diff --git a/jobs/swh-docs.yaml b/jobs/swh-docs.yaml
--- a/jobs/swh-docs.yaml
+++ b/jobs/swh-docs.yaml
@@ -2,11 +2,12 @@
     name: DDOC
     display-name: swh-docs
     jobs:
-      - "{name}"
+      - "{name}/publish"
+      - "{name}/dev"
+      - "{name}/build-on-diff"
 
-
-- job:
-    name: DDOC/publish
+- job-template:
+    name: "{name}/publish"
     description: Build the documentation and publish it
     node: swh-sphinx
     auth-token: ph4br1cat0r
@@ -30,33 +31,32 @@
 
     publishers:
       - ssh:
-          target: 'devel'
-          site: 'pergamon'
+          target: "devel"
+          site: "pergamon"
           clean-remote: true
-          source: 'swh-docs/docs/_build/html/**'
-          remove-prefix: 'swh-docs/docs/_build/html'
+          source: "swh-docs/docs/_build/html/**"
+          remove-prefix: "swh-docs/docs/_build/html"
           fail-on-error: true
           verbose: true
       - ssh:
-          target: 'user'
-          site: 'pergamon'
+          target: "user"
+          site: "pergamon"
           clean-remote: true
-          source: 'swh-docs/user/_build/html/**'
-          remove-prefix: 'swh-docs/user/_build/html'
+          source: "swh-docs/user/_build/html/**"
+          remove-prefix: "swh-docs/user/_build/html"
           fail-on-error: true
           verbose: true
       - ssh:
-          target: 'sysadm'
-          site: 'pergamon'
+          target: "sysadm"
+          site: "pergamon"
           clean-remote: true
-          source: 'swh-docs/sysadm/_build/html/**'
-          remove-prefix: 'swh-docs/sysadm/_build/html'
+          source: "swh-docs/sysadm/_build/html/**"
+          remove-prefix: "swh-docs/sysadm/_build/html"
           fail-on-error: true
           verbose: true
 
-
-- job:
-    name: DDOC/dev
+- job-template:
+    name: "{name}/dev"
     description: Build the documentation from git repos
     node: swh-sphinx
     auth-token: ph4br1cat0r
@@ -83,20 +83,52 @@
       - archive:
           artifacts: "revisions.txt,swh-docs/docs/errors.log,swh-docs/.tox/log/*"
       - html-publisher:
-          name: 'SWH Documentation (HEAD)'
-          dir: 'swh-docs/docs/_build/html'
-          files: 'index.html'
+          name: "SWH Documentation (HEAD)"
+          dir: "swh-docs/docs/_build/html"
+          files: "index.html"
           keep-all: false
-          includes: '**/*'
+          includes: "**/*"
       - html-publisher:
-          name: 'SWH User Documentation (HEAD)'
-          dir: 'swh-docs/user/_build/html'
-          files: 'index.html'
+          name: "SWH User Documentation (HEAD)"
+          dir: "swh-docs/user/_build/html"
+          files: "index.html"
           keep-all: false
-          includes: '**/*'
+          includes: "**/*"
       - html-publisher:
-          name: 'SWH sysadmin Documentation (HEAD)'
-          dir: 'swh-docs/sysadm/_build/html'
-          files: 'index.html'
+          name: "SWH sysadmin Documentation (HEAD)"
+          dir: "swh-docs/sysadm/_build/html"
+          files: "index.html"
           keep-all: false
-          includes: '**/*'
+          includes: "**/*"
+
+- job-template:
+    name: "{name}/build-on-diff"
+    display_name: Phab. diff
+    project-type: pipeline
+    docker_image: sphinx
+    concurrent: true
+    sandbox: true
+    auth-token: "ph4br1cat0r"
+    properties:
+      - build-discarder:
+          artifact-num-to-keep: 20
+    parameters:
+      - git-parameter:
+          name: REVISION
+          type: PT_REVISION
+          defaultValue: master
+          description: Git revision to build.
+      - string:
+          name: PHID
+          description: PHID of the Phabricator target object on which results will be reported.
+      - string:
+          name: DIFF_ID
+          description: ID of the Diff patch to apply, if any
+      - string:
+          name: REV_ID
+          description: ID of the Phabricator revision, if any
+      - string:
+          name: STAGING_URI
+          description: URI of the staging repository
+
+    dsl: !include-jinja2: templates/swh-docs-pipeline-diff.groovy.j2
diff --git a/jobs/templates/includes/script-apply-phabricator-diff.groovy.j2 b/jobs/templates/includes/script-apply-phabricator-diff.groovy.j2
new file mode 100644
--- /dev/null
+++ b/jobs/templates/includes/script-apply-phabricator-diff.groovy.j2
@@ -0,0 +1,65 @@
+script {
+  comment = sh(
+    script: '''
+    #!/bin/bash
+    set -e
+
+    ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+    ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+    echo "==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ===="
+    echo
+    git tag -f ${ORIGINAL_TAG} >/dev/null
+    git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base >/dev/null
+    rebased=0
+    if git merge-base --is-ancestor diff-base HEAD; then
+        echo "**Rebasing** onto ${ORIGINAL_COMMIT}..."
+        echo
+        echo '```'
+        git rebase --onto ${ORIGINAL_TAG} diff-base diff-target && rebased=1 || rebase_exit=$?
+        echo '```'
+        if [ $rebased -eq 0 ]; then
+            echo
+            echo "Rebase failed (ret=${rebase_exit})!"
+            echo
+            echo '```'
+            git rebase --abort || true
+            echo '```'
+        fi
+    fi
+
+    merged=0
+    if [ $rebased -eq 0 ]; then
+        echo "Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}..."
+        echo
+        echo '```'
+        git merge --no-edit diff-target && merged=1 || merge_exit=$?
+        echo '```'
+        if [ $merged -eq 0 ]; then
+            echo
+            echo "Merge failed (ret=${merge_exit})!"
+            echo
+        fi
+    fi
+
+    if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+        echo
+        echo "===== Changes applied before test ====="
+        echo
+        echo '```'
+        git log ${ORIGINAL_TAG}..
+        echo '```'
+    else
+        echo '**Attempts to apply the diff failed!**'
+        exit 1
+    fi
+    git tag -d ${ORIGINAL_TAG} >/dev/null
+    ''',
+    label: 'Apply patch',
+    returnStdout: true,
+  )
+
+  writeFile(
+    file: '.phabricator-comment',
+    text: comment,
+  )
+}
diff --git a/jobs/templates/includes/stage-apply-phabricator-diff.groovy.j2 b/jobs/templates/includes/stage-apply-phabricator-diff.groovy.j2
deleted file mode 100644
--- a/jobs/templates/includes/stage-apply-phabricator-diff.groovy.j2
+++ /dev/null
@@ -1,69 +0,0 @@
-stage('Apply phabricator diff') {
-  steps {
-    script {
-      comment = sh(
-        script: '''
-        #!/bin/bash
-        set -e
-
-        ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
-        ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
-        echo "==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ===="
-        echo
-        git tag -f ${ORIGINAL_TAG} >/dev/null
-        git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base >/dev/null
-        rebased=0
-        if git merge-base --is-ancestor diff-base HEAD; then
-            echo "**Rebasing** onto ${ORIGINAL_COMMIT}..."
-            echo
-            echo '```'
-            git rebase --onto ${ORIGINAL_TAG} diff-base diff-target && rebased=1 || rebase_exit=$?
-            echo '```'
-            if [ $rebased -eq 0 ]; then
-                echo
-                echo "Rebase failed (ret=${rebase_exit})!"
-                echo
-                echo '```'
-                git rebase --abort || true
-                echo '```'
-            fi
-        fi
-
-        merged=0
-        if [ $rebased -eq 0 ]; then
-            echo "Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}..."
-            echo
-            echo '```'
-            git merge --no-edit diff-target && merged=1 || merge_exit=$?
-            echo '```'
-            if [ $merged -eq 0 ]; then
-                echo
-                echo "Merge failed (ret=${merge_exit})!"
-                echo
-            fi
-        fi
-
-        if [ $merged -eq 1 -o $rebased -eq 1 ]; then
-            echo
-            echo "===== Changes applied before test ====="
-            echo
-            echo '```'
-            git log ${ORIGINAL_TAG}..
-            echo '```'
-        else
-            echo '**Attempts to apply the diff failed!**'
-            exit 1
-        fi
-        git tag -d ${ORIGINAL_TAG} >/dev/null
-        ''',
-        label: 'Apply patch',
-        returnStdout: true,
-      )
-
-      writeFile(
-        file: '.phabricator-comment',
-        text: comment,
-      )
-    }
-  }
-}
diff --git a/jobs/templates/swh-docs-pipeline-diff.groovy.j2 b/jobs/templates/swh-docs-pipeline-diff.groovy.j2
new file mode 100644
--- /dev/null
+++ b/jobs/templates/swh-docs-pipeline-diff.groovy.j2
@@ -0,0 +1,116 @@
+pipeline {
+  {% filter indent(width=2) %}
+    {%- include 'templates/includes/agent-docker.groovy.j2' -%}
+  {% endfilter %}
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout swh environment') {
+      steps {
+        {% filter indent(width=8) %}
+          {%- include 'templates/includes/create-phabricator-artifacts.groovy.j2' -%}
+        {% endfilter %}
+        checkout([
+          $class: 'GitSCM',
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [[$class: 'CloneOption', depth: 1, shallow: true]],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-environment.git'],
+          ],
+        ])
+      }
+    }
+
+    stage('Checkout swh modules') {
+      steps {
+        script {
+          sh'''#!/bin/bash
+          crudini --del .mrconfig snippets
+          crudini --del .mrconfig swh-py-template
+          # force shallow clone of swh-repos except swh-docs
+          sed -i '/swh-docs/!s/git clone/git clone --depth 1/g' .mrconfig
+          mr -j 4 -t update
+          '''
+        }
+      }
+    }
+
+    stage('Apply phabricator diff') {
+      steps {
+        dir('swh-docs') {
+          {% filter indent(width=10) %}
+            {%- include 'templates/includes/script-apply-phabricator-diff.groovy.j2' -%}
+          {% endfilter %}
+        }
+      }
+    }
+
+    stage('Build Software Heritage documentation') {
+      steps {
+        dir('swh-docs') {
+          script {
+            sh '''#!/bin/bash
+            SPHINXOPTS='-W -q --keep-going -w errors.log' SPHINXOPTCOLOR='--no-color' tox -e sphinx-dev
+            '''
+          }
+        }
+      }
+    }
+  }
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: 'swh-docs/.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+
+      archiveArtifacts(
+        allowEmptyArchive: true,
+        artifacts: 'swh-docs/docs/errors.log,swh-docs/.tox/log/*',
+        fingerprint: true,
+      )
+
+      publishHTML (target: [
+        allowMissing: true,
+        alwaysLinkToLastBuild: false,
+        keepAll: true,
+        reportDir: 'swh-docs/docs/_build/html',
+        reportFiles: 'index.html',
+        reportName: 'SWH Documentation'
+      ])
+
+      publishHTML (target: [
+        allowMissing: true,
+        alwaysLinkToLastBuild: false,
+        keepAll: true,
+        reportDir: 'swh-docs/user/_build/html',
+        reportFiles: 'index.html',
+        reportName: 'SWH User Documentation'
+      ])
+
+      publishHTML (target: [
+        allowMissing: true,
+        alwaysLinkToLastBuild: false,
+        keepAll: true,
+        reportDir: 'swh-docs/sysadm/_build/html',
+        reportFiles: 'index.html',
+        reportName: 'SWH sysadmin Documentation'
+      ])
+    }
+    cleanup {
+      cleanWs()
+    }
+  }
+}
\ No newline at end of file
diff --git a/jobs/templates/swh-pipeline.groovy.j2 b/jobs/templates/swh-pipeline.groovy.j2
--- a/jobs/templates/swh-pipeline.groovy.j2
+++ b/jobs/templates/swh-pipeline.groovy.j2
@@ -29,9 +29,13 @@
     }
 
     {%- if phabricator_diff %}
-    {% filter indent(width=4) %}
-      {%- include 'includes/stage-apply-phabricator-diff.groovy.j2' -%}
-    {% endfilter %}
+    stage('Apply phabricator diff') {
+      steps {
+        {% filter indent(width=8) %}
+          {%- include 'includes/script-apply-phabricator-diff.groovy.j2' -%}
+        {% endfilter %}
+      }
+    }
     {%- endif %}
 
     stage('Static analysis') {
diff --git a/output b/output
new file mode 100644
--- /dev/null
+++ b/output
@@ -0,0 +1,67814 @@
+test installed: certifi==2021.10.8,charset-normalizer==2.0.7,fasteners==0.16.3,idna==3.3,jenkins-job-builder @ git+https://framagit.org/douardda/jenkins-job-builder@c89bf11ef3dffacf8f9e97b01bcc59e3fcf6f655,Jinja2==3.0.2,MarkupSafe==2.0.1,multi-key-dict==2.0.3,pbr==5.6.0,python-jenkins==1.7.0,PyYAML==5.4.1,requests==2.26.0,six==1.16.0,stevedore==3.4.0,urllib3==1.26.7
+test run-test-pre: PYTHONHASHSEED='3378718169'
+test run-test: commands[0] | jenkins-jobs test -r jobs
+WARNING:jenkins_jobs.config:Config file, /etc/jenkins_jobs/jenkins_jobs.ini, not found. Using default config values.
