3 ms·

Ironic that "open source packaging systems" rely on proprietary Microsoft hosting and distribution to function. I think you meant _poorly implemented_ open sou

Ironic that "open source packaging systems" rely on proprietary Microsoft hosting and distribution to function. I think you meant _poorly implemented_ open source packaging systems.

bentley 4y ago
Of the 11,656 packages in OpenBSD’s package repos, 2,984 are built from source originally hosted on GitHub or Sourceforge. That’s a full 25%. Moralize all you want about where these upstreams should host their software, but why claim that the downstream package manager is “poorly implemented” to fetch source code from those hosts? Your complaint was not technical—you imply the proprietariness of Microsoft servers is the problem (although open source servers like GitLab also have the problem of unstable checksums)—but HTTPS is HTTPS.
- VWWHFSfQ 4y ago
  I'm fairly certain that Homebrew doesn't function without GitHub. The index (and Cargo's index, and probably others) is hard-coded to be hosted on GitHub.
  - denom 4y ago
    Exactly this. Tbh, i would expect some developer working on this feature to have an ‘a-ha’ moment: ‘I’m a homebrew user … hey wait a minute’
- ilyt 4y ago
  > Moralize all you want about where these upstreams should host their software, but why claim that the downstream package manager is “poorly implemented” to fetch source code from those hosts? Because it should validate checksums of content of the tarball, instead of just the outside blob. Then: * you don't care about compression method or implementation * you don't care about archive method or implementation * your system works just as well for "download a tarball" as for "shallow copy the remote repo
pxc 4y ago
> I think you meant _poorly implemented_ open source packaging systems. or under-resourced ones. If the upstream source only appears on GitHub, without formal release tarballs, your only options as a downstream packager are literally to get the source from GitHub or host your own mirror of every source tarball you build yourself.
- Denvercoder9 4y ago
  Or get the source code using Git, which actually (by design) guarantees that its checksums are stable.
  - pxc 4y ago
    That's a good point. It's way more resource-intensive and much slower, which is why it's not preferred in Nixpkgs, for example. But it's also vulnerable to the same problem in that your package manager's build system is still dependent on GitHub. It will take more to screw you up, but a whole GitHub outage, for example, will definitely still hurt.
    - ilyt 4y ago
      It's not depending on github-specific functionality tho. You can just redirect it to another mirror of git repo of the project
  - ecnahc515 4y ago
    Downloading a source tarball is significantly cheaper on both sides than git. A source tarball is 100% served from CDNs, whereas I don't believe the same isn't quite true for git (even over https).
chlorion 4y ago
I am not sure how you could not rely on GitHub when packaging code that is hosted on GitHub. My personal Gentoo ebuilds for example contain a URI variable that points to the GitHub auto-generated archives for projects that use GitHub for hosting. What am I supposed to do in this case? The only option here is to setup a mirror and have a backup of the data. Packages that are in the official Gentoo repository do get mirrored, but overlays do not, and most people probably don't have the ability, time or money to setup their own mirroring service. I agree that relying on GitHub sucks to be clear, but I don't think we can blame package managers for fetching code from it when people are hosting their projects there!
- pabs3 4y ago
  Software Heritage backs up GitHub, they aren't really designed to be a mirror though. https://www.softwareheritage.org/ https://www.softwareheritage.org/ Some GitHub repos also end up on archive.org, but not systematically.

Ironic that "open source packaging systems" rely on proprietary Microsoft hosting and distribution to function. I think you meant _poorly implemented_ open source packaging systems.

bentley 4y ago

Of the 11,656 packages in OpenBSD’s package repos, 2,984 are built from source originally hosted on GitHub or Sourceforge. That’s a full 25%. Moralize all you want about where these upstreams should host their software, but why claim that the downstream package manager is “poorly implemented” to fetch source code from those hosts? Your complaint was not technical—you imply the proprietariness of Microsoft servers is the problem (although open source servers like GitLab also have the problem of unstable checksums)—but HTTPS is HTTPS.

VWWHFSfQ 4y ago
I'm fairly certain that Homebrew doesn't function without GitHub. The index (and Cargo's index, and probably others) is hard-coded to be hosted on GitHub.
- denom 4y ago
  Exactly this. Tbh, i would expect some developer working on this feature to have an ‘a-ha’ moment: ‘I’m a homebrew user … hey wait a minute’
ilyt 4y ago
> Moralize all you want about where these upstreams should host their software, but why claim that the downstream package manager is “poorly implemented” to fetch source code from those hosts? Because it should validate checksums of content of the tarball, instead of just the outside blob. Then: * you don't care about compression method or implementation * you don't care about archive method or implementation * your system works just as well for "download a tarball" as for "shallow copy the remote repo

pxc 4y ago

> I think you meant _poorly implemented_ open source packaging systems. or under-resourced ones. If the upstream source only appears on GitHub, without formal release tarballs, your only options as a downstream packager are literally to get the source from GitHub or host your own mirror of every source tarball you build yourself.

Denvercoder9 4y ago
Or get the source code using Git, which actually (by design) guarantees that its checksums are stable.
- pxc 4y ago
  That's a good point. It's way more resource-intensive and much slower, which is why it's not preferred in Nixpkgs, for example. But it's also vulnerable to the same problem in that your package manager's build system is still dependent on GitHub. It will take more to screw you up, but a whole GitHub outage, for example, will definitely still hurt.
  - ilyt 4y ago
    It's not depending on github-specific functionality tho. You can just redirect it to another mirror of git repo of the project
- ecnahc515 4y ago
  Downloading a source tarball is significantly cheaper on both sides than git. A source tarball is 100% served from CDNs, whereas I don't believe the same isn't quite true for git (even over https).

chlorion 4y ago

I am not sure how you could not rely on GitHub when packaging code that is hosted on GitHub. My personal Gentoo ebuilds for example contain a URI variable that points to the GitHub auto-generated archives for projects that use GitHub for hosting. What am I supposed to do in this case? The only option here is to setup a mirror and have a backup of the data. Packages that are in the official Gentoo repository do get mirrored, but overlays do not, and most people probably don't have the ability, time or money to setup their own mirroring service. I agree that relying on GitHub sucks to be clear, but I don't think we can blame package managers for fetching code from it when people are hosting their projects there!

pabs3 4y ago
Software Heritage backs up GitHub, they aren't really designed to be a mirror though. https://www.softwareheritage.org/ https://www.softwareheritage.org/ Some GitHub repos also end up on archive.org, but not systematically.