XPost: linux.debian.devel, linux.debian.policy   
   From: josch@debian.org   
      
   Quoting Simon Josefsson (2026-02-11 21:50:42)   
   > > > NEW uploads should be permitted to be source-only.   
   > >    
   > > This would be a significant improvement.  I think binaries needed for   
   > > review by the DFSG team should be autobuilt.   
   >    
   > DFSG Team: do you look at maintainer-uploaded binaries?  Why?   
   >    
   > They could be autobuilt, but I wonder what the real purpose of that is.   
   > Only to prove that the source code actually builds against build   
   > dependencies in Debian?  That would indeed be a good test.  But   
   > binaries aren't needed for that, just a build log from a trusted builder.   
      
   Idea: Compare the binary artifact hashes of the .buildinfo (which got uploaded   
   along with the source-only upload) against what got autobuilt to ensure that   
   what was intended to be put into the archive by the developer is indeed   
   bit-by-bit identical to what the autobuilders produce from the uploaded source.   
   :)   
   --==============ˆ95872340174847585=MIME-Version: 1.0   
   Content-Transfer-Encoding: 7bit   
   Content-Description: signature   
   Content-Type: application/pgp-signature; name="signature.asc"; c   
   arset="us-ascii"   
      
   -----BEGIN PGP SIGNATURE-----   
      
   iQIzBAABCgAdFiEElFhU6KL81LF4wVq58sulx4+9g+EFAmmNwPMACgkQ8sulx4+9   
   g+GbiA/8CGw8n/vExkQbcgguPRAobhwvF81+1K0Vs6fg+u6hrmFPVDJ0E6oIjSSi   
   jIk2KOIdTRHGk9EheH/UlLhS/O9RcsQz5aEyP+F+8WDud75ebZNc7mGHMxbRtU7P   
   ohRb62Gl+85CK12YIU32wgj03R4k1ethxcgDihSTkZG6M7qZ7g7/KWGdZqTw/v/4   
   tes2ToRuTgsR3FX9lsdOjGRuVM8aXJZBFU/RaECk+UsCzvZt3Q9og+tCnHThjg46   
   3XCD1KSlfc4btV1jQ375YBK3L/xWrLQzyuvrfjfO6FDFpiOSdsJKMcj//UtxEiG6   
   SgiBzL5/2iK7bKxgqNYulzSkrojrIlyXxwt9c7tooQDNywwhkIjCTjD2uqTiMsqi   
   q/77pvbHz2Rmfm07MohdhOVyimd893yM8Bkm2s1WmQBKjoGW/rGy3jSAfLAfGYvj   
   Ek8ShNhoiZWCDACuChgwM0ij8T7jZFmq00yId2LcgqKn7uvw159gk0M5H1XTALAD   
   uuhp18broPW3tf+4pmw5X1yEdnefr7rZRpOL8ATda/c6DoGWyn8IT7zCmyc94269   
   4ZiOifQUR7BTXqedkPZcYK+s9d8Hb3yz9EWS1POlsiXPJGfy3esp7+071MLaau3L   
   lFwnJwZjW1Ee0iYAiYNNjF3If2kwkrZG8A+/D0Gqb5YhyaptVyE=   
   =V83K   
   -----END PGP SIGNATURE-----   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)