DEBIAN-WATCH-4(5)

📦

version 2.26.11ubuntu1 · 3 versions

2.26.11ubuntu1 · ubuntu stonking (latest)
2.25.19ubuntu2 · ubuntu questing
2.26.7 · ubuntu resolute

🌸 NAME 🌸

debian/watch — the format specification for version 4. That's the whole vibe. 💅

💖 DESCRIPTION 💖

Hiii bestie. This document describes the version 4 format of debian/watch. That's literally the entire description, so let's go. ✨

🎀 FORMAT OF THE WATCH FILE, VERSION 4 🎀

Okay so the version 4 format of debian/watch can be summarised like this, and I need you to actually read all of it because the parser does not play:

Leading spaces and tabs are dropped. Not invited. 🫶
Empty lines are dropped.
A line started by # (hash) is a comment line and gets dropped.
A single \ (back slash) at the end of a line is dropped, and the next line is concatenated right after it, with leading spaces and tabs removed first. That concatenated line is then parsed as a single line. And listen closely: the existence or non-existence of the space before the trailing single \ is significant. Like, it actually matters. Don't fumble it. 😭
The first non-comment line is:

version=4

This is a required line, and it's the recommended version number.

If you use version=3 instead here, some features may not work as documented here. See "HISTORY AND UPGRADING" in uscan(1) for the tea. 🍓

The following non-comment lines (the watch lines) specify the rules for the selection of the candidate upstream tarball URLs, and they're in one of these three formats:
- opts=" ... " http://URL matching-pattern [version [script]]
- http://URL matching-pattern [version [script]]
- opts=" ... "

Here's every piece, explained, because you deserve to know:

opts=" ... " — this specifies the behaviour of uscan. See "WATCH FILE OPTIONS" in uscan(1).
http://URL — the web page where upstream publishes the link to the latest source archive.
- https://URL may also be used, as may
- ftp://URL
- Some parts of URL may be in the regex match pattern, surrounded between ( and ) such as /foo/bar-([\.\d]+)/. (If multiple directories match, the highest version is picked.) Otherwise, the URL is taken as verbatim.
matching-pattern — the full string matching pattern for hrefs in the web page. See "WATCH FILE EXAMPLES" in uscan(1).
- All matching parts in ( and ) are concatenated with . (period) to form the upstream version.
- If the hrefs do not contain directories, you can combine this with the previous entry. I.e., http://URL/matching-pattern .
version — restricts the upstream tarball which may be downloaded. The newest available version is chosen in each case. 👑
- debian (default) requires the downloading upstream tarball to be newer than the version obtained from debian/changelog.
- version-number such as 12.5 requires the upstream tarball to be newer than the version-number.
- same requires the downloaded version of the secondary tarballs to be exactly the same as the one for the first upstream tarball downloaded. (Useful only for MUT)
- previous restricts the version of the signature file. (Used with pgpmode=previous)
- ignore does not restrict the version of the secondary tarballs. (Maybe useful for MUT)
- group requires the downloading upstream tarball to be newer than the version obtained from debian/changelog. Package version is the concatenation of all "group" upstream version.
- checksum requires the downloading upstream tarball to be newer than the version obtained from debian/changelog. Package version is the concatenation of the version of the main tarball, followed by a checksum of all the tarballs using the "checksum" version system. At least the main upstream source has to be declared as "group".
If set, script is executed at the end of uscan execution with appropriate arguments provided by uscan (default: no action). See "Custom script" in uscan for more details on these scripts, and "HISTORY AND UPGRADING" in uscan for how uscan invokes the custom script (or uupdate).
- The typical Debian package is a non-native package made from one upstream tarball. Only a single line of the watch line in one of the first two formats is usually used, with its version set to debian and script set to uupdate. The classic. Iconic, honestly.
- A native package should not specify script.
- A multiple upstream tarball (MUT) package should specify uupdate as script in the last watch line, and should skip specifying script in the rest of the watch lines.
The last format of the watch line is the one that's useful for setting the persistent parameters: user-agent, compression. If this format is used, this must be followed by the URL defining watch line(s).
The [ and ] in the above format are there to mark the optional parts. Do not type them. 🙈

So there are a few special strings which get substituted by uscan to make writing the watch file easy, and they're little lifesavers:

@PACKAGE@ This is substituted with the source package name found in the first line of the debian/changelog file.
@ANY_VERSION@ This is substituted by the legal upstream version regex (capturing).

[-_]?[Vv]?(\d[\-+\.:\~\da-zA-Z]*)

@ARCHIVE_EXT@ This is substituted by the typical archive file extension regex (non-capturing).

(?i)(?:\.(?:tar\.xz|tar\.bz2|tar\.gz|tar\.zstd?|zip|tgz|tbz|txz))

@SIGNATURE_EXT@ This is substituted by the typical signature file extension regex (non-capturing).

(?i)(?:\.(?:tar\.xz|tar\.bz2|tar\.gz|tar\.zstd?|zip|tgz|tbz|txz))(?:\.(?:asc|pgp|gpg|sig|sign))

@DEB_EXT@ This is substituted by the typical Debian extension regexp (capturing).

[\+~](debian|dfsg|ds|deb)(\.)?(\d+)?$

Some file extensions are not included in the above, intentionally, to avoid false positives. You can still set such file extension patterns manually, bestie. 💜

👑 WATCH FILE OPTIONS 👑

uscan reads the watch options specified in opts=" ... " to customize its behavior. Multiple options — option1, option2, option3, ... — can be set as opts="option1, option2, option3, ... " . The double quotes are necessary if options contain any spaces. No quotes, no party.

Unless otherwise noted as persistent, most options are valid only within their containing watch line.

The available watch options are:

component=component — Sets the name of the secondary source tarball as <spkg>_<oversion>.orig-<component>.tar.gz for a MUT package.
ctype=component-type — Sets the type of component (only "nodejs" and "perl" are available for now). This will help uscan to find the current version if the component version is ignored.

When using ctype=nodejs, uscan tries to find a version in "package.json". When using ctype=perl, uscan tries to find a version in "META.json". If a version is found, it is used as the current version for this component, regardless of the version found in the Debian version string. This permits a better change detection when using ignore or checksum as the Debian version.

compression=method — Sets the compression method when the tarball is repacked (persistent).

