bug#21784: Old XZ tarballs

[ludo@gnu.org (Ludovic Courtès)]

Lasse Collin <lasse.collin@tukaani.org> skribis:

> On 2015-10-30 Ludovic Courtès wrote:

[...]

>> Guix does automatically mirror tarballs via its “substitute”
>> mechanism. However, users can turn it off, in which case they end up
>> downloading the tarball from the upstream URL specified in the
>> package recipe.
>
> OK. :-) Why would users turn it off though?

The substitute mechanism is very generic; it’s not just about mirroring
tarballs:

  http://www.gnu.org/software/guix/manual/html_node/Substitutes.html

Some people might prefer to build things locally rather than download
pre-built items.

> I would guess that one good mirror would be more reliable than dozens
> of upstream sites of which just one needs to be down to be a problem
> for a user. A package manager should know the hash or signature of the
> file, so from security point of view it doesn't matter where the file
> comes.

Yes exactly, all we need is to mirror it somewhere.

>> > By the way, is there a reason why you use 5.0.4 instead of 5.0.8 (or
>> > even 5.2.2)?
>> 
>> No good reason!  We’ll upgrade it as soon as this can be done without
>> triggering too much rebuild/redownloads for users.
>
> API/ABI is backward compatible so one shouldn't need to rebuild other
> packages. There's a mailing list "xz-announce" in case you want a
> notification when a new version is released:
> <http://tukaani.org/xz/lists.html>

Noted, thanks!

Ludo’.