Debian patches for debian branch

debian/changelog

@@ -1,4 +1,4 @@
-python-tuf (0.17.0-1) UNRELEASED; urgency=low
+tuf (0.17.0-1) UNRELEASED; urgency=low
 
   [Lukas Puehringer]
   * Initial packaging effort on 0.11.2.dev3-1

debian/control

@@ -1,19 +1,24 @@
-Source: python-tuf
+Source: tuf
 Maintainer: Debian Python Team <[email protected]>
 Uploaders: Philippe Coval <[email protected]>
-Section: devel
+Section: python
 Priority: optional
 Build-Depends: dh-python,
-               debhelper-compat (= 12),
+               debhelper-compat (= 13),
                python3-all,
-               python3-setuptools,
-               python3-six,
+               python3-coverage,
+               python3-cryptography,
+               python3-dateutil,
+               python3-nacl,
                python3-requests,
-               python3-securesystemslib
-Standards-Version: 4.5.0
-Vcs-Browser: https://github.com/theupdateframework/tuf
-Vcs-Git: https://github.com/theupdateframework/tuf.git
+               python3-securesystemslib,
+               tox
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
+Vcs-Browser: https://salsa.debian.org/python-team/packages/tuf/-/tree/debian/master
+Vcs-Git: https://salsa.debian.org/python-team/packages/tuf.git
 Homepage: https://theupdateframework.com
+Testsuite: autopkgtest-pkg-python
 
 Package: python3-tuf
 Architecture: all
@@ -25,3 +30,11 @@ Description: plug-and-play library for securing a software updater
  or signing keys.
  .
  tuf is developed at the Secure Systems Lab of NYU.
+
+Package: python3-tuf-doc
+Architecture: all
+Section: doc
+Depends: ${misc:Depends}
+Description: Documentation and specification for TUF library and more
+ TUF's documentation from source package, it contains specification,
+ tutorial and more detailed documents, more can be found online.

debian/copyright

@@ -1,17 +1,26 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Contact: https://github.com/theupdateframework,
+ tuf developers <[email protected]>
 Upstream-Name: tuf
 Source: https://github.com/theupdateframework
 
 Files: *
 Copyright: 2018 New York University
+License: Apache-2.0
+
+Files: debian/*
+Copyright: 2018 New York University
+        2021 Philippe Coval <[email protected]>
+License: Apache-2.0
+
 License: Apache-2.0
  Copyright 2018 New York University
  .
  Licensed under the Apache License, Version 2.0 (the "License");
  you may not use this file except in compliance with the License.
  You may obtain a copy of the License at
  .
-    http://www.apache.org/licenses/LICENSE-2.0
+    https://www.apache.org/licenses/LICENSE-2.0
  .
  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,

debian/gbp.conf

@@ -0,0 +1,3 @@
+[DEFAULT]
+debian-branch=debian/master
+upstream-tag = v%(version)s

debian/patches/0001-test-Ignore-pinned-deps-use-systems-ones.patch

@@ -0,0 +1,31 @@
+From: Philippe Coval <[email protected]>
+Date: Sat, 27 Mar 2021 11:20:24 +0000
+Subject: test: Ignore pinned deps use systems ones
+
+Relate-to: https://github.com/theupdateframework/tuf/pull/1325
+Forwarded: not-needed
+Signed-off-by: Philippe Coval <[email protected]>
+---
+ tox.ini | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tox.ini b/tox.ini
+index acf8044..c98517e 100644
+--- a/tox.ini
++++ b/tox.ini
+@@ -19,7 +19,6 @@ commands =
+     coverage report -m --fail-under 97
+
+ deps =
+-    -r{toxinidir}/requirements-test.txt
+     # Install TUF in editable mode, instead of tox default virtual environment
+     # installation (see `skipsdist`), to get relative paths in coverage reports
+     --editable {toxinidir}
+@@ -33,7 +32,6 @@ install_command = pip install --use-deprecated=legacy-resolver --pre {opts} {pac
+ [testenv:with-sslib-master]
+ deps =
+     git+http://github.com/secure-systems-lab/securesystemslib.git@master#egg=securesystemslib
+-    -r{toxinidir}/requirements-test.txt
+     --editable {toxinidir}
+
+ commands =