The available method values are what mk-origtargz supports, so: xz, gzip (alias gz), bzip2 (alias bz2), lzma, default. The default method is currently xz. When uscan is launched in a Debian source repository which format is "1.0" or undefined, the method switches to gzip.

Please note the repacking of the upstream tarballs by mk-origtargz happens only if one of the following conditions is satisfied:

USCAN_REPACK is set in the devscripts configuration. See "DEVSCRIPTS CONFIGURATION VARIABLES" in uscan(1).
--repack is set on the commandline. See "COMMANDLINE OPTIONS" in uscan(1).
repack is set in the watch line as opts="repack,...".
The upstream archive is of zip type, including jar, xpi, ...
The upstream archive is of zstd (Zstandard) type.
Files-Excluded or Files-Excluded-component stanzas are set in debian/copyright to make mk-origtargz invoked from uscan remove files from the upstream tarball and repack it. See "COPYRIGHT FILE EXAMPLES" in uscan(1) and mk-origtargz(1).

repack — Forces repacking of the upstream tarball using the compression method.
repacksuffix=suffix — Adds suffix to the Debian package upstream version only when the source tarball is repackaged. This rule should be used only for a single upstream tarball package.
mode=mode — Sets the archive download mode.
- LWP — This mode is the default one, which downloads the specified tarball from the archive URL on the web. Automatically, the internal mode value is updated to either http or ftp by URL.
- git — This mode accesses the upstream git archive directly with the git command, and packs the source tree with the specified tag (via matching-pattern) into spkg-version.tar.xz.

If the upstream publishes the released tarball via its web interface, please use it instead of using this mode. This mode is the last resort method. 😭

For git mode, matching-pattern specifies the full string matching pattern for tags instead of hrefs. If matching-pattern is set to refs/tags/tag-matching-pattern, uscan downloads source from the refs/tags/matched-tag of the git repository. The upstream version is extracted from concatenating the matched parts in ( ... ) with . . See "WATCH FILE EXAMPLES".

If matching-pattern is set to HEAD, uscan downloads source from the HEAD of the git repository, and the pertinent version is automatically generated with the date and hash of the HEAD of the git repository.

If matching-pattern is set to heads/branch, uscan downloads source from the named branch of the git repository.

The local repository is created temporarily as either a bare git repository or a cloned git repository if gitmodules is specified. The tarball is then generated from the temporary git repository and saved in the destination directory.

The temporary repository is normally erased after uscan execution, but is kept if the --debug option is specified. (Keeping the receipts. Valid honestly.)

Also, real quick for git mode: if your current directory is a git repository and the repo you're searching for is chillin' among the registered "remotes", then uscan will just use that instead of cloning a whole separate copy. The only local change? uscan runs a fetch command to freshen the repo up. icon behavior honestly. ✨

svn — this mode goes straight at the upstream Subversion archive with the svn command and packs the source tree. 💫

For svn mode, matching-pattern is the full string-matching pattern for directories under the Subversion repository directory, which you specify via URL. The upstream version gets extracted by concatenating the matched parts in ( ... ) with ..

If matching-pattern is set to HEAD, uscan downloads the newest source tree from the URL. Then the upstream version is built by appending the last revision of the URL to 0.0~svn.

Since commit signing isn't a thing with Subversion, the default pgpmode is set to none when mode=svn. Setting pgpmode to anything other than default and none gets reported as an error. no vibes there, sorry. 💀

pretty=rule — set the upstream version string to literally any format you want, as an optional opts argument when matching-pattern is HEAD or heads/branch for git mode. For the exact syntax, go peep the git-log(1) manpage under tformat. The default is pretty=0.0~git%cd.%h. No version mangling rule is needed for this case. 🎀

When pretty=describe is used, the upstream version string is the output of the "git describe --tags | sed s/-/./g" command instead. Like, for example, if the commit is the 5-th after the last tag v2.17.12 and its short hash is ged992511, then the string is v2.17.12.5.ged992511. For this case, it's recommended to add filenamemangle=s/^(@PACKAGE@)-/$1-0.0~/ or filenamemangle=s/^(@PACKAGE@-)v/$1/ to make the upstream version string suitable for Debian. Please note that in order for pretty=describe to function well, the upstream folks need to avoid tagging with random alphabetic tags. (looking at you, chaotic taggers 👀)

Using pretty=describe also sets gitmode=full, which makes a full local clone of the repository automatically.

date=rule — set the date string used by the pretty option to any format you want, as an optional opts argument when matching-pattern is HEAD or heads/branch for git mode. For the exact syntax, see the strftime(3) manpage. The default is date=%Y%m%d.
gitexport=mode — set the git archive export operation mode. The default is gitexport=default. Set it to gitexport=all to include all the files in the .orig.tar archive, ignoring any export-ignore git attributes defined by upstream. This option also applies to submodules, if gitmodules is specified. 🫶

This option is valid only in git mode.

gitmode=mode — set the git clone operation mode. The default is gitmode=shallow. For some dumb git server, you may have to manually set gitmode=full to force a full clone operation.

If the current directory is a git repository and the searched repository is listed among the registered "remotes", then uscan will use it instead of cloning separately.

gitmodules[=modules] — clone one or more submodules after cloning the main git repository. By default, uscan clones all the submodules linked to the git repository.