+INFO:jenkins_jobs.config:Will use anonymous access to Jenkins if needed.
+WARNING:jenkins_jobs.cli.subcommand.test:(Deprecated) The default output behavior of `jenkins-jobs test` when given the --output flag will change in JJB 3.0. Instead of writing jobs to OUTPUT/jobname; they will be written to OUTPUT/jobname/config.xml. The new behavior can be enabled by the passing `--config-xml` parameter.
+INFO:jenkins_jobs.cli.subcommand.update:Updating jobs in ['/home/anlambert/swh/swh-jenkins-jobs/jobs', '/home/anlambert/swh/swh-jenkins-jobs/jobs/debian', '/home/anlambert/swh/swh-jenkins-jobs/jobs/templates', '/home/anlambert/swh/swh-jenkins-jobs/jobs/tools', '/home/anlambert/swh/swh-jenkins-jobs/jobs/templates/debian', '/home/anlambert/swh/swh-jenkins-jobs/jobs/templates/includes'] ([])
+INFO:root:Caching type scm of scm = jenkins_jobs.modules.scm:SCM
+INFO:root:Caching type triggers of triggers = jenkins_jobs.modules.triggers:Triggers
+INFO:root:Caching type builders of builders = jenkins_jobs.modules.builders:Builders
+INFO:root:Caching type publishers of publishers = jenkins_jobs.modules.publishers:Publishers
+INFO:root:Caching type wrappers of wrappers = jenkins_jobs.modules.wrappers:Wrappers
+INFO:root:Caching type properties of properties = jenkins_jobs.modules.properties:Properties
+INFO:root:Caching type parameters of parameters = jenkins_jobs.modules.parameters:Parameters
+INFO:jenkins_jobs.builder:Number of jobs generated:  370
+INFO:jenkins_jobs.builder:Job name:  DAUTH
+INFO:jenkins_jobs.builder:Job name:  DAUTH/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-auth</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DAUTH/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-auth.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-auth',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DAUTH/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DAUTH/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DAUTH/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DAUTH/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DAUTH/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DAUTH/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-auth'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DAUTH/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-auth.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DAUTH/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-auth.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DAUTH']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DAUTH/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-auth.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DAUTH']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DCIDX
+INFO:jenkins_jobs.builder:Job name:  DCIDX/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-indexer</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DCIDX/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-indexer.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-indexer',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DCIDX/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DCIDX/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DCIDX/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DCIDX/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DCIDX/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DCIDX/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-indexer'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DCIDX/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-indexer.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DCIDX/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-indexer.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DCIDX']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DCIDX/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-indexer.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DCIDX']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DCNT
+INFO:jenkins_jobs.builder:Job name:  DCNT/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-counters</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DCNT/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-counters.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-counters',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DCNT/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DCNT/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DCNT/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DCNT/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DCNT/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DCNT/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-counters'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DCNT/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-counters.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DCNT/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-counters.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DCNT']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DCNT/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-counters.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DCNT']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DCORE
+INFO:jenkins_jobs.builder:Job name:  DCORE/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-core</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DCORE/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-core.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-core',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DCORE/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DCORE/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DCORE/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DCORE/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DCORE/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DCORE/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-core'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DCORE/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-core.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DCORE/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-core.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DCORE']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DCORE/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-core.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DCORE']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DDATASET
+INFO:jenkins_jobs.builder:Job name:  DDATASET/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-dataset</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DDATASET/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-dataset.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-dataset',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DDATASET/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DDATASET/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DDATASET/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DDATASET/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DDATASET/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DDATASET/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-dataset'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DDATASET/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-dataset.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DDATASET/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-dataset.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DDATASET']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DDATASET/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-dataset.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DDATASET']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DDEP
+INFO:jenkins_jobs.builder:Job name:  DDEP/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-deposit</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DDEP/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-deposit.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-deposit',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DDEP/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DDEP/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DDEP/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DDEP/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DDEP/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DDEP/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-deposit'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DDEP/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-deposit.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DDEP/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-deposit.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DDEP']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DDEP/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-deposit.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DDEP']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DDOC/build-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/sphinx'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout swh environment') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [[$class: 'CloneOption', depth: 1, shallow: true]],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-environment.git'],
+          ],
+        ])
+      }
+    }
+
+    stage('Checkout swh modules') {
+      steps {
+        script {
+          sh'''#!/bin/bash
+          crudini --del .mrconfig snippets
+          crudini --del .mrconfig swh-py-template
+          # force shallow clone of swh-repos except swh-docs
+          sed -i '/swh-docs/!s/git clone/git clone --depth 1/g' .mrconfig
+          mr -j 4 -t update
+          '''
+        }
+      }
+    }
+
+    stage('Apply phabricator diff') {
+      steps {
+        dir('swh-docs') {
+          script {
+            comment = sh(
+              script: '''
+              #!/bin/bash
+              set -e
+
+              ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+              ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+              echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+              echo
+              git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+              git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+              rebased=0
+              if git merge-base --is-ancestor diff-base HEAD; then
+                  echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                  echo
+                  echo '```'
+                  git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                  echo '```'
+                  if [ $rebased -eq 0 ]; then
+                      echo
+                      echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                      echo
+                      echo '```'
+                      git rebase --abort || true
+                      echo '```'
+                  fi
+              fi
+
+              merged=0
+              if [ $rebased -eq 0 ]; then
+                  echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                  echo
+                  echo '```'
+                  git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                  echo '```'
+                  if [ $merged -eq 0 ]; then
+                      echo
+                      echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                      echo
+                  fi
+              fi
+
+              if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                  echo
+                  echo &quot;===== Changes applied before test =====&quot;
+                  echo
+                  echo '```'
+                  git log ${ORIGINAL_TAG}..
+                  echo '```'
+              else
+                  echo '**Attempts to apply the diff failed!**'
+                  exit 1
+              fi
+              git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+              ''',
+              label: 'Apply patch',
+              returnStdout: true,
+            )
+
+            writeFile(
+              file: '.phabricator-comment',
+              text: comment,
+            )
+          }
+        }
+      }
+    }
+
+    stage('Build Software Heritage documentation') {
+      steps {
+        dir('swh-docs') {
+          script {
+            sh '''#!/bin/bash
+            SPHINXOPTS='-W -q --keep-going -w errors.log' SPHINXOPTCOLOR='--no-color' tox -e sphinx-dev
+            '''
+          }
+        }
+      }
+    }
+  }
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: 'swh-docs/.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+
+      archiveArtifacts(
+        allowEmptyArchive: true,
+        artifacts: 'swh-docs/docs/errors.log,swh-docs/.tox/log/*',
+        fingerprint: true,
+      )
+
+      publishHTML (target: [
+        allowMissing: true,
+        alwaysLinkToLastBuild: false,
+        keepAll: true,
+        reportDir: 'swh-docs/docs/_build/html',
+        reportFiles: 'index.html',
+        reportName: &quot;SWH Documentation&quot;
+      ])
+
+      publishHTML (target: [
+        allowMissing: true,
+        alwaysLinkToLastBuild: false,
+        keepAll: true,
+        reportDir: 'swh-docs/user/_build/html',
+        reportFiles: 'index.html',
+        reportName: &quot;SWH User Documentation&quot;
+      ])
+
+      publishHTML (target: [
+        allowMissing: true,
+        alwaysLinkToLastBuild: false,
+        keepAll: true,
+        reportDir: 'swh-docs/sysadm/_build/html',
+        reportFiles: 'index.html',
+        reportName: &quot;SWH sysadmin Documentation&quot;
+      ])
+    }
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DDOC/dev
+<?xml version="1.0" encoding="utf-8"?>
+<project>
+  <actions/>
+  <description>Build the documentation from git repos&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <assignedNode>swh-sphinx</assignedNode>
+  <canRoam>false</canRoam>
+  <properties/>
+  <scm class="hudson.plugins.git.GitSCM">
+    <configVersion>2</configVersion>
+    <userRemoteConfigs>
+      <hudson.plugins.git.UserRemoteConfig>
+        <name>origin</name>
+        <refspec>+refs/heads/*:refs/remotes/origin/*</refspec>
+        <url>https://forge.softwareheritage.org/source/swh-environment.git</url>
+      </hudson.plugins.git.UserRemoteConfig>
+    </userRemoteConfigs>
+    <branches>
+      <hudson.plugins.git.BranchSpec>
+        <name>**</name>
+      </hudson.plugins.git.BranchSpec>
+    </branches>
+    <disableSubmodules>false</disableSubmodules>
+    <recursiveSubmodules>false</recursiveSubmodules>
+    <doGenerateSubmoduleConfigurations>false</doGenerateSubmoduleConfigurations>
+    <remotePoll>false</remotePoll>
+    <gitTool>Default</gitTool>
+    <submoduleCfg class="list"/>
+    <reference/>
+    <gitConfigName/>
+    <gitConfigEmail/>
+    <extensions>
+      <hudson.plugins.git.extensions.impl.WipeWorkspace/>
+    </extensions>
+  </scm>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>H 9-22/2 * * *</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>#!/bin/bash
+crudini --del .mrconfig snippets
+crudini --del .mrconfig swh-py-template
+mr -j 4 -t update
+mr -t run sh -c 'echo -n &quot;`basename $PWD` &quot; &amp;&amp; git describe' | grep -v 'mr run' &gt; revisions.txt
+cd swh-docs
+git clean -dfx
+SPHINXOPTS='-W -q --keep-going -w errors.log' SPHINXOPTCOLOR='--no-color' tox -e sphinx-dev
+</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers>
+    <hudson.tasks.ArtifactArchiver>
+      <artifacts>revisions.txt,swh-docs/docs/errors.log,swh-docs/.tox/log/*</artifacts>
+      <allowEmptyArchive>false</allowEmptyArchive>
+      <onlyIfSuccessful>false</onlyIfSuccessful>
+      <fingerprint>false</fingerprint>
+      <defaultExcludes>true</defaultExcludes>
+      <caseSensitive>true</caseSensitive>
+      <latestOnly>false</latestOnly>
+    </hudson.tasks.ArtifactArchiver>
+    <htmlpublisher.HtmlPublisher>
+      <reportTargets>
+        <htmlpublisher.HtmlPublisherTarget>
+          <reportName>SWH Documentation (HEAD)</reportName>
+          <reportDir>swh-docs/docs/_build/html</reportDir>
+          <reportFiles>index.html</reportFiles>
+          <alwaysLinkToLastBuild>false</alwaysLinkToLastBuild>
+          <keepAll>false</keepAll>
+          <allowMissing>false</allowMissing>
+          <wrapperName>htmlpublisher-wrapper.html</wrapperName>
+        </htmlpublisher.HtmlPublisherTarget>
+      </reportTargets>
+    </htmlpublisher.HtmlPublisher>
+    <htmlpublisher.HtmlPublisher>
+      <reportTargets>
+        <htmlpublisher.HtmlPublisherTarget>
+          <reportName>SWH User Documentation (HEAD)</reportName>
+          <reportDir>swh-docs/user/_build/html</reportDir>
+          <reportFiles>index.html</reportFiles>
+          <alwaysLinkToLastBuild>false</alwaysLinkToLastBuild>
+          <keepAll>false</keepAll>
+          <allowMissing>false</allowMissing>
+          <wrapperName>htmlpublisher-wrapper.html</wrapperName>
+        </htmlpublisher.HtmlPublisherTarget>
+      </reportTargets>
+    </htmlpublisher.HtmlPublisher>
+    <htmlpublisher.HtmlPublisher>
+      <reportTargets>
+        <htmlpublisher.HtmlPublisherTarget>
+          <reportName>SWH sysadmin Documentation (HEAD)</reportName>
+          <reportDir>swh-docs/sysadm/_build/html</reportDir>
+          <reportFiles>index.html</reportFiles>
+          <alwaysLinkToLastBuild>false</alwaysLinkToLastBuild>
+          <keepAll>false</keepAll>
+          <allowMissing>false</allowMissing>
+          <wrapperName>htmlpublisher-wrapper.html</wrapperName>
+        </htmlpublisher.HtmlPublisherTarget>
+      </reportTargets>
+    </htmlpublisher.HtmlPublisher>
+  </publishers>
+  <buildWrappers/>
+</project>
+INFO:jenkins_jobs.builder:Job name:  DDOC/publish
+<?xml version="1.0" encoding="utf-8"?>
+<project>
+  <actions/>
+  <description>Build the documentation and publish it&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <assignedNode>swh-sphinx</assignedNode>
+  <canRoam>false</canRoam>
+  <properties/>
+  <scm class="hudson.plugins.git.GitSCM">
+    <configVersion>2</configVersion>
+    <userRemoteConfigs>
+      <hudson.plugins.git.UserRemoteConfig>
+        <name>origin</name>
+        <refspec>+refs/heads/*:refs/remotes/origin/*</refspec>
+        <url>https://forge.softwareheritage.org/source/swh-environment.git</url>
+      </hudson.plugins.git.UserRemoteConfig>
+    </userRemoteConfigs>
+    <branches>
+      <hudson.plugins.git.BranchSpec>
+        <name>**</name>
+      </hudson.plugins.git.BranchSpec>
+    </branches>
+    <disableSubmodules>false</disableSubmodules>
+    <recursiveSubmodules>false</recursiveSubmodules>
+    <doGenerateSubmoduleConfigurations>false</doGenerateSubmoduleConfigurations>
+    <remotePoll>false</remotePoll>
+    <gitTool>Default</gitTool>
+    <submoduleCfg class="list"/>
+    <reference/>
+    <gitConfigName/>
+    <gitConfigEmail/>
+    <extensions>
+      <hudson.plugins.git.extensions.impl.WipeWorkspace/>
+    </extensions>
+  </scm>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@midnight</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>#!/bin/bash
+mr -j 4 -t update
+mr -j 4 -t run sh -c 'git checkout --detach `git describe --abbrev=0 --tags`; git clean -dfx'
+cd swh-docs
+git checkout master
+git clean -dfx
+SPHINXOPTCOLOR='--no-color' tox -e sphinx
+</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers>
+    <jenkins.plugins.publish__over__ssh.BapSshPublisherPlugin>
+      <consolePrefix>SSH: </consolePrefix>
+      <delegate>
+        <publishers>
+          <jenkins.plugins.publish__over__ssh.BapSshPublisher>
+            <configName>pergamon</configName>
+            <verbose>true</verbose>
+            <transfers>
+              <jenkins.plugins.publish__over__ssh.BapSshTransfer>
+                <remoteDirectory>devel</remoteDirectory>
+                <sourceFiles>swh-docs/docs/_build/html/**</sourceFiles>
+                <excludes/>
+                <removePrefix>swh-docs/docs/_build/html</removePrefix>
+                <remoteDirectorySDF>false</remoteDirectorySDF>
+                <flatten>false</flatten>
+                <cleanRemote>true</cleanRemote>
+              </jenkins.plugins.publish__over__ssh.BapSshTransfer>
+            </transfers>
+            <useWorkspaceInPromotion>false</useWorkspaceInPromotion>
+            <usePromotionTimestamp>false</usePromotionTimestamp>
+          </jenkins.plugins.publish__over__ssh.BapSshPublisher>
+        </publishers>
+        <continueOnError>false</continueOnError>
+        <failOnError>true</failOnError>
+        <alwaysPublishFromMaster>false</alwaysPublishFromMaster>
+        <hostConfigurationAccess class="jenkins.plugins.publish_over_ssh.BapSshPublisherPlugin" reference="../.."/>
+      </delegate>
+    </jenkins.plugins.publish__over__ssh.BapSshPublisherPlugin>
+    <jenkins.plugins.publish__over__ssh.BapSshPublisherPlugin>
+      <consolePrefix>SSH: </consolePrefix>
+      <delegate>
+        <publishers>
+          <jenkins.plugins.publish__over__ssh.BapSshPublisher>
+            <configName>pergamon</configName>
+            <verbose>true</verbose>
+            <transfers>
+              <jenkins.plugins.publish__over__ssh.BapSshTransfer>
+                <remoteDirectory>user</remoteDirectory>
+                <sourceFiles>swh-docs/user/_build/html/**</sourceFiles>
+                <excludes/>
+                <removePrefix>swh-docs/user/_build/html</removePrefix>
+                <remoteDirectorySDF>false</remoteDirectorySDF>
+                <flatten>false</flatten>
+                <cleanRemote>true</cleanRemote>
+              </jenkins.plugins.publish__over__ssh.BapSshTransfer>
+            </transfers>
+            <useWorkspaceInPromotion>false</useWorkspaceInPromotion>
+            <usePromotionTimestamp>false</usePromotionTimestamp>
+          </jenkins.plugins.publish__over__ssh.BapSshPublisher>
+        </publishers>
+        <continueOnError>false</continueOnError>
+        <failOnError>true</failOnError>
+        <alwaysPublishFromMaster>false</alwaysPublishFromMaster>
+        <hostConfigurationAccess class="jenkins.plugins.publish_over_ssh.BapSshPublisherPlugin" reference="../.."/>
