From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2.migadu.com ([2001:41d0:403:58f0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms8.migadu.com with LMTPS id yOvMBqwn9mUfOQAAe85BDQ:P1 (envelope-from ) for ; Sun, 17 Mar 2024 00:13:48 +0100 Received: from aspmx1.migadu.com ([2001:41d0:403:58f0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2.migadu.com with LMTPS id yOvMBqwn9mUfOQAAe85BDQ (envelope-from ) for ; Sun, 17 Mar 2024 00:13:48 +0100 X-Envelope-To: larch@yhetil.org Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=planete-kraus.eu header.s=albinoniA header.b=MBTHmUUI; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org"; dmarc=pass (policy=reject) header.from=planete-kraus.eu ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1710630828; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post:dkim-signature; bh=BBzNc1pCFxAbgasNHryvjmgERdq/tpS5PrPtlAiy3B4=; b=HyvXxBVQsq/65dmtXxWFnX7tFl85yN1A6pB68uq6r1WtznHJXTs+c6oYJh7Ud+CA6+MLzM HmEv5WSkMELX7uqIf7nlNEMQoIemlZqhapDl6GuqzcZQ3BnwUbBpzvxu8X782bj+bwKZ5A WsUHe7tOWaLmAQVVwo5DddVyMgnKNG/4qnM4UkPlM6jVC2oMro7LA/hUWstgr1jzaMTuGh ZtsuUlrovjC2/q/P/Uzx+A0yzESm7hJ+egVEz14McgKzpEtBVxYobnigkpqvbxdIhcgsw1 yCYpuMhsp+LHofUO/G0zS0J6aLfpYlIyp3/yXQzBrtGUlUq0QRCOD0nyVugrhg== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1710630828; a=rsa-sha256; cv=none; b=Zac2FF3d3l00lk6hb8IPdtziXOBJxxvJq1GAX8WnxSi96ENmfhGSuM5bvEJMUfRczkz+FU Wfcc8YAiLZEpR/l8otdgSZQpALtf1DO2HWT1uZYdD6r6yrTqG/l5ducWuBaRwC2rri9eNL IwR4DBb9q2hCjrvXX6mFtB1Dpp9X3SQVMe9oz3jc78zBvHNsNxmqENvK03IR+n08vk1Jv2 9clHUeJM1EmQGkdhfbXgW00VBLSAqyyDD5AS46OgtwkeY3z9AjxnAoSAtSfZiHIdHnpjI3 nKWnZVDs1HQlDoqLbgfKRAYVEzxzYdY+5yYyq9vKu9lYG5F8wTKeeLflfesGug== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=pass header.d=planete-kraus.eu header.s=albinoniA header.b=MBTHmUUI; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org"; dmarc=pass (policy=reject) header.from=planete-kraus.eu Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id A4F554633C for ; Sun, 17 Mar 2024 00:13:47 +0100 (CET) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rldDF-0000h2-Hl; Sat, 16 Mar 2024 19:13:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rldDE-0000gj-DL for guix-devel@gnu.org; Sat, 16 Mar 2024 19:13:12 -0400 Received: from planete-kraus.eu ([89.234.140.182]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_CHACHA20_POLY1305:256) (Exim 4.90_1) (envelope-from ) id 1rldDC-0001Le-C2 for guix-devel@gnu.org; Sat, 16 Mar 2024 19:13:12 -0400 Received: from planete-kraus.eu (localhost [127.0.0.1]) by planete-kraus.eu (OpenSMTPD) with ESMTP id a7ea1f4d; Sat, 16 Mar 2024 23:13:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=planete-kraus.eu; h= message-id:subject:from:to:cc:date:in-reply-to:references :content-type:content-transfer-encoding:mime-version; s= albinoniA; bh=U/nRElbGZvjIc7vo6vbQUTo/du8=; b=MBTHmUUIq833CbA+Cm Hz0TzBpJeNh8S4Oz7hW9jeGjYEeksu+FMF1PUQO6sxKyLbAiZZ10653mYe4tj4xV CjSERb3pEKgrruZvj00TzK+fx+Ux+wyVvXfKyQCHJHRbB+ybrBEv5me3yxRNmWdS KfuqsdDs4hNyVVfPwqCYlCtLHw5MTM9/tRxlTyAbI4b5JIhFiwLFAfmNXepdfmgJ jHC1bPkfaUNyj6smj254TwzrwIs3IRM+aZSeqnCZT9fN0HhsdIvLix9XB7hxDFAn ZFXy5SHLd/73hDIUFSb0XdfyoDiuEUsLM1asreO9N1cEPiRtcddz1/McHC4bIRew wS5A== Received: by planete-kraus.eu (OpenSMTPD) with ESMTPSA id a499ac26 (TLSv1.3:TLS_CHACHA20_POLY1305_SHA256:256:NO); Sat, 16 Mar 2024 23:13:06 +0000 (UTC) Message-ID: Subject: Re: Concerns/questions around Software Heritage Archive From: Vivien Kraus To: Christopher Baines , Ian Eure Cc: guix-devel@gnu.org Date: Sun, 17 Mar 2024 00:16:26 +0100 In-Reply-To: <87cyruqcfe.fsf@cbaines.net> References: <87il1mupco.fsf@meson> <87cyruqcfe.fsf@cbaines.net> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.48.4 MIME-Version: 1.0 Received-SPF: pass client-ip=89.234.140.182; envelope-from=vivien@planete-kraus.eu; helo=planete-kraus.eu X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: guix-devel-bounces+larch=yhetil.org@gnu.org X-Migadu-Flow: FLOW_IN X-Migadu-Country: US X-Migadu-Spam-Score: -9.46 X-Spam-Score: -9.46 X-Migadu-Queue-Id: A4F554633C X-Migadu-Scanner: mx11.migadu.com X-TUID: USJMk0zE6Jt+ Hello! Le samedi 16 mars 2024 =C3=A0 17:50 +0000, Christopher Baines a =C3=A9crit= =C2=A0: > This is probably worth thinking about as Guix is in a similar > situation > regarding publishing source code, and people potentially wanting to > change historical source code both in things Guix packages and Guix > itself. I see two problems: 1. providing packages; 2. developing Guix itself. I am sure that 1. is not a real problem, we could just ask the developer to release a new version incrementing the patch number, upgrade it on our side, and forget the old version. Garbage collection would ultimately get rid of the old tarballs. 2. is more difficult, because Guix contributors sometimes change their names too, and a commit reading =E2=80=9Cupdate my name=E2=80=9D is not the= best solution. If I understand correctly, rewriting the history would be understood as a =E2=80=9Cdowngrade attack=E2=80=9D, contrary to the ftfy ca= se where the developer could rewrite the history without such consequences. Is my understanding correct?