Hi, I added PGP checking test script. Then, I fixed bug in new PGP checking code and pushed it to the multitar branch.
HTTP site (pgpmode) For the basic single upstream tarball with the matching signature file not in the same file path case: version=4 opts="pgpmode=next" \ http://example.com/~user/release/foo.html \ files/(?:\d*)/foo-([\d\.]*).tar.gz debian opts="pgpmode=previous" \ http://example.com/~user/release/foo.html \ files/(?:\d+)/foo-([\d\.]*).tar.gz.asc previous uupdate Please note the upstream and signature files share the same version number. HTTP site (basic MUT) For the basic 2 upstream tarball case: version=4 http://example.com/~user/release/foo.html \ files/foo-([\d\.]*).tar.gz debian true opts=component=baz \ http://example.com/~user/release/foo.html \ files/baz-([\d\.]*).tar.gz same uupdate For the main upstream source package foo-2.0.tar.gz and the secondary upstream source package bar-2.0.tar.gz which installs under baz/, this watch file downloads and creates the Debian orig.tar file foo_2.0.orig.tar.gz and foo_2.0.orig-baz.tar.gz. As long as the tarball and signature file URL can be found on some web page as href, even if they can not be converted via pgpsigurlmangle approach, we can download the matching version pair and use them as above. Manpage needs more proofing but it seems program works as expected and it is tested. (I found typos etc...) Osamu