From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id KKyLJzNxfWGDSwEAgWs5BA (envelope-from ) for ; Sat, 30 Oct 2021 18:22:11 +0200 Received: from aspmx1.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id QHkZIzNxfWGEKQAAbx9fmQ (envelope-from ) for ; Sat, 30 Oct 2021 16:22:11 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 5F53A1C596 for ; Sat, 30 Oct 2021 18:22:11 +0200 (CEST) Received: from localhost ([::1]:45636 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mgr7S-0007Np-71 for larch@yhetil.org; Sat, 30 Oct 2021 12:22:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:49490) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mgr79-0007Ea-OC for guix-devel@gnu.org; Sat, 30 Oct 2021 12:21:51 -0400 Received: from mail-wm1-x32a.google.com ([2a00:1450:4864:20::32a]:44856) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1mgr77-0007Zm-Gi; Sat, 30 Oct 2021 12:21:51 -0400 Received: by mail-wm1-x32a.google.com with SMTP id c71-20020a1c9a4a000000b0032cdcc8cbafso6117465wme.3; Sat, 30 Oct 2021 09:21:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:in-reply-to:references:date:message-id :mime-version:content-transfer-encoding; bh=BKHOFDj7Cxe1hEvLbpOdnaoP09DgXvtczAma8T8cx1o=; b=dXq/FYIcTDZ73FfgCWFE1obQAE5jsHXftOUOJyZ7X1I0c7IB+U0QZJn2GaF5xN0EY1 ya+8PYXfZbS79h9XkWlyu+SKURp34oij9kBz8DfvhGj4+THczugkeovv26YuG64Odfmv QYyCbLjRMHwtxk0RYnxe7n8QUa+iDpUwgnz7usEGC577cDtS191RPcH7FHHLzc/qnOZA Z13SPIVHr4Vs9gRF2yRjgZZ30aHe4odv3nmRQ5TXyP+6teIWsDA7RRTAZHWoizjSyZ1B kwuvc7VJizD9NuvU3/oHCVrOUQWBLH5exixnw4Q1fqRI7Be4hBuu7heRw7OWf280ARpS H6Jw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:in-reply-to:references:date :message-id:mime-version:content-transfer-encoding; bh=BKHOFDj7Cxe1hEvLbpOdnaoP09DgXvtczAma8T8cx1o=; b=cUnEDJNeKLMNfZzUNndMCoIc3UCmEcA+AH0xOx2MDqU7qHufzkWwwB9LjeQOUq9DY2 zxb8MlH33G7kH9QOG1J7HCxaBNICZdU/sVnU1ZrxNNWFZBnRPqfp/1LrCgK9MclyKDu9 9BfeIufxmcwa9o/6kqevWJ9iB9/g7evI5uLunpM9QsSgtYV+iu/eg0WFWJOcJFkedofR eGgDaTAK4TEjrpvq45TGNKen+So9RFD1/AueCplPMvHoOlDUaAtDzWtbnCrvsdHPu6Hk NmxT3/fgqxeR4PQfyv2USB3rowoD4+kq+98JzBzVUt2gzDuVMvl0K45GX/Dn8zv5IVWF HmYQ== X-Gm-Message-State: AOAM533BvxF67ljrapR5VS+PFVxu0GlguZkFB4hTyu1VkqqpS5y1kF9H RbtRyKlAcD1m1STzq0Pg6je7kCOE7Rw= X-Google-Smtp-Source: ABdhPJyXVuV9hrKE9F0pl6srABP61YpSfepemkkVQkxrjr2NS6T/UZ9ZsYTgwHhpTdi33qDjpxIZxQ== X-Received: by 2002:a05:600c:17c3:: with SMTP id y3mr285312wmo.136.1635610907715; Sat, 30 Oct 2021 09:21:47 -0700 (PDT) Received: from lili ([2a01:e0a:59b:9120:65d2:2476:f637:db1e]) by smtp.gmail.com with ESMTPSA id n10sm10149148wmq.24.2021.10.30.09.21.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 Oct 2021 09:21:47 -0700 (PDT) From: zimoun To: Ludovic =?utf-8?Q?Court=C3=A8s?= Subject: Re: Mutable Git tags & Software Heritage In-Reply-To: <87mtmr2a3t.fsf_-_@gnu.org> References: <87o87jjx54.fsf@ngyro.com> <87a6j2w1et.fsf@gnu.org> <86ilxpzeap.fsf@gmail.com> <87mtmr2a3t.fsf_-_@gnu.org> Date: Sat, 30 Oct 2021 18:19:55 +0200 Message-ID: <86ee82jxhw.fsf@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Received-SPF: pass client-ip=2a00:1450:4864:20::32a; envelope-from=zimon.toutoune@gmail.com; helo=mail-wm1-x32a.