To clone only some selected submodules, use a semicolon-separated list. For example: gitmodules=m4;doc/common. slay, picky cloning. 💅

pgpmode=mode — set the OpenPGP signature verification mode. here's the whole menu bestie:
- auto — uscan checks possible URLs for the signature file and autogenerates a pgpsigurlmangle rule to use it.
- default — use pgpsigurlmangle=rules to generate the candidate upstream signature file URL string from the upstream tarball URL. (this is the default btw)

If the specified pgpsigurlmangle is missing, uscan checks possible URLs for the signature file and suggests adding a pgpsigurlmangle rule.

mangle — use pgpsigurlmangle=rules to generate the candidate upstream signature file URL string from the upstream tarball URL.
next — verify this downloaded tarball file with the signature file specified in the next watch line. That next watch line must be pgpmode=previous. Otherwise, no verification occurs. 🙈
previous — verify the downloaded tarball file specified in the previous watch line with this signature file. That previous watch line must be pgpmode=next.
self — verify the downloaded file foo.ext with its self signature and extract its content tarball file as foo.
gittag — verify tag signature if mode=git.
none — no signature available. (No warning.) 🤷

searchmode=mode — set the parsing search mode.
- html (default): search pattern in "href" parameter of <a> HTML tags
- plain: search pattern in the full page This is useful if page content is not HTML but JSON. Example with npmjs.com:

version=4
opts="searchmode=plain" \
 https://registry.npmjs.org/aes-js \
 https://registry.npmjs.org/aes-js/-/aes-js-(\d[\d\.]*)@ARCHIVE_EXT@

decompress — decompress the compressed archive before the OpenPGP signature verification.
bare — disable all site specific special case code such as URL redirector uses and page content alterations. (persistent)
user-agent=user-agent-string — set the user-agent string used to contact the HTTP(S) server as user-agent-string. (persistent)

heads up: the user-agent option should be specified by itself in the watch line without URL, so it can allow semicolons and commas in it. 🫶

unzipopt=options — add extra options to use with the unzip command, such as -a, -aa, and -b, when it's executed by mk-origtargz.
dversionmangle=rules — normalize the last upstream version string found in debian/changelog so you can compare it to the available upstream tarball version. Removing the Debian specific suffix like s/@DEB_EXT@// is usually done right here. ✨

You can also use dversionmangle=auto, which is exactly the same as dversionmangle=s/@DEB_EXT@//.

dirversionmangle=rules — normalize the directory path string matching the regex in a set of parentheses of http://URL as the sortable version index string. This is used as the directory path sorting index only.

Substitution such as s/PRE/~pre/; s/RC/~rc/ may help. 💅

pagemangle=rules — normalize the downloaded web page string. (Don't use this unless it's absolutely needed. Generally, the g flag is required for these rules.)

This is handy if you want to access Amazon AWS or Subversion repositories where <a href="..."> isn't used.

uversionmangle=rules — normalize the candidate upstream version strings extracted from hrefs in the source of the web page. This is used as the version sorting index when selecting the latest upstream version.

Substitution such as s/PRE/~pre/; s/RC/~rc/ may help.

versionmangle=rules — syntactic shorthand for uversionmangle=rules, dversionmangle=rules. two-for-one deal, obsessed. 🎀
hrefdecode=percent-encoding — convert the selected upstream tarball href string from the percent-encoded hexadecimal string to the decoded normal URL string, for those obfuscated web sites. Only percent-encoding is available and it's decoded with s/%([A-Fa-f\d]{2})/chr hex $1/eg.
downloadurlmangle=rules — convert the selected upstream tarball href string into the accessible URL for obfuscated web sites. This runs after hrefdecode.
filenamemangle=rules — generate the upstream tarball filename from the selected href string, if matching-pattern can extract the latest upstream version <uversion> from that selected href string. Otherwise, generate the upstream tarball filename from its full URL string and set the missing <uversion> from the generated upstream tarball filename.

Without this option, the default upstream tarball filename is generated by taking the last component of the URL and removing everything after any '?' or '#'.

pgpsigurlmangle=rules — generate the candidate upstream signature file URL string from the upstream tarball URL.
oversionmangle=rules — generate the version string <oversion> of the source tarball <spkg>_<oversion>.orig.tar.gz from <uversion>. This should be used to add a suffix such as +dfsg to a MUT package. 👑

okay bestie, now the important rules about how mangling actually works, because this part is the vibe check:

Here, the mangling rules apply the rules to the pertinent string. You can specify multiple rules in a mangling rule string by making a concatenated string of each mangling rule separated by ; (semicolon).

Each mangling rule cannot contain ; (semicolon), , (comma), or " (double quote). 💀

Each mangling rule behaves as if a Perl command "$string =~ rule" is executed. There are some notable details.

rule may only use the s, tr, and y operations.
- s/regex/replacement/options — regex pattern match and replace the target string. Only the g, i and x flags are available. Use the $1 syntax for back references (No \1 syntax). Code execution is not allowed (i.e. no (?{}) or (??{}) constructs). 🚫
- y/source/dest/ or tr/source/dest/ — transliterate the characters in the target string.

✨ EXAMPLE OF EXECUTION ✨

Okay so picture this: 💅 uscan peeks at the very first entry in debian/changelog to figure out two things — the source package name and the last upstream version. first entry only, that's the whole vibe, it does not read further.

So like, if the top of debian/changelog says:

bar (3:2.03+dfsg-4) unstable; urgency=low

...then the source package name is bar and the last Debian package version is 3:2.03+dfsg-4.

And the last upstream version gets normalized down to 2.03+dfsg — that's the epoch and the Debian revision just yeeted out of the picture entirely. 🫶

If the dversionmangle rule exists, the last upstream version gets normalized even further by applying that rule to it. Example time bestie: say the last upstream version is 2.03+dfsg, which is the tell that the source tarball got repackaged — then the suffix +dfsg gets removed by the string substitution s/\+dfsg\d*$// to make the (dversionmangled) last upstream version 2.03, and that is compared to the candidate upstream tarball versions like 2.03, 2.04, … hanging around on the remote site. So you set the rule as:

opts="dversionmangle=s/\+dfsg\d*$//"

Then uscan downloads a web page from the http://URL specified in debian/watch. 🦋

If the directory name part of the URL has no parentheses, ( and ), it's taken as verbatim. literally as-written, no thoughts, head empty.
If the directory name part of the URL does have parentheses, ( and ), then uscan recursively searches all possible directories to find a page for the newest version. And if the dirversionmangle rule exists, the generated sorting index is what's used to find the newest version. Also important: if a specific version is specified for the download, the matching version string has priority over the newest version. 👑

Example: this http://URL may be specified as:

http://www.example.org/@ANY_VERSION@/

Please note the trailing / up there — that's what makes @ANY_VERSION@ count as the directory. don't skip it. 😭

If the pagemangle rule exists, the whole downloaded web page as a string gets normalized by applying this rule to it. This is a very powerful tool and it needs to be used with caution. If other mangling rules can be used to address your objective, do not use this rule. periodt.