+      </delegate>
+    </jenkins.plugins.publish__over__ssh.BapSshPublisherPlugin>
+    <jenkins.plugins.publish__over__ssh.BapSshPublisherPlugin>
+      <consolePrefix>SSH: </consolePrefix>
+      <delegate>
+        <publishers>
+          <jenkins.plugins.publish__over__ssh.BapSshPublisher>
+            <configName>pergamon</configName>
+            <verbose>true</verbose>
+            <transfers>
+              <jenkins.plugins.publish__over__ssh.BapSshTransfer>
+                <remoteDirectory>sysadm</remoteDirectory>
+                <sourceFiles>swh-docs/sysadm/_build/html/**</sourceFiles>
+                <excludes/>
+                <removePrefix>swh-docs/sysadm/_build/html</removePrefix>
+                <remoteDirectorySDF>false</remoteDirectorySDF>
+                <flatten>false</flatten>
+                <cleanRemote>true</cleanRemote>
+              </jenkins.plugins.publish__over__ssh.BapSshTransfer>
+            </transfers>
+            <useWorkspaceInPromotion>false</useWorkspaceInPromotion>
+            <usePromotionTimestamp>false</usePromotionTimestamp>
+          </jenkins.plugins.publish__over__ssh.BapSshPublisher>
+        </publishers>
+        <continueOnError>false</continueOnError>
+        <failOnError>true</failOnError>
+        <alwaysPublishFromMaster>false</alwaysPublishFromMaster>
+        <hostConfigurationAccess class="jenkins.plugins.publish_over_ssh.BapSshPublisherPlugin" reference="../.."/>
+      </delegate>
+    </jenkins.plugins.publish__over__ssh.BapSshPublisherPlugin>
+  </publishers>
+  <buildWrappers/>
+</project>
+INFO:jenkins_jobs.builder:Job name:  DENV
+INFO:jenkins_jobs.builder:Job name:  DENV/tests
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-environment</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DFUSE
+<?xml version="1.0" encoding="utf-8"?>
+<project>
+  <actions/>
+  <description>Run tests for each swh module in development version&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <assignedNode>swh-sphinx</assignedNode>
+  <canRoam>false</canRoam>
+  <properties/>
+  <scm class="hudson.plugins.git.GitSCM">
+    <configVersion>2</configVersion>
+    <userRemoteConfigs>
+      <hudson.plugins.git.UserRemoteConfig>
+        <name>origin</name>
+        <refspec>+refs/heads/*:refs/remotes/origin/*</refspec>
+        <url>https://forge.softwareheritage.org/source/swh-environment.git</url>
+      </hudson.plugins.git.UserRemoteConfig>
+    </userRemoteConfigs>
+    <branches>
+      <hudson.plugins.git.BranchSpec>
+        <name>*/master</name>
+      </hudson.plugins.git.BranchSpec>
+    </branches>
+    <disableSubmodules>false</disableSubmodules>
+    <recursiveSubmodules>false</recursiveSubmodules>
+    <doGenerateSubmoduleConfigurations>false</doGenerateSubmoduleConfigurations>
+    <remotePoll>false</remotePoll>
+    <gitTool>Default</gitTool>
+    <submoduleCfg class="list"/>
+    <reference/>
+    <gitConfigName/>
+    <gitConfigEmail/>
+    <extensions>
+      <hudson.plugins.git.extensions.impl.WipeWorkspace/>
+    </extensions>
+  </scm>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>H */6 * * *</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>#!/bin/bash
+# fetch swh repositories
+mr -j 4 -t update
+# setup a virtualenv
+python3 -m venv .venv
+. .venv/bin/activate
+# upgrade pip as default installed version is too outdated to properly
+# install all swh dependencies but pin temporarily version to &lt;21.3
+# in order to workaround https://github.com/pypa/pip/issues/10573
+pip install --upgrade 'pip&lt;21.3'
+# install dependencies
+./bin/install
+cd swh-graph
+make java &gt;/dev/null
+cd ..
+# execute tests in each swh module
+exit_code=0
+for module in $(./bin/ls-py-modules)
+do
+    cd $module
+    tests_dir=$(echo $module | sed 's/-/\//g')/tests
+    if [ -d &quot;$tests_dir&quot; ]
+    then
+      # pipe tests output to stdout and log file
+      make test 2&gt;&amp;1 | tee ../$module.log
+      tests_status=${PIPESTATUS[0]}
+      # remove log file if tests succeeded
+      if [[ &quot;$tests_status&quot; == &quot;0&quot; ]]
+      then
+        rm -f ../$module.log
+      fi
+      # script must be exited with error when a test suite failed
+      exit_code=$(( tests_status &gt; exit_code ? tests_status : exit_code ))
+    fi
+    cd ..
+done
+
+exit $exit_code
+</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers>
+    <hudson.tasks.ArtifactArchiver>
+      <artifacts>*.log</artifacts>
+      <allowEmptyArchive>true</allowEmptyArchive>
+      <onlyIfSuccessful>false</onlyIfSuccessful>
+      <fingerprint>false</fingerprint>
+      <defaultExcludes>true</defaultExcludes>
+      <caseSensitive>true</caseSensitive>
+      <latestOnly>false</latestOnly>
+    </hudson.tasks.ArtifactArchiver>
+  </publishers>
+  <buildWrappers>
+    <hudson.plugins.build__timeout.BuildTimeoutWrapper>
+      <strategy class="hudson.plugins.build_timeout.impl.AbsoluteTimeOutStrategy">
+        <timeoutMinutes>90</timeoutMinutes>
+      </strategy>
+      <operationList>
+        <hudson.plugins.build__timeout.operations.AbortOperation/>
+      </operationList>
+    </hudson.plugins.build__timeout.BuildTimeoutWrapper>
+    <hudson.plugins.timestamper.TimestamperBuildWrapper/>
+  </buildWrappers>
+</project>
+INFO:jenkins_jobs.builder:Job name:  DFUSE/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-fuse</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DFUSE/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-fuse.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-fuse',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DFUSE/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DFUSE/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DFUSE/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DFUSE/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DFUSE/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DFUSE/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-fuse'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache --privileged --device /dev/fuse'
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DFUSE/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-fuse.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DFUSE/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache --privileged --device /dev/fuse'
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-fuse.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DFUSE']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DFUSE/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache --privileged --device /dev/fuse'
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-fuse.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DFUSE']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DGRPH
+INFO:jenkins_jobs.builder:Job name:  DGRPH/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-graph</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DGRPH/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-graph.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-graph',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DGRPH/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DGRPH/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DGRPH/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DGRPH/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DGRPH/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DGRPH/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-graph'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DGRPH/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-graph.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DGRPH/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-graph.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DGRPH']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DGRPH/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-graph.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DGRPH']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DICP
+INFO:jenkins_jobs.builder:Job name:  DICP/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-icinga-plugins</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DICP/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-icinga-plugins.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-icinga-plugins',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DICP/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DICP/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DICP/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DICP/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DICP/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DICP/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-icinga-plugins'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DICP/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-icinga-plugins.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DICP/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-icinga-plugins.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DICP']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DICP/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-icinga-plugins.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DICP']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DJNL
+INFO:jenkins_jobs.builder:Job name:  DJNL/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-journal</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DJNL/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-journal.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-journal',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DJNL/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DJNL/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DJNL/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DJNL/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DJNL/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DJNL/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-journal'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/kafka'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DJNL/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-journal.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DJNL/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/kafka'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-journal.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DJNL']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DJNL/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/kafka'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-journal.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DJNL']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDBASE
+INFO:jenkins_jobs.builder:Job name:  DLDBASE/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-core</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DLDBASE/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-loader-core.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-loader-core',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DLDBASE/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DLDBASE/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DLDBASE/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDBASE/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DLDBASE/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDBASE/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-loader-core'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DLDBASE/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-loader-core.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDBASE/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-core.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDBASE']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDBASE/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-core.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDBASE']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDBZR
+INFO:jenkins_jobs.builder:Job name:  DLDBZR/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-bzr</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DLDBZR/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-loader-bzr.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-loader-bzr',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DLDBZR/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DLDBZR/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DLDBZR/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDBZR/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DLDBZR/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDBZR/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-loader-bzr'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DLDBZR/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-loader-bzr.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDBZR/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-bzr.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDBZR']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDBZR/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-bzr.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDBZR']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDCVS
+INFO:jenkins_jobs.builder:Job name:  DLDCVS/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-cvs</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DLDCVS/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-loader-cvs.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-loader-cvs',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DLDCVS/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DLDCVS/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DLDCVS/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDCVS/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DLDCVS/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDCVS/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-loader-cvs'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DLDCVS/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-loader-cvs.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDCVS/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-cvs.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDCVS']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDCVS/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-cvs.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDCVS']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDG
+INFO:jenkins_jobs.builder:Job name:  DLDG/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-git</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DLDG/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-loader-git.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-loader-git',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DLDG/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DLDG/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DLDG/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDG/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DLDG/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDG/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-loader-git'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DLDG/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-loader-git.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDG/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-git.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDG']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDG/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-git.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDG']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDHG
+INFO:jenkins_jobs.builder:Job name:  DLDHG/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-mercurial</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DLDHG/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-loader-mercurial.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-loader-mercurial',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DLDHG/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DLDHG/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DLDHG/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDHG/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DLDHG/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDHG/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-loader-mercurial'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DLDHG/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-loader-mercurial.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDHG/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-mercurial.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDHG']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDHG/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-mercurial.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDHG']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDSVN
+INFO:jenkins_jobs.builder:Job name:  DLDSVN/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-svn</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DLDSVN/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-loader-svn.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-loader-svn',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DLDSVN/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DLDSVN/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DLDSVN/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDSVN/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DLDSVN/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLDSVN/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-loader-svn'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DLDSVN/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-loader-svn.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDSVN/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-svn.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDSVN']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLDSVN/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-loader-svn.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLDSVN']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLS
+INFO:jenkins_jobs.builder:Job name:  DLS/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-lister</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DLS/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-lister.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-lister',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DLS/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DLS/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DLS/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLS/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DLS/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DLS/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-lister'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DLS/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-lister.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLS/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-lister.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLS']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DLS/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-lister.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DLS']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DMFCD
+INFO:jenkins_jobs.builder:Job name:  DMFCD/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-clearlydefined</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DMFCD/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-clearlydefined.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-clearlydefined',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DMFCD/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DMFCD/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DMFCD/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DMFCD/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DMFCD/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DMFCD/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-clearlydefined'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DMFCD/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-clearlydefined.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DMFCD/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-clearlydefined.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DMFCD']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DMFCD/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-clearlydefined.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DMFCD']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DMOD
+INFO:jenkins_jobs.builder:Job name:  DMOD/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-model</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DMOD/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-model.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-model',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DMOD/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DMOD/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DMOD/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DMOD/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DMOD/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DMOD/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-model'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DMOD/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-model.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DMOD/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-model.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DMOD']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DMOD/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-model.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DMOD']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DOBJS
