run lintian by default after successful builds

Dockerfile

@@ -5,18 +5,19 @@ ENV LANG=C.UTF-8 \
     DEBIAN_FRONTEND=noninteractive
 
 # install the minimum needed for a standard git-buildpackage build
-# that includes pristine-tar. update-alternatives needs ../man1/
+# that includes pristine-tar.
+#
+# * update-alternatives needs ../man1/
+# * ca-certificates for fetching from HTTPS repos
 RUN mkdir -p /usr/share/man/man1 \
 	&& apt-get update \
 	&& apt-get -qy upgrade \
 	&& apt-get -qy dist-upgrade \
 	&& apt-get -qy install --no-install-recommends \
-		build-essential \
 		ca-certificates \
-		dpkg-dev \
 		fakeroot \
-		git \
 		git-buildpackage \
+		lintian \
 		pristine-tar \
 	&& apt-get -qy autoremove --purge \
 	&& apt-get clean \

gitlab-ci-git-buildpackage

@@ -21,7 +21,7 @@ if [[ ! -f $lockfile ]] ; then
         # this is running on an older version, like jessie-backports
         export BUILD_DEPENDS=`sed 's/\s*|[^,]*,/,/g' debian/control | perl -ne 'next if /^#/; $p=(s/^Build-Depends:\s*/ / or (/^ / and $p)); s/,|\n|\([^)]+\)//mg; print if $p'`
         apt-get -qy install --no-install-recommends \
-                build-essential dpkg-dev fakeroot git-buildpackage pristine-tar $BUILD_DEPENDS
+                build-essential fakeroot git-buildpackage pristine-tar $BUILD_DEPENDS
     fi
     apt-get -qy autoremove --purge
     dpkg-checkbuilddeps
@@ -35,6 +35,11 @@ if [[ ! -f $lockfile ]] ; then
     else
         gbp buildpackage -uc -us
     fi
+
+    echo "performing general and experimental lintian checks"
+    su --shell /bin/sh nobody --command "lintian --color always -EviIL +pedantic ../*.changes" || true
+    echo "performing ftp-master-rejects lintian checks"
+    su --shell /bin/sh nobody --command "lintian --color always -viF ../*.changes"
 fi
 
 [[ $CI ]] && touch $lockfile