This lets us reject an upload up front rather than dying later in
process-upload.

Some other checks use it to see which architectures are included, for
example the previous commit.

For policy queues dak keeps the .buildinfo and .changes around until
the upload is processed.  As the uploads might already be sent to
buildds while waiting in the policy queue, the buildd upload might use
the same filename and end up getting rejected.  With this change, the
upload getting rejected should be the maintainer's upload.

If source-only uploads are enabled, accept also uploads not including
arch-indep packages by default.  An exception exists for a list of
suites that have no arch:all buildds in Debian.

While arch:all binNMUs might work for some packages, they still tend
to create problems due to versioned dependencies using

  arch-all-package (= ${source:Version})

as these will be broken by the binNMU.  To avoid these, we reject
arch:all binNMUs for now.

This is intended to be used to forbid uploads to policy queues and build
queues which would result in confusing results.  While we already have a
"reject" option in the dak.conf's SuiteMappings, having the option in
the database means we don't have to edit dak.conf when configuring new
suites.

Another usecase will be the "unstable" suite for Debian Ports: here we
want to import the source packages (and arch:all) from the main archive
and only accept binary uploads.  Additional source packages must go into
the "unreleased-*" suites.  This was not possible via SuiteMappings.

Bug: https://bugs.debian.org/783115

We only allowed 'unstable' or 'experimental'.
Signed-off-by: NJulien Cristau <jcristau@debian.org>
Signed-off-by: NAnsgar Burchardt <ansgar@debian.org>

For any debug packages, redirect binary packages to the binary debug
suite if set, otherwise install as normal.

 In particular, we should tolerate .deb packages that are in the
 Files, but are not present in the Binary package listing, since
 adding them into debian/control is a pretty bad idea.

 debhelper (currently, this will be default later), when givin
 `DH_BUILD_DDEBS=1` will build DH_BUILD_DDEBS that are in the Files
 list, named foo-dbgsym.

 The check now validates that the -dbgsym package corresponds to
 a package that *is* listed in the Binary package listing, and in
 the section "debug".

Also inherit from Reject so a proper rejection message is shown
instead of a backtrace.

Multi-Arch: no currently breaks wanna-build. We don't want that to happen.

Reference: https://bugs.debian.org/768353

This is to allow setting up an experimental arch:all buildd and will
be reverted later.

This allows to eventually drop old entries from the signature_history
table.

A custom exception is nicer to handle in the caller.

Uploads that were 'skipped' should not be recorded in
signature_history as they will be repeocessed later.

Look in signature_history table if the changes was already seen to
prevent re-uploading old changes files.

textwrap.wrap is used by TransitionCheck.

lintian passes --no-check to dpkg-source by default since 2.5.15. There
is no longer a need to set undocumented environment variables.

The yaml.load() function can run arbitrary code, the safe_load() variant only
understands a safe subset of YAML which is enough for dak.

Reference: http://bugs.debian.org/717851

Many version checks fail because the uploaded version is identical to the one
already present. Make the message correct for that case as well.

Reference: <http://bugs.debian.org/710086#15>

Return the binary package name for the error message and not the package
object.

Give a proper error message if a source package includes an upstream
tarball, but doesn't have a Debian revision.

By default dpkg-source -x requires a valid signature, but uses different
keyrings than configured in dak. So this check can fail for signatures dak has
just verified as valid a bit earlier.

With this patch lintian will pass --no-check to dpkg-source to skip signature
(and checksum) verification.