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: guix-devel@gnu.org Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1635610931; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post:dkim-signature; bh=BKHOFDj7Cxe1hEvLbpOdnaoP09DgXvtczAma8T8cx1o=; b=Sk93B0SYi/9ciek4mjbZGUAfo+jliLEh1gh7G+V7Xpu4bRNjSMPI/BgxdEcQKCGMYG/21m yJ87D3qmVptp53Sy4CHfD3fSlLOj26Q8/ousQLx97uv27HP0MZO1ekE+diTpXV0tzH0+Km xy9PrQEg2jrXIzIuyPUO3exSu9GCOmEDleeVTArMRIcD7uKVhbRxHAylayB75x1IhNyOT3 P/t82RhNVZH5IJowugWI2sNlV9z1ijju83u1OQ4WxrLQAW6O3gI5W1+Pt92EQmhbLP8Qds DspX+rdwC2VIevO7zd5Ognr5Qq5F/4L93CwXIAFrN1qNfVtlVDbZ5R/6mPYA7w== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1635610931; a=rsa-sha256; cv=none; b=NIAwfJ9H3CDzI2YFZLv3Pw8g6kWycdwdT38emRkLa1z5yBmJ1RUl4FgzjMmKbsNRrpmr3N NFeSAW/RBW3SY+VDBzOiPFV6VVjrd6E42rT0jArkGkQH6od9jOQBKg7HYfb6w+/FIFQs0p o4LJsYwozJ4oSo1l0nBo3nSdn4CDRqK+HekyoR33qaPmyIvwtxgpzkKOcX9UwXbhkZQH2J UXWqSic81ysLStXklmHi7a+2j22r5attnbz3vcGBxn6DFBrhjmd8ZD/E4aayZQW5DAlSev /AY/8m1SUz/Dqx+7u+T/iMQn/9+VwFc0kKuBRGOepPZr3MzrrBj6REzOi4VVpg== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=gmail.com header.s=20210112 header.b="dXq/FYIc"; dmarc=fail reason="SPF not aligned (relaxed)" header.from=gmail.com (policy=none); spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Spam-Score: -1.32 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=gmail.com header.s=20210112 header.b="dXq/FYIc"; dmarc=fail reason="SPF not aligned (relaxed)" header.from=gmail.com (policy=none); spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Queue-Id: 5F53A1C596 X-Spam-Score: -1.32 X-Migadu-Scanner: scn0.migadu.com X-TUID: ISlUcfSs3sJc Hi, On Fri, 29 Oct 2021 at 16:12, Ludovic Court=C3=A8s wrote: >> At package time, Guix uses tag. Then =E2=80=9Cguix lint=E2=80=9D saves = the upstream >> repo; containing the correct tag. Now, upstream replaces in-place the >> tag and saves to SWH by their own. How does SWH deal with this case? > > SWH records the =E2=80=9Chistory of the history=E2=80=9D. It can tell yo= u what the tag > pointed to at the time of a specific snapshot. > > However our fallback code picks the tag as it exists in the latest > snapshot, and thus it could pick =E2=80=9Cthe wrong one=E2=80=9D if the t= ag was modified > over time. Ah yes. Once read, it seems obvious. :-) Thanks for explaining. >> Well, because it is not affordable to switch from the current >> tag-address to immutable commit-address for defining packages, in order >> to be 100% reliable, any fallback should use Disarchive-DB which stores >> the mapping from checksum to swhid; for all kind origins. >> >> Is it what you have in mind? > > No, I think we should consider always referring to commits instead of > tags. It=E2=80=99s annoying from a readability viewpoint, but it would e= nsure > reproducibility. Even flatpak has this policy. :-) Ah, IMHO, =C2=ABit is not affordable to switch from the current tag-address to immutable commit-address for defining packages, in order to be 100% reliable=C2=BB :-) Do you think the switch from tag to commit instead is really doable? Other said, do you think it should be possible to automatize such task? Because from my experience, it had been long and quite boring to manually clean various R packages from various location to correct ones (Bioconductor, CRAN, etc.). Cleaning Python2 is also something. I mean, it is not doable manually, IMHO. Cheers, simon PS: Ah, refer to commit instead of tags could be a RFC. ;-)