git-debpush,tag2upload(5): Add source= & version= to in-tag metadata

Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>

2 files changed, 14 insertions, 8 deletions

diff --git a/git-debpush b/git-debpush
index beafd4b..b6c7f57 100755
--- a/git-debpush
+++ b/git-debpush
@@ -2,7 +2,7 @@
 
 # git-debpush -- create & push a git tag with metadata for an ftp-master upload
 #
-# Copyright (C) 2019 Sean Whitton
+# Copyright (C) 2019, 2024 Sean Whitton
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -481,7 +481,7 @@ fi
 tagmessage="$source release $version for $target
 
 [dgit distro=$distro split$quilt_mode_text]
-[dgit please-upload$upstream_info]
+[dgit please-upload source=$source version=$version$upstream_info]
 "
 
 git tag "${git_tag_opts[@]}" -s -m "$tagmessage" "$debian_tag" "$branch"
diff --git a/tag2upload.5.pod b/tag2upload.5.pod
index 91b81fe..920ecc3 100644
--- a/tag2upload.5.pod
+++ b/tag2upload.5.pod
@@ -79,6 +79,17 @@ The relevant git objects will also be pushed to
 a canonical server belonging to the targeted distro
 (in Debian's case, *.dgit.debian.org).
 
+=item C<source=SOURCE> C<version=VERSION>
+
+Specifies the name and version of the source package
+intended to be uploaded,
+as also appear in the first line of F<debian/changelog>.
+Duplicating this information in the tag metadata
+is necessary to ensure certain security properties.
+
+The package and version must correspond to F<debian/control>,
+or it is an error.
+
 =item C<distro=DISTRO>
 
 Specifies an intended distribution,
@@ -170,15 +181,10 @@ of doing anything else.
 
 =head1 IN-TREE METADATA
 
-The source package name,
-target suite(s),
-and version number,
+The target suite(s),
 are obtained from
 F<debian/changelog>.
 
-The package and version must correspond to F<debian/control>,
-or it is an error.
-
 =head1 CONTENTS OF THE TREE
 
 The tree must be in the form of an unpacked Debian source package.