debian/patches/0002-test-Use-python3-coverage-from-sitepackages.patch

@@ -0,0 +1,55 @@
+From: Philippe Coval <[email protected]>
+Date: Sat, 27 Mar 2021 11:20:24 +0000
+Subject: test: Use python3-coverage from sitepackages
+
+Suppress coverage fail threshold
+
+Debian python team prefer to not break on coverage issues,
+so they are just skip for now.
+
+I suspect this is caused by unaligned deps,
+threshold may be reintroduced once sitepackages get aligned with:
+requirements-pinned.txt
+
+For example this one is currently outdated:
+
+https://tracker.debian.org/pkg/python-certifi
+
+Relate-to: https://github.com/theupdateframework/tuf/issues/263
+Forwarded: not-needed
+Signed-off-by: Philippe Coval <[email protected]>
+---
+ tox.ini | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/tox.ini b/tox.ini
+index c98517e..6327265 100644
+--- a/tox.ini
++++ b/tox.ini
+@@ -13,10 +13,13 @@ skipsdist = true
+ # would make use of other testing tools such as coverage/coveralls easier.
+ changedir = tests
+
++allowlist_externals = python3-coverage
++
++
+ commands =
+     python --version
+-    coverage run aggregate_tests.py
+-    coverage report -m --fail-under 97
++    python -m coverage run aggregate_tests.py
++    python -m coverage report -m
+
+ deps =
+     # Install TUF in editable mode, instead of tox default virtual environment
+@@ -35,8 +38,8 @@ deps =
+     --editable {toxinidir}
+
+ commands =
+-    coverage run aggregate_tests.py
+-    coverage report -m
++    python -m coverage run aggregate_tests.py
++    python -m coverage report -m
+
+ [testenv:lint]
+ commands =

debian/patches/0003-ci-Remove-workaround-for-pip-resolver-issue.patch

@@ -0,0 +1,28 @@
+From: Jussi Kukkonen <[email protected]>
+Date: Mon, 22 Feb 2021 11:07:45 +0200
+Subject: ci: Remove workaround for pip resolver issue
+
+Workaround was added for pip issue 9215 and does not _seem_ to appear
+anymore with pip 21.0.1.
+
+Signed-off-by: Jussi Kukkonen <[email protected]>
+Origin: upstream#2de2758393883ae0f96c30b43cc6b2b2107bf921
+---
+ tox.ini | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/tox.ini b/tox.ini
+index 6327265..17dfdef 100644
+--- a/tox.ini
++++ b/tox.ini
+@@ -26,9 +26,7 @@ deps =
+     # installation (see `skipsdist`), to get relative paths in coverage reports
+     --editable {toxinidir}
+
+-# FIXME: use legacy resolver because https://github.com/pypa/pip/issues/9215
+-install_command = pip install --use-deprecated=legacy-resolver --pre {opts} {packages}
+-
++install_command = pip install --pre {opts} {packages}
+
+ # Develop test env to run tests against securesystemslib's master branch
+ # Must to be invoked explicitly with, e.g. `tox -e with-sslib-master`

debian/patches/0004-debian-patches-Use-python3-explicitly.patch

@@ -0,0 +1,41 @@
+From: Philippe Coval <[email protected]>
+Date: Mon, 5 Apr 2021 16:47:55 +0200
+Subject: debian/patches: Use python3 explicitly
+
+python-is-python3. It's meant for end-users only
+
+Thanks-to: @tumbleweed
+Forwarded: Not-Needed
+Signed-off-by: Philippe Coval <[email protected]>
+---
+ tox.ini | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tox.ini b/tox.ini
+index 17dfdef..ab7196c 100644
+--- a/tox.ini
++++ b/tox.ini
+@@ -17,9 +17,9 @@ allowlist_externals = python3-coverage
+
+
+ commands =
+-    python --version
+-    python -m coverage run aggregate_tests.py
+-    python -m coverage report -m
++    python3 --version
++    python3 -m coverage run aggregate_tests.py
++    python3 -m coverage report -m
+
+ deps =
+     # Install TUF in editable mode, instead of tox default virtual environment
+@@ -36,8 +36,8 @@ deps =
+     --editable {toxinidir}
+
+ commands =
+-    python -m coverage run aggregate_tests.py
+-    python -m coverage report -m
++    python3 -m coverage run aggregate_tests.py
++    python3 -m coverage report -m
+
+ [testenv:lint]
+ commands =

debian/patches/0005-tests-Use-current-python-interpreter-for-sub-tests.patch

@@ -0,0 +1,35 @@
+From: Philippe Coval <[email protected]>
+Date: Wed, 7 Apr 2021 13:02:34 +0200
+Subject: tests: Use current python interpreter for sub tests
+
+Can be useful to run tests using distro runtimes,
+(like python3 on Debian).
+
+Relate-to: https://github.com/theupdateframework/tuf/issues/263
+Forwarded: https://github.com/theupdateframework/tuf/pull/1337
+Signed-off-by: Philippe Coval <[email protected]>
+---
+ tests/utils.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tests/utils.py b/tests/utils.py
+index 8e8c07b..df43a23 100644
+--- a/tests/utils.py
++++ b/tests/utils.py
+@@ -25,6 +25,7 @@ from contextlib import contextmanager
+ import errno
+ import logging
+ import socket
++import sys
+ import time
+ import subprocess
+ import threading
+@@ -200,7 +201,7 @@ class TestServerProcess():
+     """Starts the process running the server."""
+
+     # The "-u" option forces stdin, stdout and stderr to be unbuffered.
+-    command = ['python', '-u', self.server] + extra_cmd_args
++    command = [sys.executable, '-u', self.server] + extra_cmd_args
+
+     # Reusing one subprocess in multiple tests, but split up the logs for each.
+     self.__server_process = subprocess.Popen(command,