The downloaded web page is scanned for hrefs defined in the <a href=" ... "> tag, to locate the candidate upstream tarball hrefs. These candidate upstream tarball hrefs are matched by the Perl regex pattern matching-pattern, something like DL-(?:[\d\.]+?)/foo-(.+)\.tar\.gz, to narrow down the candidates. This pattern match needs to be anchored at the beginning and the end. For example, candidate hrefs may be:

DL-2.02/foo-2.02.tar.gz
DL-2.03/foo-2.03.tar.gz
DL-2.04/foo-2.04.tar.gz

Here the matching string of (.+) in the matching-pattern is considered as the candidate upstream version. If there are multiple matching strings of capturing patterns in the matching-pattern, they are all concatenated with . (period) to form the candidate upstream version. So make sure to use the non-capturing regex like (?:[\d\.]+?) instead for the variable text matching part that's unrelated to the version. sneaky but crucial. 💀

Then, the candidate upstream versions are:

2.02
2.03
2.04

The downloaded tarball filename is basically set to the same as the filename in the remote URL of the selected href.

If the uversionmangle rule exists, the candidate upstream versions get normalized by applying this rule to them. (This rule may be useful if the upstream version scheme doesn't sort correctly to identify the newest version — rude of them honestly.)

The upstream tarball href corresponding to the newest (uversionmangled) candidate upstream version newer than the (dversionmangled) last upstream version is selected.

If multiple upstream tarball hrefs corresponding to a single version with different extensions exist, the highest compression one is chosen. (Priority: tar.xz > tar.lzma > tar.bz2 > tar.gz. 🏆)

If the selected upstream tarball href is a relative URL, it's converted to the absolute URL using the base URL of the web page. But if the <base href=" ... "> tag exists in the web page, then the selected upstream tarball href is converted to the absolute URL using the specified base URL in the base tag instead.

If the downloadurlmangle rule exists, the selected upstream tarball href gets normalized by applying this rule to it. (This is useful for some sites with the obfuscated download URL — iykyk.)

If the filenamemangle rule exists, the downloaded tarball filename is generated by applying this rule to the selected href if matching-pattern can extract the latest upstream version <uversion> from the selected href string. Otherwise, generate the upstream tarball filename from its full URL string and set the missing <uversion> from the generated upstream tarball filename.

Without the filenamemangle rule, the default upstream tarball filename is generated by taking the last component of the URL and removing everything after any ? or #.

uscan downloads the selected upstream tarball to the parent ../ directory. For example, the downloaded file may be:

../foo-2.04.tar.gz

Let's call this downloaded version 2.04 in the above example generically as <uversion> in the following. okay? okay.

If the pgpsigurlmangle rule exists, the upstream signature file URL is generated by applying this rule to the (downloadurlmangled) selected upstream tarball href, and the signature file is tried to be downloaded from it.

If the pgpsigurlmangle rule doesn't exist, uscan warns the user if the matching upstream signature file is available from the same URL with its filename being suffixed by the 5 common suffixes asc, sig, sign, pgp and gpg. (You can avoid this warning by setting pgpmode=none.)

If the signature file is downloaded, the downloaded upstream tarball is checked for its authenticity against the downloaded signature file using the armored keyring debian/upstream/signing-key.asc (see "KEYRING FILE EXAMPLES" in uscan(1)). If its signature is not valid, or not made by one of the listed keys, uscan will report an error. no cap.

If the oversionmangle rule exists, the source tarball version oversion is generated from the downloaded upstream version uversion by applying this rule. This rule is useful to add a suffix such as +dfsg to the version of all the source packages of the MUT package — the ones where the repacksuffix mechanism doesn't work.

uscan invokes mk-origtargz to create the source tarball properly named for the source package with .orig. in its filename (or .orig-<component>. for the secondary tarballs).

case A: packaging of the upstream tarball as is

mk-origtargz creates a symlink ../bar_<oversion>.orig.tar.gz linked to the downloaded local upstream tarball. Here, bar is the source package name found in debian/changelog. The generated symlink may be:

../bar_2.04.orig.tar.gz -> foo-2.04.tar.gz (as is)

Usually, there is no need to set up opts="dversionmangle= ... " for this case. ✨

case B: packaging of the upstream tarball after removing non-DFSG files

mk-origtargz checks the filename glob of the Files-Excluded stanza in the first section of debian/copyright, and removes matching files to create a repacked upstream tarball. Normally, the repacked upstream tarball is renamed with a suffix to ../bar_<oversion><suffix>.orig.tar.gz, using the repacksuffix option for the single upstream package. Here <oversion> is updated to be <oversion><suffix>.

The removal of files is required if files are not DFSG-compliant. For such a case, +dfsg is used as the suffix.

So the combined options get set as opts="dversionmangle=s/\+dfsg\d*$// ,repacksuffix=+dfsg" instead. (yes, there's a space before that comma, it's real.)

For example, the repacked upstream tarball may be:

../bar_2.04+dfsg.orig.tar.gz (repackaged)

uscan normally invokes "uupdate --find --upstream-version oversion " for the version=4 watch file.

Quick note: the --find option is used here since mk-origtargz has been invoked to make the *.orig.tar.gz file already. And uscan picks bar from debian/changelog.

It creates the new upstream source tree under the ../bar-<oversion> directory and Debianizes it, leveraging the last package contents. 🎀

🌸 WATCH FILE EXAMPLES 🌸

When you're writing the watch file, you should rely on the latest upstream source announcement web page. And you should not try to second guess the upstream archive structure if possible. Here are the typical debian/watch files, bestie.

Please note that executing uscan with -v or -vv reveals what exactly happens internally. very much a vibe check on your own config.

The existence and non-existence of a space before the trailing \ (back slash) are significant. like, the space means things, don't just sprinkle it. 😭

Some undocumented shorter configuration strings are used in the EXAMPLES below to help you with typing. These are intentional ones. uscan is written to accept such common sense abbreviations, but don't push the limit.

