& files/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP For the upstream source package \fBfoo\-2.0.tar.gz\fR and the upstream signature file \fBfoo\-2.0.tar.asc\fR, this watch file downloads these files, verifies the authenticity using the keyring \fIdebian/upstream/signing\-key.asc\fR and creates the Debian \fBorig.tar\fR file \fBfoo_2.0.orig.tar.gz\fR. .SS "\s-1HTTP\s0 site (pgpmode=next/previous)" .IX Subsection "HTTP site (pgpmode=next/previous)" Here is an example for the basic single upstream tarball with the matching signature file in the unrelated file path. .PP .Vb 5 \& version=4 \& opts="pgpmode=next" http://example.com/release/@PACKAGE@.html \e \& files/(?:\ed+)/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@ debian \& opts="pgpmode=previous" http://example.com/release/@PACKAGE@.html \e \& files/(?:\ed+)/@PACKAGE@@ANY_VERSION@@SIGNATURE_EXT@ previous .Ve .PP \&\fB(?:\ed+)\fR part can be any random value. The tarball file can have \fB53\fR, while the signature file can have \fB33\fR. .PP \&\fB([\ed\e.]+)\fR part for the signature file has a strict requirement to match that for the upstream tarball specified in the previous line by having \fBprevious\fR as \fIversion\fR in the watch line. .SS "\s-1HTTP\s0 site (flexible)" .IX Subsection "HTTP site (flexible)" Here is an example for the maximum flexibility of upstream tarball and signature file extensions. .PP .Vb 6 \& version=4 \& opts="pgpmode=next" http://example.com/DL/ \e \& files/(?:\ed+)/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@ debian \& opts="pgpmode=previous" http://example.com/DL/ \e \& files/(?:\ed+)/@PACKAGE@@ANY_VERSION@@SIGNATURE_EXT@ \e \& previous .Ve .SS "\s-1HTTP\s0 site (basic \s-1MUT\s0)" .IX Subsection "HTTP site (basic MUT)" Here is an example for the basic multiple upstream tarballs. .PP .Vb 10 \& version=4 \& opts="pgpsigurlmangle=s%$%.sig%" \e \& http://example.com/release/foo.html \e \& files/foo\-@ANY_VERSION@@ARCHIVE_EXT@ debian \& opts="pgpsigurlmangle=s%$%.sig%, component=bar" \e \& http://example.com/release/foo.html \e \& files/foobar\-@ANY_VERSION@@ARCHIVE_EXT@ same \& opts="pgpsigurlmangle=s%$%.sig%, component=baz" \e \& http://example.com/release/foo.html \e \& files/foobaz\-@ANY_VERSION@@ARCHIVE_EXT@ same .Ve .PP For the main upstream source package \fBfoo\-2.0.tar.gz\fR and the secondary upstream source packages \fBfoobar\-2.0.tar.gz\fR and \fBfoobaz\-2.0.tar.gz\fR which install under \fIbar/\fR and \fIbaz/\fR, this watch file downloads and creates the Debian \fBorig.tar\fR file \fBfoo_2.0.orig.tar.gz\fR, \fBfoo_2.0.orig\-bar.tar.gz\fR and \&\fBfoo_2.0.orig\-baz.tar.gz\fR. Also, these upstream tarballs are verified by their signature files. .SS "\s-1HTTP\s0 site (recursive directory scanning)" .IX Subsection "HTTP site (recursive directory scanning)" Here is an example with the recursive directory scanning for the upstream tarball and its signature files released in a directory named after their version. .PP .Vb 4 \& version=4 \& opts="pgpsigurlmangle=s%$%.sig%, dirversionmangle=s/\-PRE/~pre/;s/\-RC/~rc/" \e \& http://tmrc.mit.edu/mirror/twisted/Twisted/@ANY_VERSION@/ \e \& Twisted\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP Here, the web site should be accessible at the following \s-1URL:\s0 .PP .Vb 1 \& http://tmrc.mit.edu/mirror/twisted/Twisted/ .Ve .PP Here, \fBdirversionmangle\fR option is used to normalize the sorting order of the directory names. .SS "\s-1HTTP\s0 site (alternative shorthand)" .IX Subsection "HTTP site (alternative shorthand)" For the bare \s-1HTTP\s0 site where you can directly see archive filenames, the normal watch file: .PP .Vb 4 \& version=4 \& opts="pgpsigurlmangle=s%$%.sig%" \e \& http://www.cpan.org/modules/by\-module/Text/ \e \& Text\-CSV_XS\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP can be rewritten in an alternative shorthand form only with a single string covering \s-1URL\s0 and filename: .PP .Vb 3 \& version=4 \& opts="pgpsigurlmangle=s%$%.sig%" \e \& http://www.cpan.org/modules/by\-module/Text/Text\-CSV_XS\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP In version=4, initial white spaces are dropped. Thus, this alternative shorthand form can also be written as: .PP .Vb 4 \& version=4 \& opts="pgpsigurlmangle=s%$%.sig%" \e \& http://www.cpan.org/modules/by\-module/Text/\e \& Text\-CSV_XS\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP Please note the subtle difference of a space before the tailing \fB\e\fR between the first and the last examples. .SS "\s-1HTTP\s0 site (funny version)" .IX Subsection "HTTP site (funny version)" For a site which has funny version numbers, the parenthesized groups will be joined with \fB.\fR (period) to make a sanitized version number. .PP .Vb 2 \& version=4 \& http://www.site.com/pub/foobar/foobar_v(\ed+)_(\ed+)@ARCHIVE_EXT@ .Ve .SS "\s-1HTTP\s0 site (\s-1DFSG\s0)" .IX Subsection "HTTP site (DFSG)" The upstream part of the Debian version number can be mangled to indicate the source package was repackaged to clean up non-DFSG files: .PP .Vb 3 \& version=4 \& opts="dversionmangle=s/\e+dfsg\ed*$//,repacksuffix=+dfsg1" \e \& http://some.site.org/some/path/foobar\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP See \*(L"\s-1COPYRIGHT FILE EXAMPLES\*(R"\s0. .SS "\s-1HTTP\s0 site (filenamemangle)" .IX Subsection "HTTP site (filenamemangle)" The upstream tarball filename is found by taking the last component of the \s-1URL\s0 and removing everything after any '?' or '#'. .PP If this does not fit to you, use \fBfilenamemangle\fR. For example, \fI\fR could be handled as: .PP .Vb 3 \& version=4 \& opts=filenamemangle=s/.*=(.