Re: [Chicken-janitors] release management

[Peter Bex]

On Sat, Mar 08, 2008 at 10:25:35AM -0800, Elf wrote:
> 
> ivan and others:
> 
> we need to discuss release management cycles.
> 
> we also need warning when release tags will change.

A little more background might be in order:

Today we got a visit from someone who maintains a chicken package
for the pkgsrc package managing system.  His package was for Chicken 3.0.0.
Apparently the 3.0.0 tarball linked to from the homepage got changed
so the checksum in pkgsrc did not match anymore and this made the package
break.

The pkgsrc system requires you to make a checksum of a tarball you made
a package for, so you can get a warning when someone roots a distribution
server of some program (or some angry developer puts up a trojaned version
of a package, or whatever).  Some projects have also been known to silently
replace a tarball of a version with a new version with bugfixes.  However,
this can break a build because pkgsrc can also include patches or other
specifics about the installed program that are not guaranteed to stay
constant given other sources.  In any case, pkgsrc complains loudly and
refuses to install a package if the sources' checksum have changed.

So we need some way to *guarantee* that once a release is made, that
particular version on the website will stay forever frozen.  This will
make package maintainers' lives a lot easier.  Not fixing this is bad for
Chicken, because if this is not fixed, distributions may decide they
prefer not to package Chicken if it's too much hassle.

I'm not sure how releases are currently managed, but we need to remove
as many possibilities for human error as possible if we really want to
guarantee this does not happen in the future.

Cheers,
Peter
-- 
http://sjamaan.ath.cx
--
"The process of preparing programs for a digital computer
 is especially attractive, not only because it can be economically
 and scientifically rewarding, but also because it can be an aesthetic
 experience much like composing poetry or music."
                                                        -- Donald Knuth

pgpwX3KpXtgzo.pgp
Description: PGP signature