unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
* bug#28745: tarballs generated on github are generated on demand (leading to different hash sums)
@ 2017-10-08 11:40 ng0
  2017-10-08 11:44 ` ng0
                   ` (2 more replies)
  0 siblings, 3 replies; 8+ messages in thread
From: ng0 @ 2017-10-08 11:40 UTC (permalink / raw)
  To: 28745

[-- Attachment #1: Type: text/plain, Size: 1061 bytes --]

Past and recent discussion in our IRC channel and on the mailing list
show that we can not rely on tarballs on github keeping the same
hash forever.
According to github they are "generated on demand", leading to
regular hash mismatches.

Since some of our own dependencies are on github (at the very least
guile-git), we need to come up with a solution.

Right now we have around 449 packages with tarball sources from
github in our gnu/packages.
We could:

- Move them all to use git-download and just use
  the commit that has been tagged in the versions that produce
  the tarballs on github.

- Mirror the content somewhere reliable in snapshots for
  some time. Problem here: we start to rely on this "somewhere"
  to be trustworthy and introduce one more point to trust
  (however due to pre-recorded hash sum this is just an annoyance,
  not a grave issue).

- Your idea here.

-- 
ng0
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://dist.krosos.org/dist/keys/
https://www.infotropique.org https://krosos.org

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2017-10-22 13:59 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-10-08 11:40 bug#28745: tarballs generated on github are generated on demand (leading to different hash sums) ng0
2017-10-08 11:44 ` ng0
2017-10-08 21:18   ` Jan Nieuwenhuizen
2017-10-08 21:58 ` Ricardo Wurmus
2017-10-16  3:10 ` bug#28745: [PATCH] " Maxim Cournoyer
2017-10-20 21:04   ` Ludovic Courtès
2017-10-22  3:13     ` Maxim Cournoyer
2017-10-22 10:48     ` Ricardo Wurmus

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).