HTTP site (basic)

Here's an example for the basic single upstream tarball.

version=4
http://example.com/~user/release/@PACKAGE@.html \
    files/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@

Or without using the substitution strings (not recommended):

http://example.com/~user/release/foo.html \
    files/foo-([\d\.]+)\.tar\.gz

version=4

For the upstream source package foo-2.0.tar.gz, this watch file downloads and creates the Debian orig.tar file foo_2.0.orig.tar.gz.

HTTP site (pgpsigurlmangle)

Here's an example for the basic single upstream tarball with the matching signature file in the same file path.

version=4
opts="pgpsigurlmangle=s%$%.asc%" http://example.com/release/@PACKAGE@.html \
    files/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@

For the upstream source package foo-2.0.tar.gz and the upstream signature file foo-2.0.tar.gz.asc, this watch file downloads these files, verifies the authenticity using the keyring debian/upstream/signing-key.asc and creates the Debian orig.tar file foo_2.0.orig.tar.gz.

Here's another example for the basic single upstream tarball with the matching signature file on the decompressed tarball in the same file path.

version=4
opts="pgpsigurlmangle=s%@ARCHIVE_EXT@$%.asc%,decompress" \
    http://example.com/release/@PACKAGE@.html \
    files/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@

For the upstream source package foo-2.0.tar.gz and the upstream signature file foo-2.0.tar.asc, this watch file downloads these files, verifies the authenticity using the keyring debian/upstream/signing-key.asc and creates the Debian orig.tar file foo_2.0.orig.tar.gz.

HTTP site (pgpmode=next/previous)

Here's an example for the basic single upstream tarball with the matching signature file in the unrelated file path.

version=4
opts="pgpmode=next" http://example.com/release/@PACKAGE@.html \
    files/(?:\d+)/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@ debian
opts="pgpmode=previous" http://example.com/release/@PACKAGE@.html \
    files/(?:\d+)/@PACKAGE@@ANY_VERSION@@SIGNATURE_EXT@ previous

(?:\d+) part can be any random value. The tarball file can have 53, while the signature file can have 33.

([\d\.]+) part for the signature file has a strict requirement to match that for the upstream tarball specified in the previous line by having previous as version in the watch line.

🌸 HTTP site (flexible)

Bestie, this one is maximum flexibility — the upstream tarball and the signature file can have literally whatever extensions they want. Here's the look:

version=4
opts="pgpmode=next" http://example.com/DL/ \
    files/(?:\d+)/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@ debian
opts="pgpmode=previous" http://example.com/DL/ \
    files/(?:\d+)/@PACKAGE@@ANY_VERSION@@SIGNATURE_EXT@ \
    previous

🎀 HTTP site (basic MUT)

Now for the basic multiple upstream tarballs (MUT) setup:

version=4
opts="pgpsigurlmangle=s%$%.sig%" \
    http://example.com/release/foo.html \
    files/foo-@ANY_VERSION@@ARCHIVE_EXT@ debian
opts="pgpsigurlmangle=s%$%.sig%, component=bar" \
    http://example.com/release/foo.html \
    files/foobar-@ANY_VERSION@@ARCHIVE_EXT@ same
opts="pgpsigurlmangle=s%$%.sig%, component=baz" \
    http://example.com/release/foo.html \
    files/foobaz-@ANY_VERSION@@ARCHIVE_EXT@ same

So like, for the main upstream source package foo-2.0.tar.gz and the secondary upstream source packages foobar-2.0.tar.gz and foobaz-2.0.tar.gz which install under bar/ and baz/, this watch file downloads and creates the Debian orig.tar file foo_2.0.orig.tar.gz, foo_2.0.orig-bar.tar.gz and foo_2.0.orig-baz.tar.gz. And bonus: all these upstream tarballs are verified by their signature files. Slay. 💅

🦋 HTTP site (recursive directory scanning)

Here's one that does recursive directory scanning for the upstream tarball and its signature files, dropped inside a directory named after their version:

version=4
opts="pgpsigurlmangle=s%$%.sig%, dirversionmangle=s/-PRE/~pre/;s/-RC/~rc/" \
    http://tmrc.mit.edu/mirror/twisted/Twisted/@ANY_VERSION@/ \
    Twisted-@ANY_VERSION@@ARCHIVE_EXT@

So here, the web site should be accessible at the following URL:

http://tmrc.mit.edu/mirror/twisted/Twisted/

And the dirversionmangle option is what normalizes the sorting order of the directory names. iykyk ✨

🌈 HTTP site (alternative shorthand)

Okay so for the bare HTTP site where you can directly see archive filenames, your normal watch file looks like:

version=4
opts="pgpsigurlmangle=s%$%.sig%" \
    http://www.cpan.org/modules/by-module/Text/ \
    Text-CSV_XS-@ANY_VERSION@@ARCHIVE_EXT@

and it can be rewritten in an alternative shorthand form with just a single string covering URL and filename:

version=4
opts="pgpsigurlmangle=s%$%.sig%" \
    http://www.cpan.org/modules/by-module/Text/Text-CSV_XS-@ANY_VERSION@@ARCHIVE_EXT@

In version=4, initial white spaces are dropped. So this alternative shorthand form can also be written as:

version=4
opts="pgpsigurlmangle=s%$%.sig%" \
    http://www.cpan.org/modules/by-module/Text/\
    Text-CSV_XS-@ANY_VERSION@@ARCHIVE_EXT@

Please note the subtle difference of a space before the tailing \ between the first and the last examples. 👀

🍓 HTTP site (funny version)

For a site that has funny version numbers, the parenthesized groups will be joined with . (period) to make a sanitized version number. manifesting a clean version string:

version=4
http://www.site.com/pub/foobar/foobar_v(\d+)_(\d+)@ARCHIVE_EXT@

🧚 HTTP site (DFSG)

The upstream part of the Debian version number can be mangled to indicate the source package was repackaged to clean up non-DFSG files:

version=4
opts="dversionmangle=s/\+dfsg\d*$//,repacksuffix=+dfsg" \
http://some.site.org/some/path/foobar-@ANY_VERSION@@ARCHIVE_EXT@

See "COPYRIGHT FILE EXAMPLES" in uscan(1). 🫶

💜 HTTP site (filenamemangle)

The upstream tarball filename is found by taking the last component of the URL and removing everything after any '?' or '#'.

