From 5eaf8c3d8d5880fa13d725bbe55318770d3045d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Otto=20Kek=C3=A4l=C3=A4inen?= <otto@debian.org>
Date: Thu, 21 Nov 2024 00:20:25 -0800
Subject: [PATCH] Extend default debian/gbp.conf with extra security config
 tips

When creating a new package, populate the git-buildpackage with additional
configs and in-line comments on why and how to use them. This will make
go packaging easier, more consistent and more secure as the best practices
flow to all packages via good defaults.

Contents is in line with the template used by `dh-make` version 2.202503.
---
 template.go | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/template.go b/template.go
index 7520f6f..7044f8b 100644
--- a/template.go
+++ b/template.go
@@ -341,8 +341,42 @@ func writeDebianGbpConf(dir string, dep14, pristineTar bool) error {
 		fmt.Fprintf(f, "dist = DEP14\n")
 	}
 	if pristineTar {
-		fmt.Fprintf(f, "pristine-tar = True\n")
-	}
+		fmt.Fprintf(f, `
+# Enable pristine-tar to exactly reproduce orig tarballs
+pristine-tar = True
+
+`)
+	}
+
+	// Additional text to the template which is useful for 99% of the go packages
+	fmt.Fprint(f, `
+# Lax requirement to use branch name 'debian/latest' so that git-buildpackage
+# will always build using the currently checked out branch as the Debian branch.
+# This makes it easier for contributors to work with feature and bugfix
+# branches.
+ignore-branch = True
+
+# The Debian packaging git repository may also host actual upstream tags and
+# branches, typically named 'main' or 'master'. Configure the upstream tag
+# format below, so that 'gbp import-orig' will run correctly, and link tarball
+# import branch ('upstream/latest') with the equivalent upstream release tag,
+# showing a complete audit trail of what upstream released and what was imported
+# into Debian.
+#
+# TODO: Most Go packages have tags of form 'v1.0.0', but must be double-checked.
+upstream-vcs-tag = v%(version%~%-)s
+
+# If upstream publishes tarball signatures, git-buildpackage will by default
+# import and use the them. Change this to 'on' to make 'gbp import-orig' abort
+# if the signature is not found or is not valid.
+#
+# Most Go packages don't publish signatures for the tarball releases, so this is
+# not enabled by default.
+#upstream-signatures = on
+
+# Ensure the Debian maintainer signs git tags automatically.
+sign-tags = True
+`)
 	return nil
 }