3 ms·
> Why is that of concern regarding "tarballs vs git"? If anything it's a win for git. Git tags (and branches) are mutable. Tarballs technically are, but don't
by vacri 11y ago
> Why is that of concern regarding "tarballs vs git"? If anything it's a win for git.
Git tags (and branches) are mutable. Tarballs technically are, but don't move around as much. Unless someone's being actively malicious, you can be confident that no-one's going to put new code in an old-versioned tarball.
- scrollaway 11y agoThe exact same can be said of git. You're reaching. Git has builtin verification of absolutely everything it holds (tags included) since it uses sha1 for objects and commit messages, and they include the previous state... so a point in a git tree in that way is a hell of a lot more immutable than a tarball.
- vacri 11y agoMy colleagues complain of people moving tags and sometimes branches around, or fucking things up with a bad merge. I haven't heard the same criticisms of tarballs. I'm not a tarball warrior, I'm just going off what I hear people saying.
- scrollaway 11y agoYou haven't heard the same criticisms of tarballs because tarballs aren't used as a version control system. These issues are specific to (fairly bad) VCS usage, not packaging usage.
- grhmc 11y agoYeah, except you can change a tag and it is still verified.