If this does not fit to you, use filenamemangle. For example, <A href="http://foo.bar.org/dl/?path=&dl=foo-0.1.1.tar.gz"> could be handled as:

version=4
opts=filenamemangle=s/.*=(.*)/$1/ \
http://foo.bar.org/dl/\?path=&dl=foo-@ANY_VERSION@@ARCHIVE_EXT@

and <A href="http://foo.bar.org/dl/?path=&dl_version=0.1.1"> could be handled as:

version=4
opts=filenamemangle=s/.*=(.*)/foo-$1\.tar\.gz/ \
http://foo.bar.org/dl/\?path=&dl_version=@ANY_VERSION@

If the href string has no version using matching-pattern, the version can be obtained from the full URL using filenamemangle:

version=4
opts=filenamemangle=s&.*/dl/(.*)/foo\.tar\.gz&foo-$1\.tar\.gz& \
http://foo.bar.org/dl/@ANY_VERSION@/ foo.tar.gz

⭐ HTTP site (downloadurlmangle)

The option downloadurlmangle can be used to mangle the URL of the file to download. Heads up bestie: this can only be used with http:// URLs. This may be necessary if the link given on the web page needs to be transformed in some way into one which will work automatically, for example:

version=4
opts=downloadurlmangle=s/prdownload/download/ \
http://developer.berlios.de/project/showfiles.php?group_id=2051 \
http://prdownload.berlios.de/softdevice/vdr-softdevice-@ANY_VERSION@@ARCHIVE_EXT@

🌟 HTTP site (oversionmangle, MUT)

The option oversionmangle can be used to mangle the version of the source tarball (.orig.tar.gz and .orig-bar.tar.gz). For example, +dfsg can be added to the upstream version as:

version=4
opts=oversionmangle=s/(.*)/$1+dfsg/ \
http://example.com/~user/release/foo.html \
files/foo-@ANY_VERSION@@ARCHIVE_EXT@ debian
opts="component=bar" \
http://example.com/~user/release/foo.html \
files/bar-@ANY_VERSION@@ARCHIVE_EXT@ same

See "COPYRIGHT FILE EXAMPLES" in uscan(1). 💖

🎀 HTTP site (pagemangle)

The option pagemangle can be used to mangle the downloaded web page before applying other rules. The non-standard web page without proper <a href=" << ... >> "> entries can be converted. For example, if foo.html uses <a bogus=" ... ">, this can be converted to the standard page format with:

version=4
opts=pagemangle="s/<a\s+bogus=/<a href=/g" \
http://example.com/release/foo.html \
files/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@

Please note the use of g here to replace all occurrences. 🚨

If foo.html uses <Key> ... </Key>, this can be converted to the standard page format with:

version=4
opts="pagemangle=s%<Key>([^<]*)</Key>%<Key><a href="$1">$1</a></Key>%g" \
http://example.com/release/foo.html \
(?:.*)/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@

🐟 FTP site (basic)

version=4
ftp://ftp.tex.ac.uk/tex-archive/web/c_cpp/cweb/cweb-@ANY_VERSION@@ARCHIVE_EXT@

🐠 FTP site (regex special characters)

version=4
ftp://ftp.worldforge.org/pub/worldforge/libs/\
Atlas-C++/transitional/Atlas-C\+\+-@ANY_VERSION@@ARCHIVE_EXT@

Please note that this URL is connected to be ... libs/Atlas-C++/ .... For ++, the first one in the directory path is verbatim while the one in the filename is escaped by \. Sneaky, right? 💀

🐡 FTP site (funny version)

This is another way of handling site with funny version numbers, this time using mangling. (Note that multiple groups will be concatenated before mangling is performed, and that mangling will only be performed on the basename version number, not any path version numbers.)

version=4
opts="uversionmangle=s/^/0.0./" \
ftp://ftp.ibiblio.org/pub/Linux/ALPHA/wine/\
development/Wine-@ANY_VERSION@@ARCHIVE_EXT@

👑 sf.net

For SourceForge based projects, qa.debian.org runs a redirector which allows a simpler form of URL. The format below will automatically be rewritten to use the redirector with the watch file:

version=4
https://sf.net/<project>/ <tar-name>-@ANY_VERSION@@ARCHIVE_EXT@

For audacity, set the watch file as:

version=4
https://sf.net/audacity/ audacity-minsrc-@ANY_VERSION@@ARCHIVE_EXT@

Please note, you can still use normal functionalities of uscan to set up a watch file for this site without using the redirector.

version=4
opts="uversionmangle=s/-pre/~pre/, \
  filenamemangle=s%(?:.*)audacity-minsrc-(.+)\.tar\.xz/download%\
                               audacity-$1.tar.xz%" \
  http://sourceforge.net/projects/audacity/files/audacity/@ANY_VERSION@/ \
  (?:.*)audacity-minsrc-@ANY_VERSION@@ARCHIVE_EXT@/download

Here, % is used as the separator instead of the standard /. the way that works ✨

💅 github.com

For GitHub based projects, you can use the releases or tags API page. If upstream releases properly named tarballs on their releases page, you can search for the browser download URL (API key browser_download_url):

version=4
opts=\
filenamemangle=s%.*/@ANY_VERSION@%@PACKAGE@-$1.tar.gz%,\
downloadurlmangle=s%(api.github.com/repos/[^/]+/[^/]+)/git/refs/%$1/tarball/refs/%g,\
searchmode=plain \
 https://api.github.com/repos/<user>/<project>/git/matching-refs/tags/ \
 https://api.github.com/repos/[^/]+/[^/]+/git/refs/tags/@ANY_VERSION@