*)/$1/ \e \& http://foo.bar.org/dl/\e?path=&dl=foo\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP \&\fI\fR could be handled as: .PP .Vb 3 \& version=4 \& opts=filenamemangle=s/.*=(.*)/foo\-$1\e.tar\e.gz/ \e \& http://foo.bar.org/dl/\e?path=&dl_version=@ANY_VERSION@ .Ve .PP If the href string has no version using matching\-pattern>, the version can be obtained from the full \s-1URL\s0 using \fBfilenamemangle\fR. .PP .Vb 3 \& version=4 \& opts=filenamemangle=s&.*/dl/(.*)/foo\e.tar\e.gz&foo\-$1\e.tar\e.gz& \e \& http://foo.bar.org/dl/@ANY_VERSION@/ foo.tar.gz .Ve .SS "\s-1HTTP\s0 site (downloadurlmangle)" .IX Subsection "HTTP site (downloadurlmangle)" The option \fBdownloadurlmangle\fR can be used to mangle the \s-1URL\s0 of the file to download. This can only be used with \fBhttp://\fR URLs. This may be necessary if the link given on the web page needs to be transformed in some way into one which will work automatically, for example: .PP .Vb 4 \& version=4 \& opts=downloadurlmangle=s/prdownload/download/ \e \& http://developer.berlios.de/project/showfiles.php?group_id=2051 \e \& http://prdownload.berlios.de/softdevice/vdr\-softdevice\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .SS "\s-1HTTP\s0 site (oversionmangle, \s-1MUT\s0)" .IX Subsection "HTTP site (oversionmangle, MUT)" The option \fBoversionmangle\fR can be used to mangle the version of the source tarball (\fB.orig.tar.gz\fR and \fB.orig\-bar.tar.gz\fR). For example, \fB+dfsg1\fR can be added to the upstream version as: .PP .Vb 7 \& version=4 \& opts=oversionmangle=s/(.*)/$1+dfsg1/ \e \& http://example.com/~user/release/foo.html \e \& files/foo\-@ANY_VERSION@@ARCHIVE_EXT@ debian \& opts="component=bar" \e \& http://example.com/~user/release/foo.html \e \& files/bar\-@ANY_VERSION@@ARCHIVE_EXT@ same .Ve .PP See \*(L"\s-1COPYRIGHT FILE EXAMPLES\*(R"\s0. .SS "\s-1HTTP\s0 site (pagemangle)" .IX Subsection "HTTP site (pagemangle)" The option \fBpagemangle\fR can be used to mangle the downloaded web page before applying other rules. The non-standard web page without proper \fB\fR entries can be converted. For example, if \fIfoo.html\fR uses \fB\fR, this can be converted to the standard page format with: .PP .Vb 4 \& version=4 \& opts=pagemangle="s/\fR \fI...\fR \fB\fR, this can be converted to the standard page format with: .PP .Vb 4 \& version=4 \& opts="pagemangle=s%([^<]*)%$1%g" \e \& http://example.com/release/foo.html \e \& (?:.*)/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@ .Ve .SS "\s-1FTP\s0 site (basic):" .IX Subsection "FTP site (basic):" .Vb 2 \& version=4 \& ftp://ftp.tex.ac.uk/tex\-archive/web/c_cpp/cweb/cweb\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .SS "\s-1FTP\s0 site (regex special characters):" .IX Subsection "FTP site (regex special characters):" .Vb 3 \& version=4 \& ftp://ftp.worldforge.org/pub/worldforge/libs/\e \& Atlas\-C++/transitional/Atlas\-C\e+\e+\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP Please note that this \s-1URL\s0 is connected to be \fI ... \fR\fBlibs/Atlas\-\*(C+/\fR\fI ... \fR \&. For \fB++\fR, the first one in the directory path is verbatim while the one in the filename is escaped by \fB\e\fR. .SS "\s-1FTP\s0 site (funny version)" .IX Subsection "FTP site (funny version)" This is another way of handling site with funny version numbers, this time using mangling. (Note that multiple groups will be concatenated before mangling is performed, and that mangling will only be performed on the basename version number, not any path version numbers.) .PP .Vb 4 \& version=4 \& opts="uversionmangle=s/^/0.0./" \e \& ftp://ftp.ibiblio.org/pub/Linux/ALPHA/wine/\e \& development/Wine\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .SS "sf.net" .IX Subsection "sf.net" For SourceForge based projects, qa.debian.org runs a redirector which allows a simpler form of \s-1URL.\s0 The format below will automatically be rewritten to use the redirector with the watch file: .PP .Vb 2 \& version=4 \& https://sf.net// \-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP For \fBaudacity\fR, set the watch file as: .PP .Vb 2 \& version=4 \& https://sf.net/audacity/ audacity\-minsrc\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP Please note, you can still use normal functionalities of \fBuscan\fR to set up a watch file for this site without using the redirector. .PP .Vb 6 \& version=4 \& opts="uversionmangle=s/\-pre/~pre/, \e \& filenamemangle=s%(?:.*)audacity\-minsrc\-(.+)\e.tar\e.xz/download%\e \& audacity\-$1.tar.xz%" \e \& http://sourceforge.net/projects/audacity/files/audacity/@ANY_VERSION@/ \e \& (?:.*)audacity\-minsrc\-@ANY_VERSION@@ARCHIVE_EXT@/download .Ve .PP Here, \fB%\fR is used as the separator instead of the standard \fB/\fR. .SS "github.com" .IX Subsection "github.com" For GitHub based projects, you can use the tags or releases page. The archive \&\s-1URL\s0 uses only the version as the filename. You can rename the downloaded upstream tarball from into the standard \fI\-.tar.gz\fR using \&\fBfilenamemangle\fR: .PP .Vb 4 \& version=4 \& opts="filenamemangle=s%(?:.*?)?v?(\ed[\ed.]*@ARCHIVE_EXT@)%@PACKAGE@\-$1%" \e \& https://github.com///tags \e \& (?:.*?/)?v?@ANY_VERSION@@ARCHIVE_EXT@ .Ve .SS "PyPI" .IX Subsection "PyPI" For PyPI based projects, pypi.debian.net runs a redirector which allows a simpler form of \s-1URL.