From: spwhitton@spwhitton.name 
  
 Hello, 
  
 On Sat 11 Oct 2025 at 01:09pm +01, Andrew Bower wrote: 
  
 > Package: git-debpush 
 > Version: 13.16 
 > Severity: normal 
 > 
 > Dear Maintainer, 
 > 
 > I was testing out local commands to help hypothetical collaborators who are 
 > confused by the absence of the pristine-tar anti-pattern in my package. 
 > 
 > Running 'git deborig' I obtained a different tarball from what 'git 
 debpush' 
 > had previously caused to be generated by the tag2upload builder. 
 > 
 > It would be nice to make sure that an out-of-the-box local invocation 
 produced 
 > bit-exact tarballs to what tag2upload produces to reduce the barriers to 
 > understand and accept this type of workflow. 
 > 
 > (Aside: I also wonder if the use of xz rather than gzip is sufficiently 
 > beneficial in terms of space saving to justify the greater difficulty (as I 
 > understand it - unless I have been taken in by FUD!) to guarantee 
 > reproducibility.) 
  
 tag2upload doesn't invoke git-deborig in any special way, so this 
 difference can only be due to version skew between tar and/or xz-utils 
 on the tag2upload Builder and your machine. 
  
 I don't think there is much we can do other than preserve information 
 about the versions of the software involved, which we already do in the 
 .buildinfo file included with the upload. 
  
 -- 
 Sean Whitton 
  
 --=-=-Content-Type: application/pgp-signature; name="signature.asc" 
  
 -----BEGIN PGP SIGNATURE----- 
  
 iQJNBAEBCgA3FiEEm5FwB64DDjbk/CSLaVt65L8GYkAFAmjqa3UZHHNwd2hpdHRv 
 bkBzcHdoaXR0b24ubmFtZQAKCRBpW3rkvwZiQAcQD/9vkLWSfx+mjL2x8ctC9FdI 
 bgjNzgc7Fll0EarzeQhmCKwZ5BL1rGaYZb+zFBrDbjb0lbcKcO3KVxqBD8o+PcL5 
 zmKtHNIwBirhdEkRMS6Pcow/fexNY+QzNGrV3g73D/xOI6uSA88vc34PFnIeXKip 
 F2uZ7uBJSrVtLxAa5CWmdDUiPs9RgHJ9CkgBDgqhB4GwlqjPhMjCOvo7n2dCCRh0 
 L80LbgcRuEdi9UVk30I9+A1t4BtRZSLDsm25Nw6u8nMXgk0t8RAG2DXUS/njI6Hw 
 oyx6owfq2hiPeit37xGvAl+yVdjrX4GqeJUekxvqeOdo0IIEBrVHUoeDMZmcOGKp 
 Pf23ZTSUCbQln2pTROV6MR7lOtEy9LxzyupQo8rXf8u0y6YONrA/RddfvLbk7bTF 
 0xFWJcPZaMXxJfaCsG36YmWtd1K/cN+akMhuHgk1sawsdZzjOe3ESPuUoHLOQqBN 
 BoOBS+Fa7lLe5tspbyo7Ur13WjhPUSyZiMC4z0YtjvrmjWD2YoTTnZCIgM5eMjLC 
 MWulzXZBiBL8MRGEkNWB+2V8ktYwokUkLwWFuc9UUVpATQU/SGrngqqKJHFHX0mf 
 +WW7l7kQ/tRks2QEEEs+yx9D9A4JT3Cfl5u1AtmvOpLHJqiy6JEaTqvRt1Bb+Taa 
 oQAN78GNCd/0q8ncdSHK/w==Nv1A 
 -----END PGP SIGNATURE----- 
  
 --- SoupGate-Win32 v1.05 
  * Origin: you cannot sedate... all the things you hate (1:229/2)