+INFO:jenkins_jobs.builder:Job name:  DOBJS/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-objstorage</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DOBJS/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-objstorage.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-objstorage',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DOBJS/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DOBJS/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DOBJS/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DOBJS/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DOBJS/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DOBJS/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-objstorage'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DOBJS/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-objstorage.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DOBJS/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-objstorage.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DOBJS']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DOBJS/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-objstorage.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DOBJS']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DOBJSRPL
+INFO:jenkins_jobs.builder:Job name:  DOBJSRPL/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-objstorage-replayer</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DOBJSRPL/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-objstorage-replayer.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-objstorage-replayer',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DOBJSRPL/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DOBJSRPL/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DOBJSRPL/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DOBJSRPL/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DOBJSRPL/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DOBJSRPL/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-objstorage-replayer'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DOBJSRPL/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-objstorage-replayer.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DOBJSRPL/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-objstorage-replayer.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DOBJSRPL']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DOBJSRPL/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-objstorage-replayer.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DOBJSRPL']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DOPH
+INFO:jenkins_jobs.builder:Job name:  DOPH/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-perfecthash</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DOPH/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-perfecthash.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-perfecthash',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DOPH/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DOPH/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DOPH/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DOPH/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DOPH/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DOPH/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-perfecthash'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DOPH/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-perfecthash.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DOPH/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-perfecthash.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DOPH']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DOPH/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-perfecthash.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DOPH']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DPROV
+INFO:jenkins_jobs.builder:Job name:  DPROV/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-provenance</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DPROV/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-provenance.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-provenance',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DPROV/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DPROV/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DPROV/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DPROV/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DPROV/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DPROV/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-provenance'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DPROV/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-provenance.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DPROV/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-provenance.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DPROV']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DPROV/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-provenance.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DPROV']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DSCH
+INFO:jenkins_jobs.builder:Job name:  DSCH/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-scheduler</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DSCH/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-scheduler.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-scheduler',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DSCH/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DSCH/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DSCH/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DSCH/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DSCH/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DSCH/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-scheduler'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DSCH/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-scheduler.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DSCH/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-scheduler.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DSCH']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DSCH/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-scheduler.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DSCH']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DSEA
+INFO:jenkins_jobs.builder:Job name:  DSEA/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-search</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DSEA/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-search.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-search',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DSEA/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DSEA/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DSEA/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DSEA/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DSEA/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DSEA/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-search'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DSEA/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-search.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DSEA/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-search.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DSEA']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DSEA/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-search.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DSEA']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DSTO
+INFO:jenkins_jobs.builder:Job name:  DSTO/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-storage</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DSTO/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-storage.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-storage',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DSTO/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DSTO/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DSTO/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DSTO/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DSTO/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DSTO/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-storage'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DSTO/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-storage.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DSTO/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-storage.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DSTO']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DSTO/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-storage.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DSTO']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DTPL
+INFO:jenkins_jobs.builder:Job name:  DTPL/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-py-template</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DTPL/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-py-template.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-py-template',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DTPL/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DTPL/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DTPL/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DTPL/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DTPL/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DTPL/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-py-template'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DTPL/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-py-template.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DTPL/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-py-template.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DTPL']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DTPL/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-py-template.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DTPL']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DTSCN
+INFO:jenkins_jobs.builder:Job name:  DTSCN/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-scanner</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DTSCN/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-scanner.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-scanner',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DTSCN/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DTSCN/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DTSCN/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DTSCN/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DTSCN/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DTSCN/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-scanner'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DTSCN/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-scanner.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DTSCN/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-scanner.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DTSCN']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DTSCN/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-scanner.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DTSCN']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DVAU
+INFO:jenkins_jobs.builder:Job name:  DVAU/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-vault</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DVAU/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-vault.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-vault',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DVAU/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DVAU/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DVAU/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DVAU/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DVAU/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DVAU/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-vault'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DVAU/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-vault.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DVAU/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-vault.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DVAU']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DVAU/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-vault.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DVAU']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DWAPPS
+INFO:jenkins_jobs.builder:Job name:  DWAPPS/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-web</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DWAPPS/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-web.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-web',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DWAPPS/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DWAPPS/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DWAPPS/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DWAPPS/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DWAPPS/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DWAPPS/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-web'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DWAPPS/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-web.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DWAPPS/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-web.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DWAPPS']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+        stage('Cypress tests') {
+          agent {
+            docker {
+              reuseNode true
+              image 'swh-jenkins/cypress'
+              args '--ipc=host --shm-size 1024M --tmpfs /tmp:exec --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+            }
+          }
+
+          stages {
+            stage ('Setup cypress environment') {
+              steps {
+                sh '''
+                  python3 -m pip install --no-use-pep517 --user -e .[testing]
+                  yarn install --frozen-lockfile
+                  yarn build-test
+                '''
+              }
+            }
+
+            stage ('Run cypress tests') {
+              steps {
+                sh '''#!/bin/bash
+                  export PYTHONPATH=$PWD
+                  python3 swh/web/manage.py migrate --settings=swh.web.settings.tests
+                  python3 swh/web/manage.py createcachetable --settings=swh.web.settings.tests
+                  for create_users_script in swh/web/tests/create_test_*
+                  do
+                    cat $create_users_script | python3 swh/web/manage.py shell --settings=swh.web.settings.tests
+                  done
+                  python3 swh/web/manage.py runserver --nostatic --settings=swh.web.settings.tests &amp;
+                  wait-for-it localhost:5004
+                  yarn run cypress run --config numTestsKeptInMemory=0
+                '''
+              }
+              post {
+                always {
+                  junit(
+                    allowEmptyResults: true,
+                    testResults: 'cypress/junit/results/*.xml',
+                  )
+
+                  sh '''
+                    yarn run mochawesome || true
+                    yarn run nyc report --reporter=lcov || true
+                    yarn run nyc report --reporter=cobertura || true
+                    rm -rf node_modules
+                  '''
+
+                  publishHTML (target: [
+                    allowMissing: true,
+                    alwaysLinkToLastBuild: false,
+                    keepAll: true,
+                    reportDir: 'cypress/mochawesome/report',
+                    reportFiles: 'mochawesome.html',
+                    reportName: &quot;Mochawesome Tests Report&quot;
+                  ])
+
+                  publishHTML (target: [
+                    allowMissing: true,
+                    alwaysLinkToLastBuild: false,
+                    keepAll: true,
+                    reportDir: 'cypress/coverage/lcov-report',
+                    reportFiles: 'index.html',
+                    reportName: &quot;Istanbul Code Coverage&quot;
+                  ])
+
+                  publishCoverage(
+                    adapters: [
+                      coberturaAdapter(path: 'cypress/coverage/cobertura-coverage.xml'),
+                    ],
+                    tag: 'cypress',
+                  )
+                }
+              }
+            }
+          }
+        }
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DWAPPS/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-web.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DWAPPS']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+        stage('Cypress tests') {
+          agent {
+            docker {
+              reuseNode true
+              image 'swh-jenkins/cypress'
+              args '--ipc=host --shm-size 1024M --tmpfs /tmp:exec --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+            }
+          }
+
+          stages {
+            stage ('Setup cypress environment') {
+              steps {
+                sh '''
+                  python3 -m pip install --no-use-pep517 --user -e .[testing]
+                  yarn install --frozen-lockfile
+                  yarn build-test
+                '''
+              }
+            }
+
+            stage ('Run cypress tests') {
+              steps {
+                sh '''#!/bin/bash
+                  export PYTHONPATH=$PWD
+                  python3 swh/web/manage.py migrate --settings=swh.web.settings.tests
+                  python3 swh/web/manage.py createcachetable --settings=swh.web.settings.tests
+                  for create_users_script in swh/web/tests/create_test_*
+                  do
+                    cat $create_users_script | python3 swh/web/manage.py shell --settings=swh.web.settings.tests
+                  done
+                  python3 swh/web/manage.py runserver --nostatic --settings=swh.web.settings.tests &amp;
+                  wait-for-it localhost:5004
+                  yarn run cypress run --config numTestsKeptInMemory=0
+                '''
+              }
+              post {
+                always {
+                  junit(
+                    allowEmptyResults: true,
+                    testResults: 'cypress/junit/results/*.xml',
+                  )
+
+                  sh '''
+                    yarn run mochawesome || true
+                    yarn run nyc report --reporter=lcov || true
+                    yarn run nyc report --reporter=cobertura || true
+                    rm -rf node_modules
+                  '''
+
+                  publishHTML (target: [
+                    allowMissing: true,
+                    alwaysLinkToLastBuild: false,
+                    keepAll: true,
+                    reportDir: 'cypress/mochawesome/report',
+                    reportFiles: 'mochawesome.html',
+                    reportName: &quot;Mochawesome Tests Report&quot;
+                  ])
+
+                  publishHTML (target: [
+                    allowMissing: true,
+                    alwaysLinkToLastBuild: false,
+                    keepAll: true,
+                    reportDir: 'cypress/coverage/lcov-report',
+                    reportFiles: 'index.html',
+                    reportName: &quot;Istanbul Code Coverage&quot;
+                  ])
+
+                  publishCoverage(
+                    adapters: [
+                      coberturaAdapter(path: 'cypress/coverage/cobertura-coverage.xml'),
+                    ],
+                    tag: 'cypress',
+                  )
+                }
+              }
+            }
+          }
+        }
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DWCLI
+INFO:jenkins_jobs.builder:Job name:  DWCLI/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-web-client</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  DWCLI/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-web-client.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-web-client',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/DWCLI/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/DWCLI/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/DWCLI/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DWCLI/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/DWCLI/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/DWCLI/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-web-client'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/DWCLI/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-web-client.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DWCLI/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-web-client.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DWCLI']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  DWCLI/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-web-client.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'DWCLI']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  TSBX
+INFO:jenkins_jobs.builder:Job name:  TSBX/incoming-tag
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-sandbox</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  TSBX/pypi-upload
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/swh-sandbox.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'swh-sandbox',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build and upload PyPI package') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/TSBX/pypi-upload') }
+      }
+      steps {
+        build(
+          job: '/TSBX/pypi-upload',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'PYPI_HOST', value: 'test.pypi.org'),
+          ],
+        )
+      }
+    }
+    stage('Update Debian packaging for new release') {
+      when {
+        expression { params.GIT_TAG ==~ /v\d+(.\d+)+/ }
+        expression { jobExists('/debian/packages/TSBX/update-for-release') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/TSBX/update-for-release',
+          parameters: [
+            string(name: 'GIT_TAG', value: params.GIT_TAG),
+          ],
+          wait: false,
+        )
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/packages/TSBX/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/packages/TSBX/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def module_name = 'swh-sandbox'.replace('-', '.')