\s0 The format below will automatically be rewritten to use the redirector with the watch file: .PP .Vb 3 \& version=4 \& https://pypi.python.org/packages/source/// \e \& \-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP For \fBcfn-sphere\fR, set the watch file as: .PP .Vb 3 \& version=4 \& https://pypi.python.org/packages/source/c/cfn\-sphere/ \e \& cfn\-sphere\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .PP Please note, you can still use normal functionalities of \fBuscan\fR to set up a watch file for this site without using the redirector. .PP .Vb 5 \& version=4 \& opts="pgpmode=none" \e \& https://pypi.python.org/pypi/cfn\-sphere/ \e \& https://pypi.python.org/packages/.*/.*/.*/\e \& cfn\-sphere\-@ANY_VERSION@@ARCHIVE_EXT@#.* .Ve .SS "code.google.com" .IX Subsection "code.google.com" Sites which used to be hosted on the Google Code service should have migrated to elsewhere (github?). Please look for the newer upstream site if available. .SS "npmjs.org (node modules)" .IX Subsection "npmjs.org (node modules)" npmjs.org modules are published in \s-1JSON\s0 files. Here is a way to read them: .PP .Vb 4 \& version=4 \& opts="searchmode=plain" \e \& https://registry.npmjs.org/aes\-js \e \& https://registry.npmjs.org/aes\-js/\-/aes\-js\-@ANY_VERSION@@ARCHIVE_EXT@ .Ve .SS "grouped package" .IX Subsection "grouped package" Some node modules are split into multiple little upstream package. Here is a way to group them: .PP .Vb 10 \& version=4 \& opts="searchmode=plain,pgpmode=none" \e \& https://registry.npmjs.org/mongodb \e \& https://registry.npmjs.org/mongodb/\-/mongodb\-@ANY_VERSION@@ARCHIVE_EXT@ group \& opts="searchmode=plain,pgpmode=none,component=bson" \e \& https://registry.npmjs.org/bson \e \& https://registry.npmjs.org/bson/\-/bson\-@ANY_VERSION@@ARCHIVE_EXT@ group \& opts="searchmode=plain,pgpmode=none,component=mongodb\-core" \e \& https://registry.npmjs.org/mongodb\-core \e \& https://registry.npmjs.org/mongodb\-core/\-/mongodb\-core\-@ANY_VERSION@@ARCHIVE_EXT@ group \& opts="searchmode=plain,pgpmode=none,component=requireoptional" \e \& https://registry.npmjs.org/require_optional \e \& https://registry.npmjs.org/require_optional/\-/require_optional\-@ANY_VERSION@@ARCHIVE_EXT@ group .Ve .PP Package version is then the concatenation of upstream versions separated by \&\*(L"+~\*(R". .PP To avoid having a too long version, the \*(L"checksum\*(R" method can be used. In this case, the main source has to be declared as \*(L"group\*(R": .PP .Vb 10 \& version=4 \& opts="searchmode=plain,pgpmode=none" \e \& https://registry.npmjs.org/mongodb \e \& https://registry.npmjs.org/mongodb/\-/mongodb\-@ANY_VERSION@@ARCHIVE_EXT@ group \& opts="searchmode=plain,pgpmode=none,component=bson" \e \& https://registry.npmjs.org/bson \e \& https://registry.npmjs.org/bson/\-/bson\-@ANY_VERSION@@ARCHIVE_EXT@ checksum \& opts="searchmode=plain,pgpmode=none,component=mongodb\-core" \e \& https://registry.npmjs.org/mongodb\-core \e \& https://registry.npmjs.org/mongodb\-core/\-/mongodb\-core\-@ANY_VERSION@@ARCHIVE_EXT@ checksum \& opts="searchmode=plain,pgpmode=none,component=requireoptional" \e \& https://registry.npmjs.org/require_optional \e \& https://registry.npmjs.org/require_optional/\-/require_optional\-@ANY_VERSION@@ARCHIVE_EXT@ checksum .Ve .PP The \*(L"checksum\*(R" is made up of the separate sum of each number composing the component versions. Following is an example with 3 components whose versions are \*(L"1.2.4\*(R", \*(L"2.0.1\*(R" and \*(L"10.0\*(R", with the main tarball having version \*(L"2.0.6\*(R": .PP .Vb 9 \& Main: 2.0.6 \& Comp1: 1 . 2 . 4 \& Comp2: 2 . 0 . 1 \& Comp3: 10 . 0 \& ================================ \& Result : 1+2+10 . 2+0+0 . 4+1 \& Checksum: 13 . 2 . 5 \& ================================ \& Final Version: 2.0.6+~cs13.2.5 .Ve .PP uscan will also display the original version string before being encoded into the checksum, which can for example be used in a debian/changelog entry to easily follow the changes: .PP .Vb 1 \& 2.0.6+~1.2.4+~2.0.1+~10.0 .Ve .PP \&\fBNote\fR: This feature currently accepts only versions composed of digits and full stops (`.`). .SS "direct access to the git repository (tags)" .IX Subsection "direct access to the git repository (tags)" If the upstream only publishes its code via the git repository and its code has no web interface to obtain the release tarball, you can use \fBuscan\fR with the tags of the git repository to track and package the new upstream release. .PP .Vb 4 \& version=4 \& opts="mode=git, gitmode=full, pgpmode=none" \e \& http://git.ao2.it/tweeper.git \e \& refs/tags/v@ANY_VERSION@ .Ve .PP Please note "\fBgit ls-remote\fR" is used to obtain references for tags. .PP If a tag \fBv20.5\fR is the newest tag, the above example downloads \&\fIspkg\fR\fB\-20.5.tar.xz\fR after making a full clone of the git repository which is needed for dumb git server. .PP If tags are signed, set \fBpgpmode=gittag\fR to verify them. .SS "direct access to the git repository (\s-1HEAD\s0)" .IX Subsection "direct access to the git repository (HEAD)" If the upstream only publishes its code via the git repository and its code has no web interface nor the tags to obtain the released tarball, you can use \&\fBuscan\fR with the \s-1HEAD\s0 of the git repository to track and package the new upstream release with an automatically generated version string. .PP .Vb 4 \& version=4 \& opts="mode=git, pgpmode=none" \e \& https://github.com/Debian/dh\-make\-golang \e \& HEAD .Ve .PP Please note that a local shallow copy of the git repository is made with "\fBgit clone \-\-bare \-\-depth=1\fR ..." normally in the target directory. \fBuscan\fR generates the new upstream version with "\fBgit log \-\-date=format:%Y%m%d \&\-\-pretty=0.0~git%cd.