From da81117c98c23f071fff137c83ef705cfe5adde8 Mon Sep 17 00:00:00 2001
From: ofek <ofekv9652@gmail.com>
Date: Fri, 9 Oct 2026 21:18:58 +0300
Subject: [PATCH 1/2] ci: set explicit Debian maintainer identity so
 bot-authored PRs pass package gate

---
 .github/workflows/ci.yml      | 4 ++++
 .github/workflows/release.yml | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f673faa..acef533 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,6 +23,10 @@ jobs:
     env:
       WRAITH_REQUIRE_PTRACE: "1"
       CARGO_TERM_COLOR: always
+      # package_deb.sh otherwise derives maintainer identity from the HEAD commit
+      # author; dependabot[bot] fails its e-mail validation.
+      DEBFULLNAME: grloper
+      DEBEMAIL: ofekv9652@gmail.com
     steps:
       - uses: actions/checkout@v4
       - name: Install selected Rust toolchain
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 598bd50..d5bb0f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,6 +12,9 @@ jobs:
   linux-x86_64:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
+    env:
+      DEBFULLNAME: grloper
+      DEBEMAIL: ofekv9652@gmail.com
     steps:
       - uses: actions/checkout@v4
       - name: Install stable Rust

From 9445310e399ea58c80523158e624b7d4aebc6abe Mon Sep 17 00:00:00 2001
From: grloper <ofekv9652@gmail.com>
Date: Fri, 9 Oct 2026 21:51:51 +0300
Subject: [PATCH 2/2] ci: read maintainer identity from repo variables; fail
 clearly if DEBEMAIL unset

---
 .github/workflows/ci.yml      | 12 +++++++++---
 .github/workflows/release.yml | 10 ++++++++--
 CONTRIBUTING.md               |  7 +++++++
 3 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index acef533..6474f3e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,11 +24,17 @@ jobs:
       WRAITH_REQUIRE_PTRACE: "1"
       CARGO_TERM_COLOR: always
       # package_deb.sh otherwise derives maintainer identity from the HEAD commit
-      # author; dependabot[bot] fails its e-mail validation.
-      DEBFULLNAME: grloper
-      DEBEMAIL: ofekv9652@gmail.com
+      # author; dependabot[bot] fails its e-mail validation. Configure repo variable DEBEMAIL.
+      DEBFULLNAME: ${{ vars.DEBFULLNAME || 'grloper' }}
+      DEBEMAIL: ${{ vars.DEBEMAIL }}
     steps:
       - uses: actions/checkout@v4
+      - name: Require maintainer identity
+        run: |
+          if [ -z "${DEBEMAIL}" ]; then
+            echo "::error::Set repository variable DEBEMAIL (Settings > Secrets and variables > Actions > Variables)"
+            exit 1
+          fi
       - name: Install selected Rust toolchain
         run: |
           rustup toolchain install ${{ matrix.toolchain }} --profile minimal --component clippy --component rustfmt
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d5bb0f4..9aa164f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,10 +13,16 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     env:
-      DEBFULLNAME: grloper
-      DEBEMAIL: ofekv9652@gmail.com
+      DEBFULLNAME: ${{ vars.DEBFULLNAME || 'grloper' }}
+      DEBEMAIL: ${{ vars.DEBEMAIL }}
     steps:
       - uses: actions/checkout@v4
+      - name: Require maintainer identity
+        run: |
+          if [ -z "${DEBEMAIL}" ]; then
+            echo "::error::Set repository variable DEBEMAIL (Settings > Secrets and variables > Actions > Variables)"
+            exit 1
+          fi
       - name: Install stable Rust
         run: |
           rustup toolchain install stable --profile minimal --component clippy --component rustfmt
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 264d38b..f26149a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -57,3 +57,10 @@ post vulnerabilities in public issues; see [SECURITY.md](SECURITY.md).
 A false-positive report should include the Wraith version, kernel, invocation,
 minimal benign reproducer and redacted events. A performance report should include
 baseline and traced timings, sample count, workload and hardware—not only a ratio.
+
+## CI maintainer identity
+
+The Debian package gate requires a real maintainer contact. CI reads the
+repository variables `DEBEMAIL` (required) and `DEBFULLNAME` (defaults to
+`grloper`), set under Settings > Secrets and variables > Actions > Variables.
+For local runs, export `DEBEMAIL` and `DEBFULLNAME` before `scripts/verify.sh`.