+
+def PYPI_UPLOAD_HOST
+
+switch (params.PYPI_HOST) {
+  case 'pypi.org':
+    PYPI_UPLOAD_HOST = 'upload.pypi.org'
+    break
+  default:
+    PYPI_UPLOAD_HOST = params.PYPI_HOST
+    break
+}
+
+pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  stages {
+    stage('Run tests') {
+      when {
+        expression { return !params.SKIP_TESTS }
+        beforeAgent true
+      }
+      agent none
+      steps {
+        build(
+          job: '/TSBX/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }
+    }
+
+    stage('Checkout') {
+      steps {
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/swh-sandbox.git']]
+        ])
+        sh '''rm -rf dist/'''
+      }
+    }
+
+    stage('Build') {
+      steps {
+        sh '''
+          # Build javascript assets
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+            yarn build
+          fi
+
+          # Build java assets
+          if [ -d java ]; then
+            for pom in $( find java/ -name pom.xml ) ; do
+              mvn -f $pom compile assembly:single
+            done
+          fi
+
+          python3 setup.py sdist bdist_wheel
+        '''
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }
+    }
+
+    stage('Publish') {
+      when {
+        anyOf {
+          expression { return params.FORCE_UPLOAD }
+          expression {
+            LASTV=sh(returnStdout: true,
+                     script:&quot;curl -s https://${params.PYPI_HOST}/pypi/${module_name}/json | jq -r .info.version || true&quot;).trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }
+        }
+      }
+      steps {
+        withCredentials([
+          usernamePassword(credentialsId: PYPI_UPLOAD_HOST,
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {
+          sh &quot;python3 -m twine upload --repository-url https://${PYPI_UPLOAD_HOST}/legacy/ dist/*&quot;
+        }
+      }
+    }
+  }
+  post {
+    cleanup {
+      cleanWs()
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Upload to PyPI</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>10</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.plugins.copyartifact.CopyArtifactPermissionProperty plugin="copyartifact">
+      <projectNameList>
+        <string>*</string>
+      </projectNameList>
+    </hudson.plugins.copyartifact.CopyArtifactPermissionProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>PYPI_HOST</name>
+          <description>PYPI registry to publish to when built revision is a tag. There
+must exists a usernamePassword credential object with that name.
+The pypi JSON API endpoint is built as https://$PYPI_HOST/project/&lt;name&gt;/json
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>test.pypi.org</string>
+              <string>pypi.org</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>FORCE_UPLOAD</name>
+          <description>Force uploading python packages on the chosen PYPI registry, even if
+the package already exists.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>SKIP_TESTS</name>
+          <description>Do not run tests on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>IGNORE_TESTS</name>
+          <description>Proceed even if the tests are failing on the repository.
+</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  TSBX/tests
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-sandbox.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'TSBX']
+        ])
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>master branch</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  TSBX/tests-on-diff
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent {
+    docker {
+      reuseNode true
+      image 'swh-jenkins/tox'
+      args '--tmpfs /tmp:exec -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -u jenkins:docker --mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache '
+    }
+  }
+
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            if [ -n &quot;$PHID&quot; ]; then
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              echo &quot;{
+                \\\&quot;buildTargetPHID\\\&quot;: \\\&quot;$PHID\\\&quot;,
+                \\\&quot;artifactKey\\\&quot;: \\\&quot;jenkins.console.uri\\\&quot;,
+                \\\&quot;artifactType\\\&quot;: \\\&quot;uri\\\&quot;,
+                \\\&quot;artifactData\\\&quot;: {
+                  \\\&quot;uri\\\&quot;: \\\&quot;${BUILD_URL}console\\\&quot;,
+                  \\\&quot;name\\\&quot;: \\\&quot;Jenkins console\\\&quot;,
+                  \\\&quot;ui.external\\\&quot;: true
+                }
+              }&quot; | arc call-conduit --conduit-uri $PHAB_CONDUIT_URL --conduit-token $PHAB_CONDUIT_TOKEN harbormaster.createartifact
+              python3 -m pyarcanist send-message work $PHID
+            fi
+            '''
+        }
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;${params.REVISION}&quot;]],
+          doGenerateSubmoduleConfigurations: false,
+          extensions: [],
+          gitTool: 'Default',
+          submoduleCfg: [],
+          userRemoteConfigs: [
+            [url: 'https://forge.softwareheritage.org/source/swh-sandbox.git'],
+          ],
+          browser: [$class: 'Phabricator', repoUrl: 'https://forge.softwareheritage.org', repo: 'TSBX']
+        ])
+      }
+    }
+    stage('Apply phabricator diff') {
+      steps {
+        script {
+          comment = sh(
+            script: '''
+            #!/bin/bash
+            set -e
+
+            ORIGINAL_TAG=base-revision-${BUILD_NUMBER}-D${REV_ID}
+            ORIGINAL_COMMIT=$(git rev-parse --short=10 HEAD)
+            echo &quot;==== Patch application report for D${REV_ID} (id=${DIFF_ID}) ====&quot;
+            echo
+            git tag -f ${ORIGINAL_TAG} &gt;/dev/null
+            git fetch -n ${STAGING_URI} +refs/tags/phabricator/diff/${DIFF_ID}:diff-target +refs/tags/phabricator/base/${DIFF_ID}:diff-base &gt;/dev/null
+            rebased=0
+            if git merge-base --is-ancestor diff-base HEAD; then
+                echo &quot;**Rebasing** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git rebase --onto ${ORIGINAL_TAG} diff-base diff-target &amp;&amp; rebased=1 || rebase_exit=$?
+                echo '```'
+                if [ $rebased -eq 0 ]; then
+                    echo
+                    echo &quot;Rebase failed (ret=${rebase_exit})!&quot;
+                    echo
+                    echo '```'
+                    git rebase --abort || true
+                    echo '```'
+                fi
+            fi
+
+            merged=0
+            if [ $rebased -eq 0 ]; then
+                echo &quot;Could not rebase; Attempt **merge** onto ${ORIGINAL_COMMIT}...&quot;
+                echo
+                echo '```'
+                git merge --no-edit diff-target &amp;&amp; merged=1 || merge_exit=$?
+                echo '```'
+                if [ $merged -eq 0 ]; then
+                    echo
+                    echo &quot;Merge failed (ret=${merge_exit})!&quot;
+                    echo
+                fi
+            fi
+
+            if [ $merged -eq 1 -o $rebased -eq 1 ]; then
+                echo
+                echo &quot;===== Changes applied before test =====&quot;
+                echo
+                echo '```'
+                git log ${ORIGINAL_TAG}..
+                echo '```'
+            else
+                echo '**Attempts to apply the diff failed!**'
+                exit 1
+            fi
+            git tag -d ${ORIGINAL_TAG} &gt;/dev/null
+            ''',
+            label: 'Apply patch',
+            returnStdout: true,
+          )
+
+          writeFile(
+            file: '.phabricator-comment',
+            text: comment,
+          )
+        }
+      }
+    }
+
+    stage('Static analysis') {
+      parallel {
+        stage ('flake8') {
+          steps {
+            sh '''python3 -m tox -e flake8'''
+          }
+        }
+
+        stage ('mypy') {
+          steps {
+            sh '''python3 -m tox -e mypy'''
+          }
+        }
+
+        stage ('radon') {
+          steps {
+            sh  '''
+              mkdir -p reports
+              python3 -m radon raw --json swh/ &gt; reports/raw_report.json
+              python3 -m radon cc  --json swh/ &gt; reports/cc_report.json
+              python3 -m radon mi  --json swh/ &gt; reports/mi_report.json
+              python3 -m radon hal --json swh/ &gt; reports/hal_report.json
+              python3 -m radon cc  --xml  swh/ &gt; reports/cc_report.xml
+            '''
+          }
+          post {
+            always {
+              // Archive a few report files
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: 'reports/*',
+                fingerprint: true,
+              )
+
+              // Warnings NG
+              recordIssues(
+                enabledForFailure: true,
+                tools: [
+                  ccm(pattern: '**/reports/cc_report.xml'),
+                ],
+              )
+            }
+          }
+        }
+      }
+    } // static analysis
+
+    stage('Tests') {
+      options {
+        timeout(time: 20, unit: 'MINUTES')
+      }
+
+      parallel {
+        stage('Python tests') {
+          steps {
+            sh '''
+            python3 -m tox -e $TOX_ENVIRONMENT -- \
+              --cov-report=xml \
+              --junit-xml=test-results.xml \
+              -v
+            '''
+          }
+          post {
+            always {
+              archiveArtifacts(
+                allowEmptyArchive: true,
+                artifacts: '*.xml',
+                fingerprint: true,
+              )
+
+              publishCoverage(
+                adapters: [
+                  coberturaAdapter(path: 'coverage.xml'),
+                ],
+                tag: 'pytest',
+                sourceFileResolver: sourceFiles('STORE_LAST_BUILD'),
+              )
+
+              // JUnit report
+              junit(
+                allowEmptyResults: true,
+                testResults: 'test-results.xml',
+              )
+            }
+          } // post
+        } // unit tests
+
+        stage('Sphinx documentation') {
+          agent {
+        docker {
+          reuseNode true
+          image 'swh-jenkins/sphinx'
+          args '--mount type=volume,src=shared-jenkins-cachedir,dst=/home/jenkins/.cache'
+        }
+      }
+
+          steps {
+            sh '''
+            if tox -a | grep -x sphinx &gt;/dev/null
+            then
+              tox -e sphinx
+            else
+              echo WARNING: no sphinx environment in tox.ini
+            fi
+            '''
+          }
+        } // sphinx doc
+      } // parallel
+    } // Tests stage
+  } // stages
+
+  post {
+    always {
+      step([$class: 'PhabricatorNotifier',
+            commentOnSuccess: true,
+            commentWithConsoleLinkOnFailure: true,
+            commentFile: '.phabricator-comment',
+            commentSize: '1000000',
+            preserveFormatting: true,
+            processLint: true,
+            lintFile: '.phabricator-lint',
+            lintFileSize: '1000000',
+      ])
+    } // always
+
+    cleanup {
+      cleanWs()
+    }
+  } // post
+} // pipeline</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Phab. Diff</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>true</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>20</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>REVISION</name>
+          <description>Git revision to build.</description>
+          <type>PT_REVISION</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>NONE</sortMode>
+          <defaultValue>master</defaultValue>
+          <selectedValue>NONE</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the Phabricator target object on which results will be reported.</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>DIFF_ID</name>
+          <description>ID of the Diff patch to apply, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>REV_ID</name>
+          <description>ID of the Phabricator revision, if any</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>STAGING_URI</name>
+          <description>URI of the staging repository</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>TOX_ENVIRONMENT</name>
+          <description>tox environment to use for the main tox run</description>
+          <defaultValue>py3</defaultValue>
+        </hudson.model.StringParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian
+INFO:jenkins_jobs.builder:Job name:  debian/deps
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PATS
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PATS/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Debian</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Debian Dependency Packages</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-attr-strict</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-attr-strict'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PATS/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-attr-strict'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PATS/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PCASS
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PCASS/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-attr-strict.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-attr-strict',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PATS/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PATS/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python-cassandra-driver</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python-cassandra-driver'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PCASS/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python-cassandra-driver'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PCASS/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PDJR
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PDJR/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python-cassandra-driver.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python-cassandra-driver',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PCASS/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PCASS/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-django-js-reverse</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-django-js-reverse'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PDJR/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-django-js-reverse'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PDJR/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PDWL
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PDWL/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-django-js-reverse.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-django-js-reverse',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PDJR/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PDJR/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>django-webpack-loader</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'django-webpack-loader'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PDWL/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'django-webpack-loader'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PDWL/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PJOS
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PJOS/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/django-webpack-loader.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'django-webpack-loader',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PDWL/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PDWL/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-jose</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-jose'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PJOS/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-jose'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PJOS/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PKCL
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PKCL/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-jose.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-jose',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PJOS/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PJOS/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-keycloak</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-keycloak'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PKCL/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-keycloak'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PKCL/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PMK
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PMK/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-keycloak.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-keycloak',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PKCL/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PKCL/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-mirakuru</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-mirakuru'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PMK/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-mirakuru'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PMK/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPDW
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPDW/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-mirakuru.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-mirakuru',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PMK/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PMK/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-dulwich</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-dulwich'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPDW/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-dulwich'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPDW/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPF
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPF/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-dulwich.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-dulwich',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PPDW/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PPDW/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-port-for</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-port-for'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPF/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-port-for'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPF/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPL
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPL/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-port-for.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-port-for',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PPF/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PPF/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-plotille</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-plotille'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPL/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-plotille'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPL/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPPE
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPPE/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-plotille.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-plotille',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PPL/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PPL/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-prometheus-pve-exporter</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-prometheus-pve-exporter'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPPE/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-prometheus-pve-exporter'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPPE/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPSASL
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPSASL/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-prometheus-pve-exporter.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-prometheus-pve-exporter',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PPPE/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PPPE/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python-pure-sasl</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python-pure-sasl'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPSASL/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python-pure-sasl'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPSASL/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPTRE
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPTRE/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python-pure-sasl.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python-pure-sasl',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PPSASL/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PPSASL/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-pytest-redis</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-pytest-redis'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPTRE/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-pytest-redis'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PPTRE/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PSD
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PSD/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-pytest-redis.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-pytest-redis',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PPTRE/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PPTRE/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-sqlitedict</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-sqlitedict'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PSD/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-sqlitedict'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PSD/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PSTATIO
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PSTATIO/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-sqlitedict.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-sqlitedict',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PSD/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PSD/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-statusio</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-statusio'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PSTATIO/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-statusio'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PSTATIO/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTDTM
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTDTM/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-statusio.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-statusio',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PSTATIO/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PSTATIO/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-django-test-migrations</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-django-test-migrations'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTDTM/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-django-test-migrations'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTDTM/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTPP
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTPP/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-django-test-migrations.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-django-test-migrations',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PTDTM/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PTDTM/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-pytest-postgresql</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-pytest-postgresql'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTPP/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-pytest-postgresql'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTPP/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTS
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTS/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-pytest-postgresql.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-pytest-postgresql',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PTPP/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PTPP/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>python3-tree-sitter</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-tree-sitter'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTS/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'python3-tree-sitter'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/deps/PTS/incoming-tag
+INFO:jenkins_jobs.builder:Job name:  debian/maintenance
+INFO:jenkins_jobs.builder:Job name:  debian/maintenance/schroot-maintenance
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>pipeline {
+  agent none
+  stages {
+    stage('Refresh tag list') {
+      agent any
+      steps {
+        checkout([
+          $class: 'GitSCM',
+          userRemoteConfigs: [[
+            url: 'https://forge.softwareheritage.org/source/python3-tree-sitter.git',
+          ]],
+          branches: [[
+            name: params.GIT_TAG,
+          ]],
+          browser: [
+            $class: 'Phabricator',
+            repo: 'python3-tree-sitter',
+            repoUrl: 'https://forge.softwareheritage.org/',
+          ],
+        ])
+      }
+    }
+    stage('Build Debian package') {
+      when {
+        expression { params.GIT_TAG ==~ /debian\/.*/ }
+        expression { !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }
+        expression { jobExists('/debian/deps/PTS/gbp-buildpackage') }
+      }
+      steps {
+        build(
+          job: '/debian/deps/PTS/gbp-buildpackage',
+          parameters: [
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
+          ],
+          wait: false,
+        )
+      }
+    }
+  }
+}</script>
+    <sandbox>true</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Incoming tag</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>20</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>Debian package building-related maintenance jobs.
