dpkg-buildpackage: By default do not sign builds for UNRELEASED uploads

As these are not final builds, do not bother signing them. If the user,
for whatever reason still wants to sign them, they can use --force-sign
or debsign afterwards.

Closes: #635117

debian/changelog

@@ -21,6 +21,8 @@ dpkg (1.17.0) UNRELEASED; urgency=low
   * Add new dpkg-parsechangelog --show-field option to print a field value.
     Closes: #284664
   * Add new dpkg-buildpackage --force-sign option.
+  * By default do not sign builds for UNRELEASED uploads on dpkg-buildpackage.
+    Closes: #635117
 
  -- Guillem Jover <guillem@debian.org>  Fri, 03 Aug 2012 13:21:00 +0200
 

man/dpkg-buildpackage.1

@@ -57,14 +57,14 @@ case, or if \fB\-b\fP is specified), or \fBbuild\-arch\fP and
 \fBbinary\-indep\fP (if \fB\-A\fP is specified).
 .IP \fB6.\fP 3
 It calls \fBgpg\fP to sign the \fB.dsc\fP file (if any, unless
-\fB\-us\fP is specified).
+\fB\-us\fP is specified or on UNRELEASED builds).
 .IP \fB7.\fP 3
 It calls \fBdpkg\-genchanges\fP to generate a \fB.changes\fP file.
 Many \fBdpkg\-buildpackage\fP options are forwarded to
 \fBdpkg\-genchanges\fP.
 .IP \fB8.\fP 3
 It calls \fBgpg\fP to sign the \fB.changes\fP file (unless \fB\-uc\fP
-is specified).
+is specified or on UNRELEASED builds).
 .IP \fB9.\fP 3
 If \fB\-tc\fP is specified, it will call \fBfakeroot debian/rules clean\fP
 again. Finally it calls \fBdpkg\-source \-\-after\-build\fP.

scripts/dpkg-buildpackage.pl

@@ -116,6 +116,7 @@ my ($admindir, $signkey, $usepause, $noclean,
     $changedby, $desc, $parallel);
 my $checkbuilddep = 1;
 my $signforce = 0;
+my $signreleased = 1;
 my $signsource = 1;
 my $signchanges = 1;
 my $buildtarget = 'build';
@@ -289,6 +290,8 @@ my $version = mustsetvar($changelog->{version}, _g('source version'));
 my ($ok, $error) = version_check($version);
 error($error) unless $ok;
 
+my $distribution = mustsetvar($changelog->{distribution}, _g('source distribution'));
+
 my $maintainer;
 if ($changedby) {
     $maintainer = $changedby;
@@ -333,6 +336,10 @@ if (not $signcommand) {
 } elsif ($signforce) {
     $signsource = 1;
     $signchanges = 1;
+} elsif ($distribution eq 'UNRELEASED') {
+    $signreleased = 0;
+    $signsource = 0;
+    $signchanges = 0;
 }
 
 # Preparation of environment stops here
@@ -497,6 +504,9 @@ chdir('..') or syserr('chdir ..');
 withecho('dpkg-source', @source_opts, '--after-build', $dir);
 chdir($dir) or syserr("chdir $dir");
 
+if (not $signreleased) {
+    warning(_g('not signing UNRELEASED build; use --force-sign to override'));
+}
 print "$progname: $srcmsg\n";
 if ($signerrors) {
     warning($signerrors);