6 ms·

We updated our Git version which made this change for the reasons explained. At the time we didn't foresee the impact. We're quickly rolling back the change now

We updated our Git version which made this change for the reasons explained. At the time we didn't foresee the impact. We're quickly rolling back the change now, as it's clear we need to look at this more closely to see if we can make the changes in a less disruptive way. Thanks for letting us know.

phphphphp 4y ago
Consumers often mistake hasn’t changed for a commitment to never change: any sufficiently large product will be littered with these kind of implicit commitments made by the product to consumers that nobody has visibility into. You’re unfortunate that we were all relying on this commitment you’ve never made, but the quick reversion is the best we can hope for. People will theorise how this could have been avoided but c’est la vie — easy mistake that you’ve responded well to.
- VWWHFSfQ 4y ago
  At this point they'll be stuck on old git for all of eternity unless they just roll their own archive/compress step out of band so the old hashes still work. Yikes.
  - groestl 4y ago
    They could also brownout the implied contract over a longer timespan.
    - jeffbee 4y ago
      They could use the old behavior for archives in which all the inputs predate the changeover.
  - rfoo 4y ago
    New git has a flag for keeping the old behavior, so it's not as bad.
- deleted 4y ago
  [deleted]
- dharmab 4y ago
  Hyrum's Law: With a sufficient number of users of an API, it does not matter what you promise in the contract: all observable behaviors of your system will be depended on by somebody.
  - deleted 4y ago
    [deleted]
  - modderation 4y ago
    Incidentally, I'm still waiting for GitHub to implement Spacebar Heating: https://m.xkcd.com/1172/ https://m.xkcd.com/1172/
- nickitolas 4y ago
  FWIW according to https://github.com/bazel-contrib/SIG-rules-authors/issues/11#issuecomment-1409433084 https://github.com/bazel-contrib/SIG-rules-authors/issues/11... a commitment was made, although in an exchange in some support ticket, and not in documentation.
johnklos 4y ago
[flagged]
- VWWHFSfQ 4y ago
  Ironic that "open source packaging systems" rely on proprietary Microsoft hosting and distribution to function. I think you meant _poorly implemented_ open source packaging systems.
  - bentley 4y ago
    Of the 11,656 packages in OpenBSD’s package repos, 2,984 are built from source originally hosted on GitHub or Sourceforge. That’s a full 25%. Moralize all you want about where these upstreams should host their software, but why claim that the downstream package manager is “poorly implemented” to fetch source code from those hosts? Your complaint was not technical—you imply the proprietariness of Microsoft servers is the problem (although open source servers like GitLab also have the problem of unstable checksums)—but HTTPS is HTTPS.
    - VWWHFSfQ 4y ago
      I'm fairly certain that Homebrew doesn't function without GitHub. The index (and Cargo's index, and probably others) is hard-coded to be hosted on GitHub.
      - denom 4y ago
        Exactly this. Tbh, i would expect some developer working on this feature to have an ‘a-ha’ moment: ‘I’m a homebrew user … hey wait a minute’
    - ilyt 4y ago
      > Moralize all you want about where these upstreams should host their software, but why claim that the downstream package manager is “poorly implemented” to fetch source code from those hosts? Because it should validate checksums of content of the tarball, instead of just the outside blob. Then: * you don't care about compression method or implementation * you don't care about archive method or implementation * your system works just as well for "download a tarball" as for "shallow copy the remote repo

phphphphp 4y ago

Consumers often mistake hasn’t changed for a commitment to never change: any sufficiently large product will be littered with these kind of implicit commitments made by the product to consumers that nobody has visibility into. You’re unfortunate that we were all relying on this commitment you’ve never made, but the quick reversion is the best we can hope for. People will theorise how this could have been avoided but c’est la vie — easy mistake that you’ve responded well to.

VWWHFSfQ 4y ago
At this point they'll be stuck on old git for all of eternity unless they just roll their own archive/compress step out of band so the old hashes still work. Yikes.
- groestl 4y ago
  They could also brownout the implied contract over a longer timespan.
  - jeffbee 4y ago
    They could use the old behavior for archives in which all the inputs predate the changeover.
- rfoo 4y ago
  New git has a flag for keeping the old behavior, so it's not as bad.
deleted 4y ago
[deleted]
dharmab 4y ago
Hyrum's Law: With a sufficient number of users of an API, it does not matter what you promise in the contract: all observable behaviors of your system will be depended on by somebody.
- deleted 4y ago
  [deleted]
- modderation 4y ago
  Incidentally, I'm still waiting for GitHub to implement Spacebar Heating: https://m.xkcd.com/1172/ https://m.xkcd.com/1172/
nickitolas 4y ago
FWIW according to https://github.com/bazel-contrib/SIG-rules-authors/issues/11#issuecomment-1409433084 https://github.com/bazel-contrib/SIG-rules-authors/issues/11... a commitment was made, although in an exchange in some support ticket, and not in documentation.

johnklos 4y ago

[flagged]

VWWHFSfQ 4y ago
Ironic that "open source packaging systems" rely on proprietary Microsoft hosting and distribution to function. I think you meant _poorly implemented_ open source packaging systems.
- bentley 4y ago
  Of the 11,656 packages in OpenBSD’s package repos, 2,984 are built from source originally hosted on GitHub or Sourceforge. That’s a full 25%. Moralize all you want about where these upstreams should host their software, but why claim that the downstream package manager is “poorly implemented” to fetch source code from those hosts? Your complaint was not technical—you imply the proprietariness of Microsoft servers is the problem (although open source servers like GitLab also have the problem of unstable checksums)—but HTTPS is HTTPS.
  - VWWHFSfQ 4y ago
    I'm fairly certain that Homebrew doesn't function without GitHub. The index (and Cargo's index, and probably others) is hard-coded to be hosted on GitHub.
    - denom 4y ago
      Exactly this. Tbh, i would expect some developer working on this feature to have an ‘a-ha’ moment: ‘I’m a homebrew user … hey wait a minute’
  - ilyt 4y ago
    > Moralize all you want about where these upstreams should host their software, but why claim that the downstream package manager is “poorly implemented” to fetch source code from those hosts? Because it should validate checksums of content of the tarball, instead of just the outside blob. Then: * you don't care about compression method or implementation * you don't care about archive method or implementation * your system works just as well for "download a tarball" as for "shallow copy the remote repo