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Debian Maintenance</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  debian/maintenance/update-scripts
+<?xml version="1.0" encoding="utf-8"?>
+<matrix-project>
+  <executionStrategy class="hudson.matrix.DefaultMatrixExecutionStrategyImpl">
+    <runSequentially>true</runSequentially>
+  </executionStrategy>
+  <combinationFilter/>
+  <axes>
+    <hudson.matrix.LabelAxis>
+      <name>slave</name>
+      <values>
+        <string>jenkins-debian01.internal.softwareheritage.org</string>
+      </values>
+    </hudson.matrix.LabelAxis>
+    <hudson.matrix.TextAxis>
+      <name>distribution</name>
+      <values>
+        <string>unstable</string>
+        <string>bullseye</string>
+        <string>buster</string>
+        <string>stretch</string>
+      </values>
+    </hudson.matrix.TextAxis>
+    <hudson.matrix.TextAxis>
+      <name>architecture</name>
+      <values>
+        <string>amd64</string>
+        <string>i386</string>
+      </values>
+    </hudson.matrix.TextAxis>
+  </axes>
+  <actions/>
+  <description>Update sbuild chroots.&lt;br/&gt;Do not edit this job through the web interface, it is generated via jenkins-job-builder!&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <childCustomWorkspace>.</childCustomWorkspace>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>7</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>H */6 * * *</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>/usr/share/jenkins/debian-scripts/schroot-maintenance.sh</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers/>
+  <buildWrappers/>
+</matrix-project>
+INFO:jenkins_jobs.builder:Job name:  debian/packages
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DAUTH
+<?xml version="1.0" encoding="utf-8"?>
+<matrix-project>
+  <executionStrategy class="hudson.matrix.DefaultMatrixExecutionStrategyImpl">
+    <runSequentially>false</runSequentially>
+  </executionStrategy>
+  <combinationFilter/>
+  <axes>
+    <hudson.matrix.LabelAxis>
+      <name>slave</name>
+      <values>
+        <string>jenkins-debian01.internal.softwareheritage.org</string>
+      </values>
+    </hudson.matrix.LabelAxis>
+  </axes>
+  <actions/>
+  <description>Update debian scripts from the jenkins-jobs repository&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <childCustomWorkspace>.</childCustomWorkspace>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>7</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+  </properties>
+  <scm class="hudson.plugins.git.GitSCM">
+    <configVersion>2</configVersion>
+    <userRemoteConfigs>
+      <hudson.plugins.git.UserRemoteConfig>
+        <name>origin</name>
+        <refspec>+refs/heads/*:refs/remotes/origin/*</refspec>
+        <url>https://forge.softwareheritage.org/source/swh-jenkins-jobs/</url>
+      </hudson.plugins.git.UserRemoteConfig>
+    </userRemoteConfigs>
+    <branches>
+      <hudson.plugins.git.BranchSpec>
+        <name>master</name>
+      </hudson.plugins.git.BranchSpec>
+    </branches>
+    <disableSubmodules>false</disableSubmodules>
+    <recursiveSubmodules>false</recursiveSubmodules>
+    <doGenerateSubmoduleConfigurations>false</doGenerateSubmoduleConfigurations>
+    <remotePoll>false</remotePoll>
+    <gitTool>Default</gitTool>
+    <submoduleCfg class="list"/>
+    <reference/>
+    <gitConfigName/>
+    <gitConfigEmail/>
+    <extensions/>
+  </scm>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>H * * * *</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>chmod go+rX -R scripts/debian/</command>
+    </hudson.tasks.Shell>
+    <hudson.tasks.Shell>
+      <command>rsync -az --delete scripts/debian/ /usr/share/jenkins/debian-scripts/</command>
+    </hudson.tasks.Shell>
+    <hudson.tasks.Shell>
+      <command>rsync -az --delete keyrings/ /usr/share/keyrings/extra-repositories/</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers/>
+  <buildWrappers/>
+</matrix-project>
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>Debian Packages</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <healthMetrics>
+    <com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+      <nonRecursive>false</nonRecursive>
+    </com.cloudbees.hudson.plugins.folder.health.WorstChildHealthMetric>
+  </healthMetrics>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DAUTH/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-auth</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-auth'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DAUTH/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-auth'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DAUTH/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-auth'
+def python_module = 'swh.auth'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DAUTH/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCIDX
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCIDX/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-indexer</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-indexer'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCIDX/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-indexer'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCIDX/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-indexer'
+def python_module = 'swh.indexer'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DCIDX/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCNT
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCNT/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-counters</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-counters'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCNT/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-counters'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCNT/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-counters'
+def python_module = 'swh.counters'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DCNT/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCORE
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCORE/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-core</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-core'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCORE/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-core'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DCORE/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-core'
+def python_module = 'swh.core'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DCORE/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DDATASET
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DDATASET/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-dataset</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-dataset'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DDATASET/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-dataset'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DDATASET/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-dataset'
+def python_module = 'swh.dataset'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DDATASET/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DDEP
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DDEP/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-deposit</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-deposit'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DDEP/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-deposit'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DDEP/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-deposit'
+def python_module = 'swh.deposit'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DDEP/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DFUSE
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DFUSE/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-fuse</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-fuse'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DFUSE/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-fuse'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DFUSE/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-fuse'
+def python_module = 'swh.fuse'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DFUSE/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DGRPH
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DGRPH/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-graph</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-graph'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DGRPH/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-graph'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DGRPH/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-graph'
+def python_module = 'swh.graph'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DGRPH/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DICP
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DICP/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-icinga-plugins</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-icinga-plugins'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DICP/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-icinga-plugins'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DICP/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-icinga-plugins'
+def python_module = 'swh.icinga_plugins'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DICP/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DJNL
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DJNL/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-journal</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-journal'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DJNL/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-journal'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DJNL/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-journal'
+def python_module = 'swh.journal'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DJNL/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDBASE
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDBASE/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-core</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-core'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDBASE/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-core'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDBASE/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-loader-core'
+def python_module = 'swh.loader.core'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DLDBASE/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDBZR
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDBZR/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-bzr</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-bzr'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDBZR/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-bzr'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDBZR/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-loader-bzr'
+def python_module = 'swh.loader.bzr'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DLDBZR/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDCVS
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDCVS/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-cvs</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-cvs'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDCVS/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-cvs'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDCVS/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-loader-cvs'
+def python_module = 'swh.loader.cvs'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DLDCVS/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDG
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDG/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-git</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-git'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDG/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-git'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDG/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-loader-git'
+def python_module = 'swh.loader.git'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DLDG/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDHG
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDHG/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-mercurial</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-mercurial'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDHG/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-mercurial'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDHG/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-loader-mercurial'
+def python_module = 'swh.loader.mercurial'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DLDHG/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDSVN
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDSVN/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-loader-svn</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-svn'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDSVN/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-loader-svn'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLDSVN/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-loader-svn'
+def python_module = 'swh.loader.svn'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DLDSVN/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLS
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLS/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-lister</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-lister'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLS/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-lister'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DLS/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-lister'
+def python_module = 'swh.lister'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DLS/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DMFCD
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DMFCD/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-clearlydefined</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-clearlydefined'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DMFCD/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-clearlydefined'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DMFCD/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-clearlydefined'
+def python_module = 'swh.clearlydefined'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DMFCD/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DMOD
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DMOD/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-model</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-model'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DMOD/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-model'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DMOD/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-model'
+def python_module = 'swh.model'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DMOD/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOBJS
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOBJS/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-objstorage</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-objstorage'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOBJS/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-objstorage'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>ceph</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOBJS/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-objstorage'
+def python_module = 'swh.objstorage'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DOBJS/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOBJSRPL
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOBJSRPL/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-objstorage-replayer</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-objstorage-replayer'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOBJSRPL/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-objstorage-replayer'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOBJSRPL/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-objstorage-replayer'
+def python_module = 'swh.objstorage.replayer'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DOBJSRPL/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOPH
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOPH/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-perfecthash</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-perfecthash'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOPH/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-perfecthash'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DOPH/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-perfecthash'
+def python_module = 'swh.perfecthash'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DOPH/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DPROV