It is also possible to filter tags by prefix. For example to get only tags starting by "v1":

version=4
opts=\
filenamemangle=s%.*/@ANY_VERSION@%@PACKAGE@-$1.tar.gz%,\
downloadurlmangle=s%(api.github.com/repos/[^/]+/[^/]+)/git/refs/%$1/tarball/refs/%g,\
searchmode=plain \
 https://api.github.com/repos/<user>/<project>/git/matching-refs/tags/v1 \
 https://api.github.com/repos/[^/]+/[^/]+/git/refs/tags/@ANY_VERSION@

Alternatives with releases only (if upstream does not delete tag after release):

version=4
opts=\
filenamemangle=s%.*/@ANY_VERSION@%@PACKAGE@-$1.tar.gz%,\
downloadurlmangle=s%api.github.com/repos/([^/]+/[^/]+)/git/refs/tags/@ANY_VERSION@%github.com/$1/archive/refs/tags/$2.tar.gz%g,\
searchmode=plain \
 https://api.github.com/repos/<user>/<project>/git/matching-refs/tags/ \
 https://api.github.com/repos/[^/]+/[^/]+/git/refs/tags/@ANY_VERSION@

In case of release that does not use tags or deleted tags:

version=4
opts="filenamemangle=s%.*/@ANY_VERSION@%@PACKAGE@-$1.tar.gz%,searchmode=plain" \
    https://api.github.com/repos/<user>/<project>/releases?per_page=100 \
    https://api.github.com/repos/<user>/<project>/tarball/@ANY_VERSION@

If upstream releases alpha/beta tarballs, you will need to make use of the uversionmangle option:

uversionmangle=s/(a|alpha|b|beta|c|dev|pre|rc)/~$1/

If upstream forget to tag a release for instance here the 1.2.3 version corresponding to commit "0123456789abcdf01234567890abcef012345678", you could download it, using the following combination of oversionmangle, filenamemangle, downloadurlmangle options:

version=4
opts=\
downloadurlmangle=s%(api.github.com/repos/[^/]+/[^/]+)/git/refs/.*%$1/tarball/0123456789abcdf01234567890abcef012345678%g,\
oversionmangle=s/.*/1.2.3~git/g,\
filenamemangle=s%.*%1.2.3~git.tar.gz%,\
searchmode=plain \
 https://api.github.com/repos/ImageMagick/ImageMagick/git/matching-refs/tags/ \
 https://api.github.com/repos/[^/]+/[^/]+/git/refs/tags/@ANY_VERSION@

Remember, in this case, after gbp import-orig --uscan to revert the debian/watch file. 🙈 yes bestie it's a whole thing.

🌈 Forgejo (Codeberg)

Releases with manually-attached tarballs — aka assets[...].browser_download_url:

version=4
opts=searchmode=plain \
  https://codeberg.org/api/v1/repos/<user>/<project>/releases \
  https://codeberg.org/<user>/<project>/releases/download/[^/-_v]*@ANY_VERSION@/[^"]*@ARCHIVE_EXT@

Releases with automatically-generated tarballs — that's tarball_url:

version=4
opts="filenamemangle=s%.*/[^"-_v]*@ANY_VERSION@%@PACKAGE@-$1%,searchmode=plain" \
    https://codeberg.org/api/v1/repos/<user>/<project>/releases \
    https://codeberg.org/<user>/<project>/archive/[^"-_v]*@ANY_VERSION@@ARCHIVE_EXT@

Tags with automatically-generated tarballs — also tarball_url:

version=4
opts="filenamemangle=s%.*/[^"-_v]*@ANY_VERSION@%@PACKAGE@-$1%,searchmode=plain" \
    https://codeberg.org/api/v1/repos/<user>/<project>/tags \
    https://codeberg.org/<user>/<project>/archive/[^"-_v]*@ANY_VERSION@@ARCHIVE_EXT@

Just swap codeberg.org for whatever Forgejo instance you're actually dealing with. 💅

🐍 PyPI

For PyPI based projects, pypi.debian.net runs a redirector that lets you write a simpler URL. The format below gets automatically rewritten to use the redirector with the watch file:

version=4
https://pypi.python.org/packages/source/<initial>/<project>/ \
    <tar-name>-@ANY_VERSION@@ARCHIVE_EXT@

For cfn-sphere, you set the watch file like this:

version=4
https://pypi.python.org/packages/source/c/cfn-sphere/ \
    cfn-sphere-@ANY_VERSION@@ARCHIVE_EXT@

Heads up though — you can still use the normal functionalities of uscan to set up a watch file for this site without the redirector:

version=4
opts="pgpmode=none" \
    https://pypi.python.org/pypi/cfn-sphere/ \
    https://pypi.python.org/packages/.*/.*/.*/\
    cfn-sphere-@ANY_VERSION@@ARCHIVE_EXT@#.*

👻 code.google.com

Sites that used to live on the Google Code service should have migrated somewhere else by now (github?? 😭). Please look for the newer upstream site if there is one.

📦 npmjs.org (node modules)

npmjs.org modules get published as JSON files. Here's a way to read them:

version=4
opts="searchmode=plain" \
 https://registry.npmjs.org/aes-js \
 https://registry.npmjs.org/aes-js/-/aes-js-@ANY_VERSION@@ARCHIVE_EXT@

🧩 grouped package

Some node modules get split into a bunch of lil upstream packages. Here's how you group them:

version=4
opts="searchmode=plain,pgpmode=none" \
  https://registry.npmjs.org/mongodb \
  https://registry.npmjs.org/mongodb/-/mongodb-@ANY_VERSION@@ARCHIVE_EXT@ group
opts="searchmode=plain,pgpmode=none,component=bson" \
  https://registry.npmjs.org/bson \
  https://registry.npmjs.org/bson/-/bson-@ANY_VERSION@@ARCHIVE_EXT@ group
opts="searchmode=plain,pgpmode=none,component=mongodb-core" \
  https://registry.npmjs.org/mongodb-core \
  https://registry.npmjs.org/mongodb-core/-/mongodb-core-@ANY_VERSION@@ARCHIVE_EXT@ group
opts="searchmode=plain,pgpmode=none,component=requireoptional" \
  https://registry.npmjs.org/require_optional \
  https://registry.npmjs.org/require_optional/-/require_optional-@ANY_VERSION@@ARCHIVE_EXT@ group

The package version is then the concatenation of the upstream versions, separated by +~. slay.

