Re: Mutable Git tags & Software Heritage

[zimoun <zimon.toutoune@gmail.com>]

Hi,

On Fri, 29 Oct 2021 at 16:12, Ludovic Courtès <ludo@gnu.org> wrote:

>> At package time, Guix uses tag.  Then “guix lint” saves the upstream
>> repo; containing the correct tag.  Now, upstream replaces in-place the
>> tag and saves to SWH by their own.  How does SWH deal with this case?
>
> SWH records the “history of the history”.  It can tell you what the tag
> pointed to at the time of a specific snapshot.
>
> However our fallback code picks the tag as it exists in the latest
> snapshot, and thus it could pick “the wrong one” if the tag was modified
> over time.

Ah yes.  Once read, it seems obvious. :-)  Thanks for explaining.

>> Well, because it is not affordable to switch from the current
>> tag-address to immutable commit-address for defining packages, in order
>> to be 100% reliable, any fallback should use Disarchive-DB which stores
>> the mapping from checksum to swhid; for all kind origins.
>>
>> Is it what you have in mind?
>
> No, I think we should consider always referring to commits instead of
> tags.  It’s annoying from a readability viewpoint, but it would ensure
> reproducibility.  Even flatpak has this policy.  :-)

Ah, IMHO, «it is not affordable to switch from the current tag-address
to immutable commit-address for defining packages, in order to be 100%
reliable» :-)

Do you think the switch from tag to commit instead is really doable?

Other said, do you think it should be possible to automatize such task?

Because from my experience, it had been long and quite boring to
manually clean various R packages from various location to correct ones
(Bioconductor, CRAN, etc.).  Cleaning Python2 is also something.  I
mean, it is not doable manually, IMHO.

Cheers,
simon

PS: Ah, refer to commit instead of tags could be a RFC. ;-)