[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#28745: tarballs generated on github are generated on demand (leading
bug#28745: tarballs generated on github are generated on demand (leading to different hash sums)
Sun, 8 Oct 2017 11:40:09 +0000
Past and recent discussion in our IRC channel and on the mailing list
show that we can not rely on tarballs on github keeping the same
According to github they are "generated on demand", leading to
regular hash mismatches.
Since some of our own dependencies are on github (at the very least
guile-git), we need to come up with a solution.
Right now we have around 449 packages with tarball sources from
github in our gnu/packages.
- Move them all to use git-download and just use
the commit that has been tagged in the versions that produce
the tarballs on github.
- Mirror the content somewhere reliable in snapshots for
some time. Problem here: we start to rely on this "somewhere"
to be trustworthy and introduce one more point to trust
(however due to pre-recorded hash sum this is just an annoyance,
not a grave issue).
- Your idea here.
Description: PGP signature
- bug#28745: tarballs generated on github are generated on demand (leading to different hash sums),