5.11.2. NMUs and debian/changelog

Just like any other (source) upload, NMUs must add an entry to debian/changelog, telling what has changed with this upload. The first line of this entry must explicitly mention that this upload is an NMU, e.g.:

  1. * Non-maintainer upload.

The way to version NMUs differs for native and non-native packages.

If the package is a native package (without a Debian revision in the version number), the version must be the version of the last maintainer upload, plus +nmuX, where X is a counter starting at 1. If the last upload was also an NMU, the counter should be increased. For example, if the current version is 1.5, then an NMU would get version 1.5+nmu1.

If the package is not a native package, you should add a minor version number to the Debian revision part of the version number (the portion after the last hyphen). This extra number must start at 1. For example, if the current version is 1.5-2, then an NMU would get version 1.5-2.1. If a new upstream version is packaged in the NMU, the Debian revision is set to 0, for example 1.6-0.1.

In both cases, if the last upload was also an NMU, the counter should be increased. For example, if the current version is 1.5+nmu3 (a native package which has already been NMUed), the NMU would get version 1.5+nmu4.

A special versioning scheme is needed to avoid disrupting the maintainer’s work, since using an integer for the Debian revision will potentially conflict with a maintainer upload already in preparation at the time of an NMU, or even one sitting in the ftp NEW queue. It also has the benefit of making it visually clear that a package in the archive was not made by the official maintainer.

If you upload a package to testing or stable, you sometimes need to “fork” the version number tree. This is the case for security uploads, for example. For this, a version of the form +debXuY should be used, where X is the major release number, and Y is a counter starting at 1. For example, while buster (Debian 10) is stable, a security NMU to stable for a package at version 1.5-3 would have version 1.5-3+deb10u1, whereas a security upload to bullseye would get version 1.5-3+deb11u1.