%h\fR" on this local copy of repository as its default behavior. .PP The generation of the upstream version string may the adjusted to your taste by adding \fBpretty\fR and \fBdate\fR options to the \fBopts\fR arguments. .SS "direct access to the Subversion repository (tags)" .IX Subsection "direct access to the Subversion repository (tags)" If the upstream only publishes its code via the Subversion repository and its code has no web interface to obtain the release tarball, you can use \fBuscan\fR with the tags of the Subversion repository to track and package the new upstream release. .PP .Vb 4 \& version=4 \& opts="mode=svn, pgpmode=none" \e \& svn://svn.code.sf.net/p/jmol/code/tags/ \e \& @ANY_VERSION@\e/ .Ve .SS "direct access to the Subversion repository (\s-1HEAD\s0)" .IX Subsection "direct access to the Subversion repository (HEAD)" If the upstream only publishes its code via the Subversion repository and its code has no web interface to obtain the release tarball, you can use \fBuscan\fR to get the most recent source of a subtree in the repository with an automatically generated version string. .PP .Vb 4 \& version=4 \& opts="mode=svn, pgpmode=none" \e \& svn://svn.code.sf.net/p/jmol/code/trunk/ \e \& HEAD .Ve .PP By default, \fBuscan\fR generates the new upstream version by appending the revision number to \*(L"0.0~svn\*(R". This can later be changed using \fBuversionmangle\fR. .SH "COPYRIGHT FILE EXAMPLES" .IX Header "COPYRIGHT FILE EXAMPLES" Here is an example for the \fIdebian/copyright\fR file which initiates automatic repackaging of the upstream tarball into \fI_.orig.tar.gz\fR (In \fIdebian/copyright\fR, the \fBFiles-Excluded\fR and \&\fBFiles\-Excluded\-\fR\fIcomponent\fR stanzas are a part of the first paragraph and there is a blank line before the following paragraphs which contain \fBFiles\fR and other stanzas.): .PP .Vb 6 \& Format: http://www.debian.org/doc/packaging\-manuals/copyright\-format/1.0/ \& Files\-Excluded: exclude\-this \& exclude\-dir \& */exclude\-dir \& .* \& */js/jquery.js \& \& Files: * \& Copyright: ... \& ... .Ve .PP Here is another example for the \fIdebian/copyright\fR file which initiates automatic repackaging of the multiple upstream tarballs into \&\fI_.orig.tar.gz\fR and \&\fI_.orig\-bar.tar.gz\fR: .PP .Vb 11 \& Format: http://www.debian.org/doc/packaging\-manuals/copyright\-format/1.0/ \& Files\-Excluded: exclude\-this \& exclude\-dir \& */exclude\-dir \& .* \& */js/jquery.js \& Files\-Excluded\-bar: exclude\-this \& exclude\-dir \& */exclude\-dir \& .* \& */js/jquery.js \& \& Files: * \& Copyright: ... \& ... .Ve .PP See \fBmk\-origtargz\fR\|(1). .SH "KEYRING FILE EXAMPLES" .IX Header "KEYRING FILE EXAMPLES" Let's assume that the upstream "\fBuscan test key (no secret) \fR" signs its package with a secret OpenPGP key and publishes the corresponding public OpenPGP key. This public OpenPGP key can be identified in 3 ways using the hexadecimal form. .IP "\(bu" 4 The fingerprint as the 20 byte data calculated from the public OpenPGP key. E. g., '\fB\s-1CF21 8F0E 7EAB F584 B7E2 0402 C77E 2D68 7254 3FAF\s0\fR' .IP "\(bu" 4 The long keyid as the last 8 byte data of the fingerprint. E. g., \&'\fBC77E2D6872543FAF\fR' .IP "\(bu" 4 The short keyid is the last 4 byte data of the fingerprint. E. g., \&'\fB72543FAF\fR' .PP Considering the existence of the collision attack on the short keyid, the use of the long keyid is recommended for receiving keys from the public key servers. You must verify the downloaded OpenPGP key using its full fingerprint value which you know is the trusted one. .PP The armored keyring file \fIdebian/upstream/signing\-key.asc\fR can be created by using the \fBgpg\fR (or \fBgpg2\fR) command as follows. .PP .Vb 12 \& $ gpg \-\-recv\-keys "C77E2D6872543FAF" \& ... \& $ gpg \-\-finger "C77E2D6872543FAF" \& pub 4096R/72543FAF 2015\-09\-02 \& Key fingerprint = CF21 8F0E 7EAB F584 B7E2 0402 C77E 2D68 7254 3FAF \& uid uscan test key (no secret) \& sub 4096R/52C6ED39 2015\-09\-02 \& $ cd path/to/\- \& $ mkdir \-p debian/upstream \& $ gpg \-\-export \-\-export\-options export\-minimal \-\-armor \e \& \*(AqCF21 8F0E 7EAB F584 B7E2 0402 C77E 2D68 7254 3FAF\*(Aq \e \& >debian/upstream/signing\-key.asc .Ve .PP The binary keyring files, \fIdebian/upstream/signing\-key.pgp\fR and \&\fIdebian/upstream\-signing\-key.pgp\fR, are still supported but deprecated. .PP If a group of developers sign the package, you need to list fingerprints of all of them in the argument for \fBgpg \-\-export ...\fR to make the keyring to contain all OpenPGP keys of them. .PP Sometimes you may wonder who made a signature file. You can get the public keyid used to create the detached signature file \fIfoo\-2.0.tar.gz.asc\fR by running \fBgpg\fR as: .PP .Vb 12 \& $ gpg \-vv foo\-2.0.tar.gz.asc \& gpg: armor: BEGIN PGP SIGNATURE \& gpg: armor header: Version: GnuPG v1 \& :signature packet: algo 1, keyid C77E2D6872543FAF \& version 4, created 1445177469, md5len 0, sigclass 0x00 \& digest algo 2, begin of digest 7a c7 \& hashed subpkt 2 len 4 (sig created 2015\-10\-18) \& subpkt 16 len 8 (issuer key ID C77E2D6872543FAF) \& data: [4091 bits] \& gpg: assuming signed data in \`foo\-2.0.tar.gz\*(Aq \& gpg: Signature made Sun 18 Oct 2015 11:11:09 PM JST using RSA key ID 72543FAF \& ... .Ve .SH "COMMANDLINE OPTIONS" .IX Header "COMMANDLINE OPTIONS" For the basic usage, \fBuscan\fR does not require to set these options. .IP "\fB\-\-conffile\fR, \fB\-\-conf\-file\fR" 4 .IX Item "--conffile, --conf-file" Add or replace default configuration files (\f(CW\*(C`/etc/devscripts.conf\*(C'\fR and \&\f(CW\*(C`~/.devscripts\*(C'\fR). This can only be used as the first option given on the command-line. .RS 4 .IP "replace:" 4 .IX Item "replace:" .Vb 1 \& uscan \-\-conf\-file test.conf \-\-verbose .Ve .IP "add:" 4 .IX Item "add:" .Vb 1 \& uscan \-\-conf\-file +test.conf \-\-verbose .Ve .Sp If one \fB\-\-conf\-file\fR has no \f(CW\*(C`+\*(C'\fR, default configuration files are ignored. .RE .RS 4 .RE .IP "\fB\-\-no\-conf\fR, \fB\-\-noconf\fR" 4 .IX Item "--no-conf, --noconf" Don't read any configuration files. This can only be used as the first option given on the command-line. .IP "\fB\-\-no\-verbose\fR" 4 .IX Item "--no-verbose" Don't report verbose information. (default) .IP "\fB\-\-verbose\fR, \fB\-v\fR" 4 .IX Item "--verbose, -v" Report verbose information. .IP "\fB\-\-debug\fR, \fB\-vv\fR" 4 .IX Item "--debug, -vv" Report verbose information and some internal state values. .IP "\fB\-\-extra\-debug\fR, \fB\-vvv\fR" 4 .IX Item "--extra-debug, -vvv" Report verbose information including the downloaded web pages as processed to \s-1STDERR\s0 for debugging. .IP "\fB\-\-dehs\fR" 4 .IX Item "--dehs" Send \s-1DEHS\s0 style output (XML-type) to \s-1STDOUT,\s0 while send all other uscan output to \s-1STDERR.\s0 .IP "\fB\-\-no\-dehs\fR" 4 .IX Item "--no-dehs" Use only traditional uscan output format. (default) .IP "\fB\-\-download\fR, \fB\-d\fR" 4 .IX Item "--download, -d" Download the new upstream release. (default) .IP "\fB\-\-force\-download\fR, \fB\-dd\fR" 4 .IX Item "--force-download, -dd" Download the new upstream release even if up-to-date. (may not overwrite the local file) .IP "\fB\-\-overwrite\-download\fR, \fB\-ddd\fR" 4 .IX Item "--overwrite-download, -ddd" Download the new upstream release even if up-to-date. (may overwrite the local file) .IP "\fB\-\-no\-download\fR, \fB\-\-nodownload\fR" 4 .IX Item "--no-download, --nodownload" Don't download and report information. .Sp Previously downloaded tarballs may be used. .Sp Change default to \fB\-\-skip\-signature\fR. .IP "\fB\-\-signature\fR" 4 .IX Item "--signature" Download signature. (default) .IP "\fB\-\-no\-signature\fR" 4 .IX Item "--no-signature" Don't download signature but verify if already downloaded. .IP "\fB\-\-skip\-signature\fR" 4 .IX Item "--skip-signature" Don't bother download signature nor verifying signature. .IP "\fB\-\-safe\fR, \fB\-\-report\fR" 4 .IX Item "--safe, --report" Avoid running unsafe scripts by skipping both the repacking of the downloaded package and the updating of the new source tree. .Sp Change default to \fB\-\-no\-download\fR and \fB\-\-skip\-signature\fR. .Sp When the objective of running \fBuscan\fR is to gather the upstream package status under the security conscious environment, please make sure to use this option. .IP "\fB\-\-report\-status\fR" 4 .IX Item "--report-status" This is equivalent of setting "\fB\-\-verbose \-\-safe\fR". .IP "\fB\-\-download\-version\fR \fIversion\fR" 4 .IX Item "--download-version version" Specify the \fIversion\fR which the upstream release must match in order to be considered, rather than using the release with the highest version. (a best effort feature) .IP "\fB\-\-download\-debversion\fR \fIversion\fR" 4 .IX Item "--download-debversion version" Specify the Debian package version to download the corresponding upstream release version. The \fBdversionmangle\fR and \fBuversionmangle\fR rules are considered. (a best effort feature) .IP "\fB\-\-download\-current\-version\fR" 4 .IX Item "--download-current-version" Download the currently packaged version. (a best effort feature) .IP "\fB\-\-check\-dirname\-level\fR \fIN\fR" 4 .IX Item "--check-dirname-level N" See the below section \*(L"Directory name checking\*(R" for an explanation of this option. .IP "\fB\-\-check\-dirname\-regex\fR \fIregex\fR" 4 .IX Item "--check-dirname-regex regex" See the below section \*(L"Directory name checking\*(R" for an explanation of this option. .IP "\fB\-\-destdir\fR \fIpath\fR Normally, \fBuscan\fR changes its internal current directory to the package's source directory where the \fIdebian/\fR is located. Then the destination directory for the downloaded tarball and other files is set to the parent directory \fI../\fR from this internal current directory." 4 .IX Item "--destdir path Normally, uscan changes its internal current directory to the package's source directory where the debian/ is located. Then the destination directory for the downloaded tarball and other files is set to the parent directory ../ from this internal current directory." This default destination directory can be overridden by setting \fB\-\-destdir\fR option to a particular \fIpath\fR. If this \fIpath\fR is a relative path, the destination directory is determined in relative to the internal current directory of \fBuscan\fR execution. If this \fIpath\fR is a absolute path, the destination directory is set to \fIpath\fR irrespective of the internal current directory of \fBuscan\fR execution. .Sp The above is true not only for the simple \fBuscan\fR run in the single source tree but also for the advanced scanning \fBuscan\fR run with subdirectories holding multiple source trees. .Sp One exception is when \fB\-\-watchfile\fR and \fB\-\-package\fR are used together. For this case, the internal current directory of \fBuscan\fR execution and the default destination directory are set to the current directory \fI.