In the paper Compact Lattice Gadget and Its Applications to Hash-and-Sign Signatures, the preimage sampling boils down to only n times sampling of $D_{q\mathbb{Z}+c,r}$. How can we obtain a sample from the specific distribution?
My idea is sampling a sample $x^\prime$ from $D_{0,r}$, and then compute $x = q*x^\prime + c$. But this process seems to lead to inconsistent expectation.
