Automatic upstream version upgrades - uscan

[Vincinator]

What would you like to be added

Debian's uscan can be used to watch upstream sources.

• Adapt Garden Linux package build pipelines to perform the scan and create commits accordingly
• Define rules for selected packages in main branch (major bump allowed)
• Define rules for selected back ported packages (only patch level bump allowed in most cases)
• Document uscan integration
• Write guide on how to define the rules file
• Check if we can watch two repositories with uscan for a single package
  • debian/ folder from salsa for debianization + upstream source from upstream git

Why is this needed

Short summary: automate steps required for upgrading package versions, to improve speed of releasing Garden Linux versions.

Case 1: Option to automatically upgrade backports of garden linux packages

Background

For package backports we have not yet a streamlined way to get the source for a package. Current methods used are:

• good ✅: pin debian folder from debian salsa + pin upstream sources from upstream repo
• good ✅: pin branch on debian salsa (in case salsa includes copy of a upstream source)
• bad 🙅🏻: use apt source repo from a snapshot + add git format-patch patches to bump to latest upstream (not okay)

However, all current methods require a Garden Linux maintainer to manually check the pinned versions an upgrade if needed. This is time consuming and can be automated. The tool uscan can assist here.

Improvement with uscan

Watch upstream git repository for new versions available, and automatically bump version and automatically try to run a build.

Maintainer has now the following advantages:

• No need to tediously bump versions for all backport branches
• Build already triggered, maintainer can already start analysing in case version bump broke the build

Case 2: Option to get latest an greatest upstream versions

Background

For latest and greatest Garden Linux packages we mostly use sources mirrored from debian testing [1].
Special cases exist, where we explicitly want a more recent upstream version (e.g. frr or linux). In those special cases we setup the prepare_source script to pull upstream sources from somewhere else by specifying a hard-coded branch and version.

Improvement with uscan

Specify upstream git repository to watch for upstream version upgrades, so we can either automatically upgrade or be notified about upstream changes.

Maintainer has now the following advantages:

• same as for case 1
• we have the option to adopt faster to new major package upgrades from upstream without waiting for debian

Notes
[1]: apt sources are mirrored daily, and are available via a cloudfront gated S3 bucket. This apt source is configured in the ghcr.io/gardenlinux/repo-debian-snapshot container which we create daily and is used for reproducibility. We have all sources of all packages and dependencies that we need available.

[Vincinator]

uscan requires the debian folder. Maybe we can write something tailored for our use case.

1. uscan reads package name from debian/changelog => don't need that
2. uscan invokes mk-origtargz to create origtar of sources => maybe interesting for better reproducibility in case upstream or debian tags are re-written
3. uscan rules are defined in debian/rules => need to make sure that we override rules from debian salsa with our rules