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DPROV/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-provenance</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-provenance'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DPROV/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-provenance'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DPROV/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-provenance'
+def python_module = 'swh.provenance'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DPROV/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSCH
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSCH/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-scheduler</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-scheduler'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSCH/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-scheduler'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSCH/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-scheduler'
+def python_module = 'swh.scheduler'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DSCH/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSEA
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSEA/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-search</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-search'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSEA/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-search'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>elasticsearch</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSEA/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-search'
+def python_module = 'swh.search'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DSEA/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSTO
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSTO/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-storage</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-storage'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSTO/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-storage'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>cassandra</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DSTO/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-storage'
+def python_module = 'swh.storage'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DSTO/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DTPL
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DTPL/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-py-template</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-py-template'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DTPL/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-py-template'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DTPL/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-py-template'
+def python_module = 'swh.foo'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DTPL/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DTSCN
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DTSCN/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-scanner</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-scanner'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DTSCN/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-scanner'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DTSCN/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-scanner'
+def python_module = 'swh.scanner'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DTSCN/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DVAU
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DVAU/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-vault</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-vault'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DVAU/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-vault'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DVAU/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-vault'
+def python_module = 'swh.vault'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DVAU/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DWAPPS
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DWAPPS/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-web</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-web'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DWAPPS/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-web'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DWAPPS/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-web'
+def python_module = 'swh.web'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DWAPPS/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DWCLI
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DWCLI/automatic-backport
+<?xml version="1.0" encoding="utf-8"?>
+<com.cloudbees.hudson.plugins.folder.Folder plugin="cloudbees-folder">
+  <icon class="com.cloudbees.hudson.plugins.folder.icons.StockFolderIcon"/>
+  <views/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <primaryView>All</primaryView>
+  <healthMetrics/>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <displayName>swh-web-client</displayName>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</com.cloudbees.hudson.plugins.folder.Folder>
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-web-client'
+
+def environment
+
+def release
+switch (params.DESTINATION) {
+  case ~/^stretch(-.*|)$/:
+    release = 9
+    break
+  case ~/^buster(-.*|)$/:
+    release = 10
+    break
+  case ~/^bullseye(-.*|)$/:
+    release = 11
+    break
+  case ~/^bookworm(-.*|)$/:
+    release = 12
+    break
+  case ~/^trixie(-.*|)$/:
+    release = 13
+    break
+  default:
+    release = 'UNKNOWN'
+    break
+}
+
+def backport_ok = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: &quot;debian/${params.DESTINATION}&quot;], [name: &quot;refs/tags/${params.GIT_TAG}&quot;]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+        ])
+      }
+    }
+    stage('Check the source branch') {
+      steps {
+        script {
+          def current_release = sh(
+            script: &quot;dpkg-parsechangelog -SDistribution&quot;,
+            returnStdout: true,
+          ).trim();
+
+          backport_ok = current_release == params.SOURCE &amp;&amp; release != 'UNKNOWN'
+        }
+      }
+    }
+    stage('Seed the environment') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        script {
+          def hostname = sh(
+            script: &quot;hostname --fqdn&quot;,
+            returnStdout: true,
+          ).trim();
+
+          def short_hostname = hostname - '.internal.softwareheritage.org';
+
+          environment = [
+            &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+            &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+          ]
+        }
+      }
+    }
+    stage('Merge package version to destination branch') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            git checkout debian/${params.DESTINATION} || git checkout -b debian/${params.DESTINATION} ${params.GIT_TAG}
+            git merge ${params.GIT_TAG} --no-commit --no-edit || true
+            git checkout ${params.GIT_TAG} -- debian/changelog debian/gbp.conf
+            sed -i 's!^debian-branch\\s*=.*\$!debian-branch=debian/${params.DESTINATION}!' debian/gbp.conf
+            git add debian/changelog debian/gbp.conf
+            git commit --no-verify -m &quot;Merge tag '${params.GIT_TAG}' into debian/${params.DESTINATION}&quot;
+            git show
+          &quot;&quot;&quot;
+          }
+      }
+    }
+    stage('Update changelog for backport') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh &quot;&quot;&quot;
+            dch -l ~bpo${release}+ -D ${params.DESTINATION} --force-distribution 'Rebuild for ${params.DESTINATION}'
+            git add debian/changelog
+            git commit --no-verify -m &quot;Updated backport on ${params.DESTINATION} from ${params.GIT_TAG} (${params.SOURCE})&quot;
+            git show
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Tag package') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        withEnv(environment) {
+          sh 'gbp buildpackage --git-tag-only'
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { backport_ok }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-public-ci-ssh']) {
+          script {
+            def git_push = 'git push --follow-tags --all'
+            if (params.DRY_RUN) {
+              git_push += ' -n'
+            }
+
+            sh(script: git_push)
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Backport Debian package to the given release
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to backport</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>SOURCE</name>
+          <description>check that the source branch corresponds to this before issuing the backport</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>unstable-swh</string>
+              <string>unstable</string>
+              <string>bookworm-swh</string>
+              <string>bullseye-swh</string>
+              <string>buster-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>DESTINATION</name>
+          <description>the destination branch the backport targets</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string>buster-swh</string>
+              <string>bullseye-swh</string>
+              <string>bookworm-swh</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DWCLI/gbp-buildpackage
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def repo_name = 'swh-web-client'
+
+def changelog_distribution
+
+def repo_host = 'pergamon.internal.softwareheritage.org'
+def repo_user = 'swhdebianrepo'
+def repo_path = '/srv/softwareheritage/repository'
+
+def upload_target = &quot;${repo_path}/incoming&quot;
+def repo_command = &quot;umask 002; reprepro -vb ${repo_path} processincoming incoming&quot;
+
+def backport_job = '/' + (currentBuild.fullProjectName.split('/')[0..-2] + ['automatic-backport']).join('/')
+
+pipeline {
+  agent { label 'debian' }
+  environment {
+    PHAB_CONDUIT_URL = 'https://forge.softwareheritage.org/api/'
+  }
+  stages {
+    stage('Notify Phabricator start') {
+      when {
+        beforeAgent true
+        expression { params.PHID }
+      }
+      agent { label 'swh-tox' }
+      steps {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          sh '''
+            python3 -m pyarcanist send-message work $PHID
+          '''
+        }
+      }
+    }
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: params.GIT_REVISION]],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+        ])
+        script {
+          dir(repo_name) {
+            if(!fileExists('debian/changelog')) {
+              error('Trying to build a debian package without a debian/changelog')
+            }
+
+            changelog_distribution = sh(
+              script: 'dpkg-parsechangelog -SDistribution',
+              returnStdout: true,
+            ).trim()
+
+            def parsed_gbp_config = readProperties(
+              file: 'debian/gbp.conf',
+              defaults: ['debian-branch': 'master'],
+            )
+
+            def debian_branch = parsed_gbp_config['debian-branch']
+            def pristine_tar = parsed_gbp_config['pristine-tar']
+            def upstream_branch = parsed_gbp_config['upstream-branch']
+
+            sh &quot;&quot;&quot;
+              git checkout -b ${debian_branch}
+              [ ${pristine_tar} = &quot;True&quot; ] &amp;&amp; git branch -f pristine-tar origin/pristine-tar
+              git branch -f ${upstream_branch} origin/${upstream_branch}
+            &quot;&quot;&quot;
+          }
+        }
+      }
+    }
+    stage('Build package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+      }
+      steps {
+        script {
+          dir (repo_name) {
+            def wanted_extra_repositories = params.EXTRA_REPOSITORIES.split(',')
+
+            def build_dep_resolver
+
+            def extra_repositories = []
+            def extra_repository_keys = []
+
+            def base_distribution = changelog_distribution.split('-')[0]
+            def backports = changelog_distribution.endsWith('-backports')
+            def swh = changelog_distribution.endsWith('-swh')
+
+            if (base_distribution in ['unstable', 'experimental'] || 'incoming' in wanted_extra_repositories) {
+              def suites = []
+              if (base_distribution == 'unstable') {
+                suites = ['buildd-unstable']
+              } else if (base_distribution == 'experimental') {
+                suites = ['buildd-unstable', 'buildd-experimental']
+              } else {
+                suites = [&quot;buildd-${base_distribution}-proposed-updates&quot;]
+                if (backports || swh) {
+                  suites.add(&quot;buildd-${base_distribution}-backports&quot;)
+                }
+              }
+              suites.each {suite -&gt;
+                extra_repositories.add(&quot;deb http://incoming.debian.org/debian-buildd/ ${suite} main&quot;)
+              }
+            }
+
+            if (swh || 'swh' in wanted_extra_repositories) {
+              def swh_distribution = &quot;${base_distribution}-swh&quot;
+              if (base_distribution in ['unstable', 'experimental']) {
+                swh_distribution = 'unstable'
+              }
+              extra_repositories.add(&quot;deb [trusted=yes] https://debian.softwareheritage.org/ ${swh_distribution} main&quot;)
+            }
+
+            if ((backports || swh || 'backports' in wanted_extra_repositories) &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://deb.debian.org/debian/ ${base_distribution}-backports main&quot;)
+              build_dep_resolver = 'aptitude'
+            }
+
+            if ('ceph' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              if (base_distribution != 'stretch') {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-octopus/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              } else {
+                extra_repositories.add(&quot;deb http://download.proxmox.com/debian/ceph-luminous/ ${base_distribution} main&quot;)
+                extra_repository_keys.add('proxmox.asc')
+              }
+            }
+
+            if ('pgdg' in wanted_extra_repositories &amp;&amp; !(base_distribution in ['unstable', 'experimental'])) {
+              extra_repositories.add(&quot;deb http://apt.postgresql.org/pub/repos/apt/ ${base_distribution}-pgdg main&quot;)
+              extra_repository_keys.add('postgres.asc')
+            }
+
+            if ('elasticsearch' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb https://artifacts.elastic.co/packages/7.x/apt stable main&quot;)
+              extra_repository_keys.add('elasticsearch.asc')
+            }
+
+            if ('cassandra' in wanted_extra_repositories) {
+              extra_repositories.add(&quot;deb http://www.apache.org/dist/cassandra/debian 40x main&quot;)
+              extra_repository_keys.add('cassandra.asc')
+            }
+
+            if (params.BUILD_DEP_RESOLVER) {
+              build_dep_resolver = params.BUILD_DEP_RESOLVER
+            }
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            def uploader = &quot;Software Heritage autobuilder (on ${short_hostname}) &lt;jenkins@${hostname}&gt;&quot;
+
+            def gbp_buildpackage = [
+              'gbp buildpackage',
+              '--git-builder=sbuild',
+              '--nolog',
+              '--batch',
+              '--no-clean-source',
+              '--no-run-lintian',
+              '--arch-all',
+              '--source',
+              '--force-orig-source',
+              &quot;--uploader='${uploader}'&quot;,
+            ]
+
+            if (build_dep_resolver != null) {
+              gbp_buildpackage.add(&quot;--build-dep-resolver=${build_dep_resolver}&quot;)
+            }
+
+            extra_repositories.each { repo -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository='${repo}'&quot;)
+            }
+
+            extra_repository_keys.each { key -&gt;
+              gbp_buildpackage.add(&quot;--extra-repository-key=/usr/share/keyrings/extra-repositories/${key}&quot;)
+            }
+
+            def gbp_buildpackage_cmd = gbp_buildpackage.join(' ')
+
+            sh(script: gbp_buildpackage_cmd)
+          }
+
+          if (params.DO_UPLOAD) {
+            sh(script: 'debsign *.changes')
+          }
+
+          archiveArtifacts(
+            artifacts: sh(
+              script: 'dcmd echo *.changes',
+              returnStdout: true
+            ).split().join(','),
+            fingerprint: true,
+          )
+        }
+      }
+    }
+    stage('Upload package') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.DO_UPLOAD }
+      }
+      steps {
+        sshagent (credentials: ['jenkins-debian-repo-ssh']) {
+          sh &quot;&quot;&quot;