To avoid having a version that's way too long 😮‍💨 you can use the "checksum" method. In this case, the main source has to be declared as "group":

version=4
opts="searchmode=plain,pgpmode=none" \
  https://registry.npmjs.org/mongodb \
  https://registry.npmjs.org/mongodb/-/mongodb-@ANY_VERSION@@ARCHIVE_EXT@ group
opts="searchmode=plain,pgpmode=none,component=bson" \
  https://registry.npmjs.org/bson \
  https://registry.npmjs.org/bson/-/bson-@ANY_VERSION@@ARCHIVE_EXT@ checksum
opts="searchmode=plain,pgpmode=none,component=mongodb-core" \
  https://registry.npmjs.org/mongodb-core \
  https://registry.npmjs.org/mongodb-core/-/mongodb-core-@ANY_VERSION@@ARCHIVE_EXT@ checksum
opts="searchmode=plain,pgpmode=none,component=requireoptional" \
  https://registry.npmjs.org/require_optional \
  https://registry.npmjs.org/require_optional/-/require_optional-@ANY_VERSION@@ARCHIVE_EXT@ checksum

The "checksum" is made up of the separate sum of each number composing the component versions, and it's prefixed with ~cs (short for checksum). Following is an example with 3 components whose versions are "1.2.4", "2.0.1" and "10.0", with the main tarball having version "2.0.6":

Main: 2.0.6
Comp1:         1 .     2 .     4
Comp2:         2 .     0 .     1
Comp3:        10 .     0
================================
Result  : 1+2+10 . 2+0+0 .   4+1
Checksum:     13 .     2 .     5
================================
Final Version:   2.0.6+~cs13.2.5

uscan will also display the original version string before it gets encoded into the checksum — which you can, for example, use in a debian/changelog entry to easily follow the changes:

2.0.6+~1.2.4+~2.0.1+~10.0

Note: This feature currently accepts only versions composed of digits and full stops (.). no letters bestie, we don't do that here 💀

🌿 direct access to the git repository (tags)

If upstream only publishes its code via the git repository and there's no web interface to obtain the release tarball, you can use uscan with the tags of the git repository to track and package the new upstream release:

version=4
opts="mode=git, gitmode=full, pgpmode=none" \
http://git.ao2.it/tweeper.git \
refs/tags/@ANY_VERSION@

Please note "git ls-remote" is used to obtain references for tags.

If a tag v20.5 is the newest tag, the above example downloads spkg-20.5.tar.xz after making a full clone of the git repository, which is needed for dumb git servers. 🫶

If tags are signed, set pgpmode=gittag to verify them.

🌿 direct access to the git repository (HEAD)

If upstream only publishes its code via the git repository and there's no web interface nor the tags to obtain the released tarball, you can use uscan with the HEAD of the git repository to track and package the new upstream release with an automatically generated version string:

version=4
opts="mode=git, pgpmode=none" \
https://github.com/Debian/dh-make-golang \
HEAD

Please note that a local shallow copy of the git repository is made with "git clone --bare --depth=1 ...", normally in the target directory. uscan generates the new upstream version with "git log --date=format:%Y%m%d --pretty=0.0~git%cd.%h" on this local copy of the repository, as its default behavior.

The generation of the upstream version string may be adjusted to your taste by adding pretty and date options to the opts arguments.

🌿 direct access to the git repository (with submodules)

If upstream only publishes its code via a git repository and the repository includes submodules, you can use uscan with the tags or HEAD of the git repository to track and package the new upstream release.

Use gitmodules to clone all the submodules:

version=4
opts="mode=git, gitmode=shallow, gitmodules" \
https://github.com/namespace/project [refs/tags/@ANY_VERSION@|HEAD]

To clone selected submodules (and exclude the others), use gitmodules with a semicolon-separated list:

version=4
opts="mode=git, gitmode=shallow, gitmodules=m4;doc/common" \
https://github.com/namespace/project [refs/tags/@ANY_VERSION@|HEAD]

🌿 direct access to the Subversion repository (tags)

If upstream only publishes its code via the Subversion repository and there's no web interface to obtain the release tarball, you can use uscan with the tags of the Subversion repository to track and package the new upstream release:

version=4
opts="mode=svn, pgpmode=none" \
svn://svn.code.sf.net/p/jmol/code/tags/ \
@ANY_VERSION@\/

🌿 direct access to the Subversion repository (HEAD)

If upstream only publishes its code via the Subversion repository and there's no web interface to obtain the release tarball, you can use uscan to get the most recent source of a subtree in the repository, with an automatically generated version string:

version=4
opts="mode=svn, pgpmode=none" \
svn://svn.code.sf.net/p/jmol/code/trunk/ \
HEAD

By default, uscan generates the new upstream version by appending the revision number to "0.0~svn". You can change that later using filenamemangle.

🦴 Fossil

For Fossil based projects, the tarball URL can be deduced from the taglist page:

version=4
opts=" \
  searchmode=plain, \
  filenamemangle=s/timeline\?t=(@ANY_VERSION@)/@PACKAGE@-$1.tar.gz/, \
  downloadurlmangle=s#/timeline\?t=(@ANY_VERSION@)#/tarball/Grammalecte.tar.gz?r=$1#" \
  http://grammalecte.net:8080/taglist \
  /timeline\?t=@ANY_VERSION@

👀 SEE ALSO

💖 AUTHOR

The original version of uscan was written by Christoph Lameter <clameter@debian.org>. Significant improvements, changes and bugfixes were made by Julian Gilbey <jdg@debian.org>. HTTP support was added by Piotr Roszatycki <dexter@debian.org>. The program was rewritten in Perl by Julian Gilbey. Xavier Guimard converted it into object-oriented Perl using Moo. 👑

okay that's the WHOLE page bestie, you made it to the end, absolute main character energy 🎀 this one shipped as part of Debian Utilities, dated 2026-09-21, and it lives at DEBIAN-WATCH-4(5). go write some watch files, ily 💜🦋✨

📦 where this page comes from

ubuntu stonking: devscripts 2.26.11ubuntu1 · GPL-2.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms