bug#39575: guix time-machine fails when a tarball was modified in-place

[Efraim Flashner <efraim@flashner.co.il>]

[-- Attachment #1: Type: text/plain, Size: 1845 bytes --]

On Mon, Feb 17, 2020 at 09:47:41AM +0100, zimoun wrote:
> Hi,
> 
> On Sat, 15 Feb 2020 at 21:01, Tobias Geerinckx-Rice <me@tobias.gr> wrote:
> 
> > Janneke 写道：
> > > https://snapshot.debian.org/archive/debian/20190406T212022Z/pool/main/h/harfbuzz/harfbuzz_2.4.0.orig.tar.bz2
> >
> > This is a wonderful resource!  Thank you, Janneke (and Debian)!
> >
> > zimoun 写道：
> > > Cool!
> > > But how do you determine the "date", i.e., this reference
> > > '20190406T212022Z' ?
> >
> > You'd take the timestamp immediately preceding your desired (Guix)
> > commit's date, or something like that.  The fact that git commit
> > dates aren't linear shouldn't hurt here.
> 
> You assume that Debian packs packages as fast as Guix, I mean on the
> same schedule which is a strong assumption IMHO.
> For example, if it was the contrary and the "new" release of harfbuzz
> 2.4.0 were missing, then would Debian be helpful?
> 
> 

We could first try
mirror://debian/pool/main/harfbuzz/harfbuzz_2.4.0.orig.tar.bz2

and then scrape https://snapshot.debian.org/package/harfbuzz/ for
2.4.0-1 and then parse the website for harfbuzz_2.4.0.orig.tar.bz2. Or
for just 'orig.tar'

> > Also, this doesn't seem to be a supported service yet[0]:
> >
> >   “This is an implementation for a possible snapshot.debian.org
> >   service.
> >    It's not yet finished, it's more a prototype/proof of concept
> >    to show
> >    and learn what we want and can provide.  So far it seems to
> >    actually work.”
> >
> > Still really cool,
> 
> Yes, still cool! :-)
> 
> 
> Thanks,
> simon
> 
> 
> 

-- 
Efraim Flashner   <efraim@flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]