From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alex Kost Subject: Re: Source tarballs from PyPI versus tarballs from the individual project websites Date: Wed, 12 Oct 2016 10:49:04 +0300 Message-ID: <87vawyvwgf.fsf@gmail.com> References: Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:45717) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1buEHm-00026H-E8 for guix-devel@gnu.org; Wed, 12 Oct 2016 03:49:11 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1buEHh-00007T-3A for guix-devel@gnu.org; Wed, 12 Oct 2016 03:49:09 -0400 Received: from mail-lf0-x235.google.com ([2a00:1450:4010:c07::235]:35771) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1buEHg-00007L-RK for guix-devel@gnu.org; Wed, 12 Oct 2016 03:49:05 -0400 Received: by mail-lf0-x235.google.com with SMTP id l131so32470591lfl.2 for ; Wed, 12 Oct 2016 00:49:04 -0700 (PDT) In-Reply-To: (Arun Isaac's message of "Wed, 12 Oct 2016 11:46:17 +0530") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Arun Isaac Cc: "guix-devel@gnu.org" Arun Isaac (2016-10-12 11:46 +0530) wrote: > When packaging python packages, why are we using the source tarballs > hosted on PyPI, rather than using the source tarballs hosted on the > websites of the individual projects? > > For example, for the package python-pycrypto, why are we using the > tarball from PyPI > https://pypi.python.org/packages/source/p/pycrypto/pycrypto-2.6.1.tar.gz > instead of the tarball from the pycrypto project website > https://ftp.dlitz.net/pub/dlitz/crypto/pycrypto/pycrypto-2.6.1.tar.gz ? > > Using the PyPI tarball seems to make Guix dependent on another package > repository -- namely, PyPI. That seems to me a bad thing. > > I have packaged a few python packages using the tarballs from their > respective project websites. Should I change them to use the PyPI > tarballs before contributing the package definitions to Guix? Which > tarball should I prefer? As for me, I always prefer tarballs directly from the upstream. So I wouldn't change those packages to use PyPi sources. -- Alex