\fR where \fBuscan\fR is started. The default destination directory can be overridden by setting \&\fB\-\-destdir\fR option as well. .IP "\fB\-\-package\fR \fIpackage\fR" 4 .IX Item "--package package" Specify the name of the package to check for rather than examining \&\fIdebian/changelog\fR; this requires the \fB\-\-upstream\-version\fR (unless a version is specified in the \fIwatch\fR file) and \fB\-\-watchfile\fR options as well. Furthermore, no directory scanning will be done and nothing will be downloaded. This option automatically sets \fB\-\-no\-download\fR and \fB\-\-skip\-signature\fR; and probably most useful in conjunction with the \s-1DEHS\s0 system (and \fB\-\-dehs\fR). .IP "\fB\-\-upstream\-version\fR \fIupstream-version\fR" 4 .IX Item "--upstream-version upstream-version" Specify the current upstream version rather than examine \fIdebian/watch\fR or \&\fIdebian/changelog\fR to determine it. This is ignored if a directory scan is being performed and more than one \fIdebian/watch\fR file is found. .IP "\fB\-\-watchfile\fR \fIwatchfile\fR" 4 .IX Item "--watchfile watchfile" Specify the \fIwatchfile\fR rather than perform a directory scan to determine it. If this option is used without \fB\-\-package\fR, then \fBuscan\fR must be called from within the Debian package source tree (so that \fIdebian/changelog\fR can be found simply by stepping up through the tree). .Sp One exception is when \fB\-\-watchfile\fR and \fB\-\-package\fR are used together. \&\fBuscan\fR can be called from anywhare and the internal current directory of \&\fBuscan\fR execution and the default destination directory are set to the current directory \fI.\fR where \fBuscan\fR is started. .Sp See more in the \fB\-\-destdir\fR explanation. .IP "\fB\-\-bare\fR" 4 .IX Item "--bare" Disable all site specific special case codes to perform \s-1URL\s0 redirections and page content alterations. .IP "\fB\-\-http\-header\fR" 4 .IX Item "--http-header" Add specified header in \s-1HTTP\s0 requests for matching url. This option can be used more than one time, values must be in the form "baseUrl@Name=value. Example: .Sp .Vb 1 \& uscan \-\-http\-header https://example.org@My\-Token=qwertyuiop .Ve .Sp Security: .RS 4 .IP "The given \fIbaseUrl\fR must exactly match the base url before '/'. Examples:" 4 .IX Item "The given baseUrl must exactly match the base url before '/'. Examples:" .Vb 7 \& | \-\-http\-header value | Good for | Never used | \& +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+\-\-\-\-\-\-\-\-\-\-\-\-+ \& | https://example.org.com@Hdr=Value | https://example.org.com/... | | \& | https://example.org.com/@Hdr=Value | | X | \& | https://e.com:1879@Hdr=Value | https://e.com:1879/... | | \& | https://e.com:1879/dir@Hdr=Value | https://e.com:1879/dir/... | | \& | https://e.com:1879/dir/@Hdr=Value | | X | .Ve .IP "It is strongly recommended to not use this feature to pass a secret token over unciphered connection \fI(http://)\fR" 4 .IX Item "It is strongly recommended to not use this feature to pass a secret token over unciphered connection (http://)" .PD 0 .ie n .IP "You can use ""USCAN_HTTP_HEADER"" variable (in ""~/.devscripts"") to hide secret token from scripts" 4 .el .IP "You can use \f(CWUSCAN_HTTP_HEADER\fR variable (in \f(CW~/.devscripts\fR) to hide secret token from scripts" 4 .IX Item "You can use USCAN_HTTP_HEADER variable (in ~/.devscripts) to hide secret token from scripts" .RE .RS 4 .RE .IP "\fB\-\-no\-exclusion\fR" 4 .IX Item "--no-exclusion" .PD Don't automatically exclude files mentioned in \fIdebian/copyright\fR field \fBFiles-Excluded\fR. .IP "\fB\-\-pasv\fR" 4 .IX Item "--pasv" Force \s-1PASV\s0 mode for \s-1FTP\s0 connections. .IP "\fB\-\-no\-pasv\fR" 4 .IX Item "--no-pasv" Don't use \s-1PASV\s0 mode for \s-1FTP\s0 connections. .IP "\fB\-\-no\-symlink\fR" 4 .IX Item "--no-symlink" Don't rename nor repack upstream tarball. .IP "\fB\-\-timeout\fR \fIN\fR" 4 .IX Item "--timeout N" Set timeout to \fIN\fR seconds (default 20 seconds). .IP "\fB\-\-user\-agent\fR, \fB\-\-useragent\fR" 4 .IX Item "--user-agent, --useragent" Override the default user agent header. .IP "\fB\-\-help\fR" 4 .IX Item "--help" Give brief usage information. .IP "\fB\-\-version\fR" 4 .IX Item "--version" Display version information. .PP \&\fBuscan\fR also accepts following options and passes them to \fBmk-origtargz\fR: .IP "\fB\-\-symlink\fR" 4 .IX Item "--symlink" Make \fBorig.tar.gz\fR (with the appropriate extension) symlink to the downloaded files. (This is the default behavior.) .IP "\fB\-\-copy\fR" 4 .IX Item "--copy" Instead of symlinking as described above, copy the downloaded files. .IP "\fB\-\-rename\fR" 4 .IX Item "--rename" Instead of symlinking as described above, rename the downloaded files. .IP "\fB\-\-repack\fR" 4 .IX Item "--repack" After having downloaded an lzma tar, xz tar, bzip tar, gz tar, zip, jar, xpi, zstd archive, repack it to the specified compression (see \fB\-\-compression\fR). .Sp The unzip package must be installed in order to repack zip and jar archives, the mozilla-devscripts package must be installed to repack xpi archives, the xz-utils package must be installed to repack lzma or xz tar archives, and zstd must be installed to repack zstd archives. .IP "\fB\-\-compression\fR [ \fBgzip\fR | \fBbzip2\fR | \fBlzma\fR | \fBxz\fR ]" 4 .IX Item "--compression [ gzip | bzip2 | lzma | xz ]" In the case where the upstream sources are repacked (either because \fB\-\-repack\fR option is given or \fIdebian/copyright\fR contains the field \fBFiles-Excluded\fR), it is possible to control the compression method via the parameter. The default is \fBgzip\fR for normal tarballs, and \fBxz\fR for tarballs generated directly from the git repository. .IP "\fB\-\-copyright\-file\fR \fIcopyright-file\fR" 4 .IX Item "--copyright-file copyright-file" Exclude files mentioned in \fBFiles-Excluded\fR in the given \fIcopyright-file\fR. This is useful when running \fBuscan\fR not within a source package directory. .SH "DEVSCRIPT CONFIGURATION VARIABLES" .IX Header "DEVSCRIPT CONFIGURATION VARIABLES" For the basic usage, \fBuscan\fR does not require to set these configuration variables. .PP The two configuration files \fI/etc/devscripts.conf\fR and \fI~/.devscripts\fR are sourced by a shell in that order to set configuration variables. These may be overridden by command line options. Environment variable settings are ignored for this purpose. If the first command line option given is \&\fB\-\-noconf\fR, then these files will not be read. The currently recognized variables are: .IP "\fB\s-1USCAN_DOWNLOAD\s0\fR" 4 .IX Item "USCAN_DOWNLOAD" Download or report only: .RS 4 .IP "\fBno\fR: equivalent to \fB\-\-no\-download\fR, newer upstream files will not be downloaded." 