salsa

Posted Jul 5, 2024 19:43 UTC (Fri) by smurf (subscriber, #17840)
In reply to: salsa by LtWorf
Parent article: Debian debate over tag2upload reaches compromise

> There are some problems with using salsa as the ultimate source of truth: it isn't.

It's not intended to be. The signed tag is picked up by t2u and then pushed to an append-only git repository (to check it out: https://browse.dgit.debian.org). That, plus the source archive (the two are supposed to contain the same data after all, at least when you consider the trees linked to the actual tagged commits), is the "source of truth".

Whatever else happens on salsa and/or some other git repository is something Debian will have to deal with sooner or later, true, but that's independent of t2u,