Revert source-bundle generation back to binary-only

dpkg-buildpackage -us -uc (without -b) requires the port to satisfy
3.0 (quilt) round-trip semantics — orig.tar + debian/patches must
reconstruct the working tree. SafeLibs ports do not satisfy that
contract (no upstream tarball, post-patch safe/ tree, and several
ports keep partial debian/patches/ that no longer round-trip). Pull
the template back to binary-only via -b.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: zardus

.github/workflows/ci-release.yml

@@ -83,54 +83,54 @@ jobs:
         id: artifact
         run: |
           set -euo pipefail
+          shopt -s nullglob
           mapfile -t debs < <(find dist -type f -name '*.deb' -print | sort)
           if (( ${#debs[@]} == 0 )); then
             printf 'No .deb files were produced under dist/.\n' >&2
             exit 1
           fi
-          mapfile -t all_files < <(find dist -type f -print | sort)
           {
-            printf 'count=%d\n' "${#all_files[@]}"
+            printf 'count=%d\n' "${#debs[@]}"
             printf 'paths<<EOF\n'
-            printf '%s\n' "${all_files[@]}"
+            printf '%s\n' "${debs[@]}"
             printf 'EOF\n'
           } >> "$GITHUB_OUTPUT"
-          printf 'Built %d artifact(s) (%d .deb):\n' "${#all_files[@]}" "${#debs[@]}"
-          printf '  %s\n' "${all_files[@]}"
+          printf 'Built %d .deb file(s):\n' "${#debs[@]}"
+          printf '  %s\n' "${debs[@]}"
 
       - name: Upload Debian artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: debs-${{ github.run_id }}
-          path: dist/*
+          path: dist/*.deb
           if-no-files-found: error
 
       - name: Publish build release
         if: github.event_name == 'push'
         env:
           GH_TOKEN: ${{ github.token }}
-          ARTIFACT_PATHS: ${{ steps.artifact.outputs.paths }}
+          DEB_PATHS: ${{ steps.artifact.outputs.paths }}
         run: |
           set -euo pipefail
 
           short_sha="${GITHUB_SHA:0:12}"
           tag="build-${short_sha}"
 
-          mapfile -t artifact_files <<< "$ARTIFACT_PATHS"
+          mapfile -t deb_files <<< "$DEB_PATHS"
 
           notes_file="$(mktemp)"
           {
             printf 'Commit SHA: %s\n\n' "$GITHUB_SHA"
-            printf 'Attached binary (.deb) and source (.dsc, .tar.*, .changes, .buildinfo) artifacts were produced by `scripts/build-debs.sh`.\n'
+            printf 'Attached .deb file(s) were produced by `scripts/build-debs.sh`.\n'
           } > "$notes_file"
 
           if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            gh release upload "$tag" "${artifact_files[@]}" --repo "$GITHUB_REPOSITORY" --clobber
+            gh release upload "$tag" "${deb_files[@]}" --repo "$GITHUB_REPOSITORY" --clobber
           else
-            gh release create "$tag" "${artifact_files[@]}" \
+            gh release create "$tag" "${deb_files[@]}" \
               --repo "$GITHUB_REPOSITORY" \
               --target "$GITHUB_SHA" \
-              --title "Safe library build for ${short_sha}" \
+              --title "Safe library debs for ${short_sha}" \
               --notes-file "$notes_file"
           fi
 

scripts/lib/build-deb-common.sh

@@ -11,10 +11,9 @@
 #                          run in a directory containing debian/changelog.
 #                          Honors $SAFELIBS_COMMIT_SHA when set.
 #   build_with_dpkg_buildpackage
-#                          Run mk-build-deps + dpkg-buildpackage -us -uc in
-#                          the current directory (full build: source + binary)
-#                          and copy the resulting .deb / .dsc / .tar.* /
-#                          .buildinfo / .changes files into $repo_root/dist.
+#                          Run mk-build-deps + dpkg-buildpackage -us -uc -b
+#                          (binary-only) in the current directory and copy
+#                          the resulting .deb files into $repo_root/dist.
 
 prepare_rust_env() {
   if [[ -f "$HOME/.cargo/env" ]]; then
@@ -77,56 +76,9 @@ stamp_safelibs_changelog() {
   mv debian/changelog.new debian/changelog
 }
 
-_synthesize_orig_tarball_if_needed() {
-  # SafeLibs ports don't carry an upstream orig.tar (the safe/ tree IS the
-  # source). For 3.0 (quilt) packages, dpkg-source -b refuses to build
-  # without one, so synthesize a deterministic orig.tar.xz from the safe/
-  # tree (excluding debian/ and build artifacts).
-  [[ -f debian/source/format ]] || return 0
-  grep -Fq '3.0 (quilt)' debian/source/format || return 0
-
-  local package upstream_version orig_tar
-  package="$(dpkg-parsechangelog -S Source)"
-  upstream_version="$(dpkg-parsechangelog -S Version | sed -E 's/-[^-]*$//')"
-  orig_tar="../${package}_${upstream_version}.orig.tar.xz"
-
-  [[ -f "$orig_tar" ]] && return 0
-
-  local stage
-  stage="$(mktemp -d)"
-  rsync -a \
-    --exclude='/debian' \
-    --exclude='/target' \
-    --exclude='/build' \
-    --exclude='/build-check' \
-    --exclude='/build-check-install' \
-    --exclude='/.git' \
-    ./ "$stage/${package}-${upstream_version}/"
-  tar --create --xz --file="$orig_tar" \
-    --sort=name --owner=0 --group=0 --numeric-owner \
-    --mtime='@0' \
-    -C "$stage" "${package}-${upstream_version}"
-  rm -rf "$stage"
-}
-
 build_with_dpkg_buildpackage() {
   local repo_root="$1"
   sudo mk-build-deps -i -r -t "apt-get -y --no-install-recommends" debian/control
-  _synthesize_orig_tarball_if_needed
-  dpkg-buildpackage -us -uc
-  shopt -s nullglob
-  local artifacts=(
-    ../*.deb
-    ../*.ddeb
-    ../*.dsc
-    ../*.tar.gz ../*.tar.xz ../*.tar.bz2 ../*.tar.zst
-    ../*.buildinfo
-    ../*.changes
-  )
-  shopt -u nullglob
-  if (( ${#artifacts[@]} == 0 )); then
-    printf 'build_with_dpkg_buildpackage: dpkg-buildpackage produced no artifacts\n' >&2
-    return 1
-  fi
-  cp -v "${artifacts[@]}" "$repo_root/dist"/
+  dpkg-buildpackage -us -uc -b
+  cp -v ../*.deb "$repo_root/dist"/
 }