[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#21784: Old XZ tarballs
From: |
Ludovic Courtès |
Subject: |
bug#21784: Old XZ tarballs |
Date: |
Sun, 01 Nov 2015 11:20:07 +0100 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) |
Lasse Collin <address@hidden> skribis:
> On 2015-10-30 Ludovic Courtès wrote:
[...]
>> Guix does automatically mirror tarballs via its “substitute”
>> mechanism. However, users can turn it off, in which case they end up
>> downloading the tarball from the upstream URL specified in the
>> package recipe.
>
> OK. :-) Why would users turn it off though?
The substitute mechanism is very generic; it’s not just about mirroring
tarballs:
http://www.gnu.org/software/guix/manual/html_node/Substitutes.html
Some people might prefer to build things locally rather than download
pre-built items.
> I would guess that one good mirror would be more reliable than dozens
> of upstream sites of which just one needs to be down to be a problem
> for a user. A package manager should know the hash or signature of the
> file, so from security point of view it doesn't matter where the file
> comes.
Yes exactly, all we need is to mirror it somewhere.
>> > By the way, is there a reason why you use 5.0.4 instead of 5.0.8 (or
>> > even 5.2.2)?
>>
>> No good reason! We’ll upgrade it as soon as this can be done without
>> triggering too much rebuild/redownloads for users.
>
> API/ABI is backward compatible so one shouldn't need to rebuild other
> packages. There's a mailing list "xz-announce" in case you want a
> notification when a new version is released:
> <http://tukaani.org/xz/lists.html>
Noted, thanks!
Ludo’.
- bug#21784: Old XZ tarballs,
Ludovic Courtès <=