debian/patches/series

@@ -0,0 +1,5 @@
+0001-test-Ignore-pinned-deps-use-systems-ones.patch
+0002-test-Use-python3-coverage-from-sitepackages.patch
+0003-ci-Remove-workaround-for-pip-resolver-issue.patch
+0004-debian-patches-Use-python3-explicitly.patch
+0005-tests-Use-current-python-interpreter-for-sub-tests.patch

debian/python3-tuf-doc.doc-base

@@ -0,0 +1,13 @@
+Document: python3-tuf-doc
+Title: TUF The update framework documentation
+Abstract: Specification, tutorial and papers about using and implementing TUF.
+Section: Video
+
+Format: Text
+Index: /usr/share/doc/python3-tuf/docs/GETTING_STARTED.rst
+Files: /usr/share/doc/python3-tuf/docs/*.md
+ /usr/share/doc/python3-tuf/docs/*.rst
+ /usr/share/doc/python3-tuf/docs/*.txt
+
+Format: PDF
+Files: /usr/share/doc/python3-tuf/docs/papers/*.pdf.gz

debian/python3-tuf-doc.docs

@@ -0,0 +1,2 @@
+README.md
+docs

debian/rules

@@ -1,7 +1,32 @@
 #!/usr/bin/make -f
 
-#export DH_VERBOSE = 1
+export DH_VERBOSE = 1
 export PYBUILD_NAME = tuf
 
+PYVERS ?= $(shell py3versions -rv)
+TOX_OPTIONS += --sitepackages
+
 %:
 	dh $@ --with python3  --buildsystem=pybuild
+
+override_dh_install:
+	dh_install
+	rm -rfv debian/*/usr/bin/*.py
+
+override_dh_auto_test:
+ifeq (,$(findstring nocheck,$(DEB_BUILD_OPTIONS)))
+	tox -l
+	set -e ; for py in $(PYVERS); do \
+	  env=$$(echo "py$${py}" | tr -d '.') ; \
+	  tox ${TOX_OPTIONS} -e "$${env}" -- -s ; \
+	done
+endif
+
+override_dh_auto_clean:
+	rm -rf .tox
+	dh_auto_clean
+
+override_dh_installdocs:
+	dh_installdocs
+	ln -fs tuf-spec.md \
+debian/python3-tuf-doc/usr/share/doc/python3-tuf/docs/tuf-spec.txt

debian/salsa-ci.yml

@@ -0,0 +1,3 @@
+include:
+ - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+ - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml

debian/tests/control

@@ -0,0 +1,8 @@
+Tests: testsuite
+Depends:
+ @,
+ python3-pytest,
+ python3-cryptography,
+ python3-dateutil,
+ python3-nacl,
+Restrictions: allow-stderr

debian/tests/testsuite

@@ -0,0 +1,17 @@
+#!/bin/sh
+set -efu
+set -x
+
+pys="$(py3versions -s 2> /dev/null)"
+
+cp -rva tests "$AUTOPKGTEST_TMP/"
+cd "$AUTOPKGTEST_TMP/tests"
+
+# Resolve "from tests import utils"
+PYTHONPATH=".."
+export PYTHONPATH
+
+for py in $pys; do
+    echo "=== $py ==="
+    $py aggregate_tests.py
+done

debian/upstream/metadata

@@ -0,0 +1,5 @@
+Bug-Database: https://github.com/theupdateframework/tuf/issues/
+Bug-Submit: https://github.com/theupdateframework/tuf/issues/new
+Documentation: https://theupdateframework.io/
+Repository-Browse: https://github.com/theupdateframework/tuf/
+Repository: https://github.com/theupdateframework/tuf.git

debian/watch

@@ -1,3 +1,5 @@
-version=3
-opts=uversionmangle=s/(rc|a|b|c)/~$1/,pgpsigurlmangle=s/$/.asc/ \
-https://pypi.debian.net/tuf/tuf-(.+)\.(?:zip|tgz|tbz|txz|(?:tar\.(?:gz|bz2|xz)))
+version=4
+opts="mode=git,pgpmode=gittag" \
+https://github.com/theupdateframework/@[email protected] \
+refs/tags/v([\d\.]+)
+