+            dcmd rsync -v *.changes ${repo_user}@${repo_host}:${upload_target}
+            ssh ${repo_user}@${repo_host} '${repo_command}'
+          &quot;&quot;&quot;
+        }
+      }
+    }
+    stage('Prepare backport') {
+      when {
+        beforeAgent true
+        expression { changelog_distribution != 'UNRELEASED' }
+        expression { params.BACKPORT_ON_SUCCESS }
+        expression { jobExists(backport_job) }
+      }
+      steps {
+        script {
+          params.BACKPORT_ON_SUCCESS.split(',').each { bpo_pair -&gt;
+            def (src_suite, dst_suite) = bpo_pair.split('&gt;')
+
+            if (src_suite == changelog_distribution) {
+              build(
+                job: backport_job,
+                parameters: [
+                  string(name: 'GIT_TAG', value: params.GIT_REVISION),
+                  string(name: 'SOURCE', value: src_suite),
+                  string(name: 'DESTINATION', value: dst_suite),
+                ],
+                wait: false,
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+  post {
+    always {
+      node('swh-tox') {
+        withCredentials([
+          string(credentialsId: 'swh-public-ci',
+                 variable: 'PHAB_CONDUIT_TOKEN')]) {
+          withEnv([&quot;JOBSTATUS=${currentBuild.currentResult}&quot;]) {
+            sh '''
+              if [ &quot;$JOBSTATUS&quot; = &quot;SUCCESS&quot; ]; then
+                MSGTYPE=pass
+              else
+                MSGTYPE=fail
+              fi
+              echo &quot;Current job status is $JOBSTATUS -&gt; $MGSTYPE&quot;
+              if [ -n &quot;$PHID&quot; ]; then
+                python3 -m pyarcanist send-message $MSGTYPE $PHID
+              fi
+            '''
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>Build Debian package
+&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>10</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.StringParameterDefinition>
+          <name>GIT_REVISION</name>
+          <description>Git revision to build</description>
+          <defaultValue>debian/unstable-swh</defaultValue>
+        </hudson.model.StringParameterDefinition>
+        <hudson.model.StringParameterDefinition>
+          <name>PHID</name>
+          <description>PHID of the phabricator target object on which results will be reported</description>
+          <defaultValue/>
+        </hudson.model.StringParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>EXTRA_REPOSITORIES</name>
+          <description>extra repositories needed to build this package</description>
+          <value>incoming,backports,swh,ceph,pgdg,elasticsearch,cassandra</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>None</defaultValue>
+          <descriptionPropertyValue>The buildd incoming repository (default for builds from unstable),The debian backports repository (default for builds for stable-swh),The Software Heritage debian repository (default for builds for swh branches),The ceph repository,PostgreSQL Global Dvt Group repository (for stable-swh builds requiring latest postgresql),Elasticsearch 7.x repository (for builds requiring elasticsearch installed),Cassandra 4.x repository (for builds requiring cassandra installed)</descriptionPropertyValue>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+        <hudson.model.ChoiceParameterDefinition>
+          <name>BUILD_DEP_RESOLVER</name>
+          <description>the sbuild build dependency resolver (overrides the automatic detection)
+</description>
+          <choices class="java.util.Arrays$ArrayList">
+            <a class="string-array">
+              <string/>
+              <string>apt</string>
+              <string>aptitude</string>
+            </a>
+          </choices>
+        </hudson.model.ChoiceParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DO_UPLOAD</name>
+          <description>upload the built package</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+        <com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+          <name>BACKPORT_ON_SUCCESS</name>
+          <description>If the build is successful, which backports should we perform?</description>
+          <value>unstable-swh&gt;stretch-swh,unstable-swh&gt;buster-swh,unstable-swh&gt;bullseye-swh,buster-swh&gt;stretch-swh</value>
+          <visibleItemCount>5</visibleItemCount>
+          <multiSelectDelimiter>,</multiSelectDelimiter>
+          <quoteValue>false</quoteValue>
+          <defaultValue>unstable-swh&gt;buster-swh</defaultValue>
+          <descriptionPropertyValue/>
+          <type>PT_CHECKBOX</type>
+          <propertyFile/>
+          <propertyKey/>
+          <defaultPropertyFile/>
+          <defaultPropertyKey/>
+          <descriptionPropertyFile/>
+          <descriptionPropertyKey/>
+          <bindings/>
+          <groovyScript/>
+          <groovyScriptFile/>
+          <groovyClasspath/>
+          <defaultGroovyScript/>
+          <defaultGroovyClasspath/>
+          <descriptionGroovyScript/>
+          <descriptionGroovyClasspath/>
+        </com.cwctravel.hudson.plugins.extended__choice__parameter.ExtendedChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  debian/packages/DWCLI/update-for-release
+<?xml version="1.0" encoding="utf-8"?>
+<flow-definition plugin="workflow-job">
+  <definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition" plugin="workflow-cps">
+    <script>def upstream_tag = params.GIT_TAG
+def version = upstream_tag.substring(1)
+def repo_name = 'swh-web-client'
+def python_module = 'swh.web.client'
+
+def full_environ
+
+def debian_upstream_tag_exists = false
+
+pipeline {
+  agent { label 'debian' }
+  stages {
+    stage('Checkout') {
+      steps {
+        cleanWs()
+        checkout([
+          $class: 'GitSCM',
+          branches: [[name: 'debian/unstable-swh'], [name: 'debian/*'], [name: 'pristine-tar']],
+          userRemoteConfigs: [[
+            url: &quot;https://forge.softwareheritage.org/source/${repo_name}.git&quot;,
+          ]],
+          extensions: [
+            [$class: 'RelativeTargetDirectory', relativeTargetDir: repo_name],
+          ],
+          poll: false,
+        ])
+        dir (repo_name) {
+          sh '''
+            git checkout -B pristine-tar origin/pristine-tar
+            git checkout -B debian/upstream origin/debian/upstream
+            git checkout -B debian/unstable-swh origin/debian/unstable-swh
+          '''
+          script {
+            def tag_exists_retval = sh(
+              script: &quot;git rev-parse --verify debian/upstream/${version}&quot;,
+              returnStatus: true
+            )
+            debian_upstream_tag_exists = (tag_exists_retval == 0)
+          }
+        }
+      }
+    }
+    stage('Get author information from tag') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          // This script retrieves the author data for the tag that we're currently processing
+          script {
+            // Check if the tag is annotated or not
+            def objecttype = sh(
+              script: &quot;git tag -l --format='%(*objecttype)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            def tagger = !objecttype.isEmpty() ? 'tagger' : 'author';
+
+            def tagger_name = sh(
+              script: &quot;git tag -l --format='%(${tagger}name)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def tagger_email = sh(
+              script: &quot;git tag -l --format='%(${tagger}email)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+            tagger_email = tagger_email.substring(1, tagger_email.length() - 1);
+
+            def tagger_date = sh(
+              script: &quot;git tag -l --format='%(${tagger}date:iso)' ${upstream_tag}&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def hostname = sh(
+              script: &quot;hostname --fqdn&quot;,
+              returnStdout: true,
+            ).trim();
+
+            def short_hostname = hostname - '.internal.softwareheritage.org';
+
+            full_environ = [
+              &quot;DEBEMAIL=jenkins@${hostname}&quot;,
+              &quot;DEBFULLNAME=Software Heritage autobuilder (on ${short_hostname})&quot;,
+              &quot;UPSTREAM_TAG=${upstream_tag}&quot;,
+              &quot;UPSTREAM_TAGGER_NAME=${tagger_name}&quot;,
+              &quot;UPSTREAM_TAGGER_EMAIL=${tagger_email}&quot;,
+              &quot;UPSTREAM_TAGGER_DATE=${tagger_date}&quot;,
+              &quot;UPSTREAM_VERSION=${version}&quot;,
+              &quot;PYTHON_MODULE=${python_module}&quot;,
+            ];
+          }
+        }
+      }
+    }
+    stage('gbp import-orig') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        copyArtifacts(
+          projectName: '/DWCLI/pypi-upload',
+          parameters: 'GIT_TAG=' + params.GIT_TAG,
+        )
+        withEnv(full_environ) {
+          dir (repo_name) {
+            sh '''
+              gbp import-orig --merge-mode=replace --no-symlink-orig -u ${UPSTREAM_VERSION} ../dist/${PYTHON_MODULE}-${UPSTREAM_VERSION}.tar.gz
+            '''
+          }
+        }
+      }
+    }
+    stage('unstable-swh changelog') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        withEnv(full_environ) {
+          dir(repo_name) {
+            sh '''
+              dch -v ${UPSTREAM_VERSION}-1~swh1 &quot;New upstream release ${UPSTREAM_VERSION}\n    - (tagged by ${UPSTREAM_TAGGER_NAME} &lt;${UPSTREAM_TAGGER_EMAIL}&gt; on ${UPSTREAM_TAGGER_DATE})&quot;
+              dch &quot;Upstream changes:\n$(git tag -l --format='%(contents:subject)%0a%(contents:body)' ${UPSTREAM_TAG} | sed -E -e '/^$/d' -e 's/^ *(- *)?//' -e 's/^/    - /')&quot;
+              dch -D unstable-swh --force-distribution ''
+              git add debian/changelog
+              git commit --no-verify -m &quot;Updated debian changelog for version ${UPSTREAM_VERSION}&quot;
+              git show
+              gbp buildpackage --git-tag-only
+            '''
+          }
+        }
+      }
+    }
+    stage('Upload changes') {
+      when {
+        beforeAgent true
+        expression { !debian_upstream_tag_exists }
+      }
+      steps {
+        dir (repo_name) {
+          sshagent (credentials: ['jenkins-public-ci-ssh']) {
+            script {
+              def git_push = 'git push --follow-tags --all'
+              if (params.DRY_RUN) {
+                git_push += ' -n'
+              }
+
+              sh(script: git_push)
+            }
+          }
+        }
+      }
+    }
+  }
+}</script>
+    <sandbox>false</sandbox>
+  </definition>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <canRoam>true</canRoam>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+          <name>GIT_TAG</name>
+          <description>git tag to process</description>
+          <type>PT_TAG</type>
+          <branch/>
+          <tagFilter>*</tagFilter>
+          <branchFilter>.*</branchFilter>
+          <sortMode>DESCENDING_SMART</sortMode>
+          <defaultValue/>
+          <selectedValue>TOP</selectedValue>
+          <useRepository/>
+          <quickFilterEnabled>false</quickFilterEnabled>
+        </net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition>
+        <hudson.model.BooleanParameterDefinition>
+          <name>DRY_RUN</name>
+          <description>Don't push the resulting changes to a Debian branch</description>
+          <defaultValue>false</defaultValue>
+        </hudson.model.BooleanParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <publishers/>
+  <buildWrappers/>
+</flow-definition>
+INFO:jenkins_jobs.builder:Job name:  jenkins-tools/clean-docker
+INFO:jenkins_jobs.builder:Job name:  jenkins-tools/swh-jenkins-dockerfiles
+INFO:jenkins_jobs.builder:Job name:  swh-docker-dev
+<?xml version="1.0" encoding="utf-8"?>
+<project>
+  <actions/>
+  <description>Clean old Docker objects&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <assignedNode>master</assignedNode>
+  <canRoam>false</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>7</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@midnight</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>docker system prune --filter 'label!=keep' --volumes --force</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers/>
+  <buildWrappers/>
+</project>
+<?xml version="1.0" encoding="utf-8"?>
+<project>
+  <actions/>
+  <description>&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <authToken>ph4br1cat0r</authToken>
+  <concurrentBuild>false</concurrentBuild>
+  <assignedNode>master</assignedNode>
+  <canRoam>false</canRoam>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>7</daysToKeep>
+        <numToKeep>-1</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+  </properties>
+  <scm class="hudson.plugins.git.GitSCM">
+    <configVersion>2</configVersion>
+    <userRemoteConfigs>
+      <hudson.plugins.git.UserRemoteConfig>
+        <name>origin</name>
+        <refspec>+refs/heads/*:refs/remotes/origin/*</refspec>
+        <url>http://forge.softwareheritage.org/source/swh-jenkins-dockerfiles.git</url>
+      </hudson.plugins.git.UserRemoteConfig>
+    </userRemoteConfigs>
+    <branches>
+      <hudson.plugins.git.BranchSpec>
+        <name>**</name>
+      </hudson.plugins.git.BranchSpec>
+    </branches>
+    <disableSubmodules>false</disableSubmodules>
+    <recursiveSubmodules>false</recursiveSubmodules>
+    <doGenerateSubmoduleConfigurations>false</doGenerateSubmoduleConfigurations>
+    <remotePoll>false</remotePoll>
+    <gitTool>Default</gitTool>
+    <submoduleCfg class="list"/>
+    <reference/>
+    <gitConfigName/>
+    <gitConfigEmail/>
+    <extensions/>
+  </scm>
+  <triggers class="vector">
+    <hudson.triggers.SCMTrigger>
+      <spec>H/30 * * * *</spec>
+      <ignorePostCommitHooks>false</ignorePostCommitHooks>
+    </hudson.triggers.SCMTrigger>
+    <hudson.triggers.TimerTrigger>
+      <spec>@daily</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>make checkrebuild all</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers/>
+  <buildWrappers>
+    <hudson.plugins.timestamper.TimestamperBuildWrapper/>
+    <hudson.plugins.ansicolor.AnsiColorBuildWrapper>
+      <colorMapName>xterm</colorMapName>
+    </hudson.plugins.ansicolor.AnsiColorBuildWrapper>
+  </buildWrappers>
+</project>
+INFO:jenkins_jobs.builder:Number of views generated:  0
+<?xml version="1.0" encoding="utf-8"?>
+<project>
+  <actions/>
+  <description>Build the swh/stack:latest image&lt;!-- Managed by Jenkins Job Builder --&gt;</description>
+  <keepDependencies>false</keepDependencies>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <concurrentBuild>false</concurrentBuild>
+  <assignedNode>master</assignedNode>
+  <canRoam>false</canRoam>
+  <properties/>
+  <scm class="hudson.plugins.git.GitSCM">
+    <configVersion>2</configVersion>
+    <userRemoteConfigs>
+      <hudson.plugins.git.UserRemoteConfig>
+        <name>origin</name>
+        <refspec>+refs/heads/*:refs/remotes/origin/*</refspec>
+        <url>https://forge.softwareheritage.org/source/swh-environment.git</url>
+      </hudson.plugins.git.UserRemoteConfig>
+    </userRemoteConfigs>
+    <branches>
+      <hudson.plugins.git.BranchSpec>
+        <name>*/master</name>
+      </hudson.plugins.git.BranchSpec>
+    </branches>
+    <disableSubmodules>false</disableSubmodules>
+    <recursiveSubmodules>false</recursiveSubmodules>
+    <doGenerateSubmoduleConfigurations>false</doGenerateSubmoduleConfigurations>
+    <remotePoll>false</remotePoll>
+    <gitTool>Default</gitTool>
+    <submoduleCfg class="list"/>
+    <reference/>
+    <gitConfigName/>
+    <gitConfigEmail/>
+    <extensions>
+      <hudson.plugins.git.extensions.impl.WipeWorkspace/>
+    </extensions>
+  </scm>
+  <triggers class="vector">
+    <hudson.triggers.TimerTrigger>
+      <spec>@midnight</spec>
+    </hudson.triggers.TimerTrigger>
+  </triggers>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>#!/bin/bash
+cd docker
+docker build --pull --no-cache -t swh/stack .
+tox
+</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers>
+    <hudson.tasks.ArtifactArchiver>
+      <artifacts>docker/**/*.logs</artifacts>
+      <allowEmptyArchive>true</allowEmptyArchive>
+      <onlyIfSuccessful>false</onlyIfSuccessful>
+      <fingerprint>false</fingerprint>
+      <defaultExcludes>true</defaultExcludes>
+      <caseSensitive>true</caseSensitive>
+      <latestOnly>false</latestOnly>
+    </hudson.tasks.ArtifactArchiver>
+  </publishers>
+  <buildWrappers>
+    <hudson.plugins.build__timeout.BuildTimeoutWrapper>
+      <strategy class="hudson.plugins.build_timeout.impl.AbsoluteTimeOutStrategy">
+        <timeoutMinutes>30</timeoutMinutes>
+      </strategy>
+      <operationList>
+        <hudson.plugins.build__timeout.operations.AbortOperation/>
+      </operationList>
+    </hudson.plugins.build__timeout.BuildTimeoutWrapper>
+    <hudson.plugins.timestamper.TimestamperBuildWrapper/>
+  </buildWrappers>
+</project>
+___________________________________ summary ____________________________________
+  test: commands succeeded
+  congratulations :)