4 .IX Item "no: equivalent to --no-download, newer upstream files will not be downloaded." .PD 0 .IP "\fByes\fR: equivalent to \fB\-\-download\fR, newer upstream files will be downloaded. This is the default behavior." 4 .IX Item "yes: equivalent to --download, newer upstream files will be downloaded. This is the default behavior." .PD See also \fB\-\-force\-download\fR and \fB\-\-overwrite\-download\fR. .RE .RS 4 .RE .IP "\fB\s-1USCAN_SAFE\s0\fR" 4 .IX Item "USCAN_SAFE" If this is set to \fByes\fR, then \fBuscan\fR avoids running unsafe scripts by skipping both the repacking of the downloaded package and the updating of the new source tree; this is equivalent to the \fB\-\-safe\fR options; this also sets the default to \fB\-\-no\-download\fR and \fB\-\-skip\-signature\fR. .IP "\fB\s-1USCAN_PASV\s0\fR" 4 .IX Item "USCAN_PASV" If this is set to yes or no, this will force \s-1FTP\s0 connections to use \s-1PASV\s0 mode or not to, respectively. If this is set to default, then \fB\fBNet::FTP\fB\|(3)\fR makes the choice (primarily based on the \fB\s-1FTP_PASSIVE\s0\fR environment variable). .IP "\fB\s-1USCAN_TIMEOUT\s0\fR" 4 .IX Item "USCAN_TIMEOUT" If set to a number \fIN\fR, then set the timeout to \fIN\fR seconds. This is equivalent to the \fB\-\-timeout\fR option. .IP "\fB\s-1USCAN_SYMLINK\s0\fR" 4 .IX Item "USCAN_SYMLINK" If this is set to no, then a \fIpkg\fR_\fIversion\fR\fB.orig.tar.{gz|bz2|lzma|xz}\fR symlink will not be made (equivalent to the \fB\-\-no\-symlink\fR option). If it is set to \fByes\fR or \fBsymlink\fR, then the symlinks will be made. If it is set to \&\fBrename\fR, then the files are renamed (equivalent to the \fB\-\-rename\fR option). .IP "\fB\s-1USCAN_DEHS_OUTPUT\s0\fR" 4 .IX Item "USCAN_DEHS_OUTPUT" If this is set to \fByes\fR, then DEHS-style output will be used. This is equivalent to the \fB\-\-dehs\fR option. .IP "\fB\s-1USCAN_VERBOSE\s0\fR" 4 .IX Item "USCAN_VERBOSE" If this is set to \fByes\fR, then verbose output will be given. This is equivalent to the \fB\-\-verbose\fR option. .IP "\fB\s-1USCAN_USER_AGENT\s0\fR" 4 .IX Item "USCAN_USER_AGENT" If set, the specified user agent string will be used in place of the default. This is equivalent to the \fB\-\-user\-agent\fR option. .IP "\fB\s-1USCAN_DESTDIR\s0\fR" 4 .IX Item "USCAN_DESTDIR" If set, the downloaded files will be placed in this directory. This is equivalent to the \fB\-\-destdir\fR option. .IP "\fB\s-1USCAN_REPACK\s0\fR" 4 .IX Item "USCAN_REPACK" If this is set to yes, then after having downloaded a bzip tar, lzma tar, xz tar, zip or zstd archive, uscan will repack it to the specified compression (see \fB\-\-compression\fR). This is equivalent to the \fB\-\-repack\fR option. .IP "\fB\s-1USCAN_EXCLUSION\s0\fR" 4 .IX Item "USCAN_EXCLUSION" If this is set to no, files mentioned in the field \fBFiles-Excluded\fR of \&\fIdebian/copyright\fR will be ignored and no exclusion of files will be tried. This is equivalent to the \fB\-\-no\-exclusion\fR option. .IP "\fB\s-1USCAN_HTTP_HEADER\s0\fR" 4 .IX Item "USCAN_HTTP_HEADER" If set, the specified http header will be used if \s-1URL\s0 match. This is equivalent to \fB\-\-http\-header\fR option. .SH "EXIT STATUS" .IX Header "EXIT STATUS" The exit status gives some indication of whether a newer version was found or not; one is advised to read the output to determine exactly what happened and whether there were any warnings to be noted. .IP "\fB0\fR" 4 .IX Item "0" Either \fB\-\-help\fR or \fB\-\-version\fR was used, or for some \fIwatch\fR file which was examined, a newer upstream version was located. .IP "\fB1\fR" 4 .IX Item "1" No newer upstream versions were located for any of the \fIwatch\fR files examined. .SH "ADVANCED FEATURES" .IX Header "ADVANCED FEATURES" \&\fBuscan\fR has many other enhanced features which are skipped in the above section for the simplicity. Let's check their highlights. .PP \&\fBuscan\fR can be executed with \fIpath\fR as its argument to change the starting directory of search from the current directory to \fIpath\fR . .PP If you are not sure what exactly is happening behind the scene, please enable the \fB\-\-verbose\fR option. If this is not enough, enable the \fB\-\-debug\fR option too see all the internal activities. .PP See \*(L"\s-1COMMANDLINE OPTIONS\*(R"\s0 and \*(L"\s-1DEVSCRIPT CONFIGURATION VARIABLES\*(R"\s0 for other variations. .SS "Custom script" .IX Subsection "Custom script" The optional \fIscript\fR parameter in \fIdebian/watch\fR means to execute \fIscript\fR with options after processing this line if specified. .PP See \*(L"\s-1HISTORY AND UPGRADING\*(R"\s0 for how \fBuscan\fR invokes the custom \fIscript\fR. .PP For compatibility with other tools such as \fBgit-buildpackage\fR, it may not be wise to create custom scripts with random behavior. In general, \fBuupdate\fR is the best choice for the non-native package and custom scripts, if created, should behave as if \fBuupdate\fR. For possible use case, see as an example. .SS "\s-1URL\s0 diversion" .IX Subsection "URL diversion" Some popular