3 ms·
> I think you meant _poorly implemented_ open source packaging systems. or under-resourced ones. If the upstream source only appears on GitHub, without formal
by pxc 4y ago
> I think you meant _poorly implemented_ open source packaging systems.
or under-resourced ones. If the upstream source only appears on GitHub, without formal release tarballs, your only options as a downstream packager are literally to get the source from GitHub or host your own mirror of every source tarball you build yourself.
- Denvercoder9 4y agoOr get the source code using Git, which actually (by design) guarantees that its checksums are stable.
- pxc 4y agoThat's a good point. It's way more resource-intensive and much slower, which is why it's not preferred in Nixpkgs, for example. But it's also vulnerable to the same problem in that your package manager's build system is still dependent on GitHub. It will take more to screw you up, but a whole GitHub outage, for example, will definitely still hurt.
- ilyt 4y agoIt's not depending on github-specific functionality tho. You can just redirect it to another mirror of git repo of the project
- ecnahc515 4y agoDownloading a source tarball is significantly cheaper on both sides than git. A source tarball is 100% served from CDNs, whereas I don't believe the same isn't quite true for git (even over https).