bug#46849: ELPA packages are fetched from unstable url -> not reproducible

[zimoun]

Follow-up.

-------------------- Start of forwarded message --------------------
Date: Fri, 05 Mar 2021 12:56:27 +0100
From: Johannes Rosenberger <johannes@jorsn.eu>
Subject: Re: bug#46849: ELPA packages are fetched from unstable url -> not
 reproducible
To: zimoun <zimon.toutoune@gmail.com>

Hi Simon,


Excerpts from zimoun's message of March 5, 2021 2:32 am:

> On Mon, 01 Mar 2021 at 14:15, Johannes Rosenberger <johannes@jorsn.eu> wrote:
> 
>> These are only available for the newest version of a package.
>> ELPA keeps compressed archives only of around 20 hand-selected versions. 
>> All package versions are kept in their git repo, which is a complete archive,
>> but there you must somehow extract the commit hash of a version.
> 
> So it would break the “guix time-machine”, right?

Not only this. In Nixpkgs it broke the release of auctex in the 
stable branch, because this wasn't at the newest version.
The old version was still available lz-compressed, but there is no 
guarantee for this.

> There is 2 solutions:
> 
>  1- trust the future Tarball Heritage [1]
>  2- switch to git-fetch all the ELPA packages.

I documented (2) there:

https://github.com/NixOS/nixpkgs/issues/110796#issuecomment-779297144

There is one third solution:

   3- trust archive.org

In Nixpkgs we also add archive.org urls as secondary source urls for 
proprietary printer drivers.

>> - https://debbugs.gnu.org/cgi/bugreport.cgi?bug=46441
> 
> About #2, I am confused by this quote:
> 
>         If you can work from the elpa.git instead, then you'll avoid
>         those problems (but the content is slightly different, so it
>         might be less convenient).

I don't understand this sentence either, because the file

http://git.savannah.gnu.org/cgit/emacs/elpa.git/tree/elpa-admin.el?h=elpa-admin

seems to create the packages, so every package in the elpa built from 
the git should be the same. One could check whether all packages on ELPA 
are also in the git and vice versa. Also, some packages might not be 
`external` in the language of ELPA, so not residing in an `external/*` 
branch.


Best,

Johannes
-------------------- End of forwarded message --------------------