web sites changed their web page structure causing maintenance problems to the watch file. There are some redirection services created to ease maintenance of the watch file. Currently, \fBuscan\fR makes automatic diversion of \s-1URL\s0 requests to the following URLs to cope with this situation. .IP "\(bu" 4 .IP "\(bu" 4 .SS "Directory name checking" .IX Subsection "Directory name checking" Similarly to several other scripts in the \fBdevscripts\fR package, \fBuscan\fR explores the requested directory trees looking for \fIdebian/changelog\fR and \&\fIdebian/watch\fR files. As a safeguard against stray files causing potential problems, and in order to promote efficiency, it will examine the name of the parent directory once it finds the \fIdebian/changelog\fR file, and check that the directory name corresponds to the package name. It will only attempt to download newer versions of the package and then perform any requested action if the directory name matches the package name. Precisely how it does this is controlled by two configuration file variables \&\fB\s-1DEVSCRIPTS_CHECK_DIRNAME_LEVEL\s0\fR and \fB\s-1DEVSCRIPTS_CHECK_DIRNAME_REGEX\s0\fR, and their corresponding command-line options \fB\-\-check\-dirname\-level\fR and \&\fB\-\-check\-dirname\-regex\fR. .PP \&\fB\s-1DEVSCRIPTS_CHECK_DIRNAME_LEVEL\s0\fR can take the following values: .IP "\fB0\fR" 4 .IX Item "0" Never check the directory name. .IP "\fB1\fR" 4 .IX Item "1" Only check the directory name if we have had to change directory in our search for \fIdebian/changelog\fR, that is, the directory containing \&\fIdebian/changelog\fR is not the directory from which \fBuscan\fR was invoked. This is the default behavior. .IP "\fB2\fR" 4 .IX Item "2" Always check the directory name. .PP The directory name is checked by testing whether the current directory name (as determined by \fBpwd\fR\|(1)) matches the regex given by the configuration file option \fB\s-1DEVSCRIPTS_CHECK_DIRNAME_REGEX\s0\fR or by the command line option \&\fB\-\-check\-dirname\-regex\fR \fIregex\fR. Here regex is a Perl regex (see \&\fBperlre\fR\|(3perl)), which will be anchored at the beginning and the end. If regex contains a \fB/\fR, then it must match the full directory path. If not, then it must match the full directory name. If regex contains the string \fIpackage\fR, this will be replaced by the source package name, as determined from the \&\fIdebian/changelog\fR. The default value for the regex is: \fIpackage\fR\fB(\-.+)?\fR, thus matching directory names such as \fIpackage\fR and \fIpackage\fR\-\fIversion\fR. .SH "HISTORY AND UPGRADING" .IX Header "HISTORY AND UPGRADING" This section briefly describes the backwards-incompatible \fIwatch\fR file features which have been added in each \fIwatch\fR file version, and the first version of the \&\fBdevscripts\fR package which understood them. .IP "Pre-version 2" 4 .IX Item "Pre-version 2" The \fIwatch\fR file syntax was significantly different in those days. Don't use it. If you are upgrading from a pre-version 2 \fIwatch\fR file, you are advised to read this manpage and to start from scratch. .IP "Version 2" 4 .IX Item "Version 2" \&\fBdevscripts\fR version 2.6.90: The first incarnation of the current style of \&\fIwatch\fR files. This version is also deprecated and will be rejected after the Debian 11 release. .IP "Version 3" 4 .IX Item "Version 3" \&\fBdevscripts\fR version 2.8.12: Introduced the following: correct handling of regex special characters in the path part, directory/path pattern matching, version number in several parts, version number mangling. Later versions have also introduced \s-1URL\s0 mangling. .Sp If you are upgrading from version 2, the key incompatibility is if you have multiple groups in the pattern part; whereas only the first one would be used in version 2, they will all be used in version 3. To avoid this behavior, change the non-version-number groups to be \fB(?:\fR \fI ...\fR \fB)\fR instead of a plain \fB(\fR \fI ... \fR \fB)\fR group. .RS 4 .IP "\(bu" 4 \&\fBuscan\fR invokes the custom \fIscript\fR as "\fIscript\fR \fB\-\-upstream\-version\fR \&\fIversion\fR \fB../\fR\fIspkg\fR\fB_\fR\fIversion\fR\fB.orig.tar.gz\fR". .IP "\(bu" 4 \&\fBuscan\fR invokes the standard \fBuupdate\fR as "\fBuupdate\fR \fB\-\-no\-symlink \&\-\-upstream\-version\fR \fIversion\fR \fB../\fR\fIspkg\fR\fB_\fR\fIversion\fR\fB.orig.tar.gz\fR". .RE .RS 4 .RE .IP "Version 4" 4 .IX Item "Version 4" \&\fBdevscripts\fR version 2.15.10: The first incarnation of \fIwatch\fR files supporting multiple upstream tarballs. .Sp The syntax of the watch file is relaxed to allow more spaces for readability. .Sp If you have a custom script in place of \fBuupdate\fR, you may also encounter problems updating from Version 3. .RS 4 .IP "\(bu" 4 \&\fBuscan\fR invokes the custom \fIscript\fR as "\fIscript\fR \fB\-\-upstream\-version\fR \&\fIversion\fR". .IP "\(bu" 4 \&\fBuscan\fR invokes the standard \fBuupdate\fR as "\fBuupdate\fR \fB\-\-find\fR \&\fB\-\-upstream\-version\fR \fIversion\fR". .RE .RS 4 .Sp Restriction for \fB\-\-dehs\fR is lifted by redirecting other output to \s-1STDERR\s0 when it is activated. .RE .SH "SEE ALSO" .IX Header "SEE ALSO" \&\fBdpkg\fR\|(1), \fBmk\-origtargz\fR\|(1), \fBperlre\fR\|(1), \fBuupdate\fR\|(1), \fBdevscripts.conf\fR\|(5) .SH "AUTHOR" .IX Header "AUTHOR" The original version of uscan was written by Christoph Lameter . Significant improvements, changes and bugfixes were made by Julian Gilbey . \s-1HTTP\s0 support was added by Piotr Roszatycki . The program was rewritten in Perl by Julian Gilbey. Xavier Guimard converted it in object-oriented Perl using Moo.