5 ms·

It's absolutely because of inertia. Cutting a tarball is a very public indicator that the software is ready to be used. A git tag or branch doesn't have the cla

by Kluggy 3y ago

It's absolutely because of inertia. Cutting a tarball is a very public indicator that the software is ready to be used. A git tag or branch doesn't have the clarity of "use this" as a release tarball does. That said, this is absolutely going to be changing now. We obviously can't keep relying on tarballs anymore. We'll find a new normal that will work for a very long time until some other critical issue arises and the cycle repeats.

kzrdude 3y ago
We can use tarballs - they are useful as signed artifacts, but only if we verify that they are reproducible.
- lupusreal 3y ago
  If you're going to download both the tarball and the got repo and verify the reproducibility of the tarball, then why bother with the tarball at all? You already have the got repo.
  - b112 3y ago
    A git repo can vanish overnight. Git is often used to snag source, but tarballs are still crafted after even then: https://news.ycombinator.com/item?id=39903813 https://news.ycombinator.com/item?id=39903813
    - kijin 3y ago
      Git repos only vanish if they have no clones. For the purpose of accountability, the "official" repo is not more privileged than any other clone that retains the same history, and can be verifiably recreated from any clone if it is ever lost or tampered with. (Assuming SHA-1 isn't too broken, that is.) For archival purposes, nothing prevents people from creating a tarball that contains the .git directory as well, which would preserve not only the current state of the project but its entire history.
      - b112 3y ago
        Git repos only vanish if they have no clones. And? You're speaking probabilities, not certainties. It's not relevant in terms of archiving. You don't guess, you don't hope, you simply 100% ensure that 10 days, 19 years, or a century from now you can build the same thing. I agree that adding "extra stuff" to a tarball isn't a bad idea, and in fact, many already do!
        lupusreal 3y ago
        If you can archive the tarball, you can archive the git repos. If for some reason you can't, you can cut your own tarballs from the git repo and then you don't have to worry about them because you made them yourself.
        b112 3y ago
        Archiving an entire git repo is serious overkill, and untenable realistically. Debian has 30k packages, if not more, and some of them are the linux kernel. My responses in these threads has been to the "why not build from git" logic championed here. You want to build from a reliable, repeatable source. And as I mentioned, that can be git clone -> tarball, sure.

by Kluggy 3y ago

kzrdude 3y ago

We can use tarballs - they are useful as signed artifacts, but only if we verify that they are reproducible.

lupusreal 3y ago
If you're going to download both the tarball and the got repo and verify the reproducibility of the tarball, then why bother with the tarball at all? You already have the got repo.
- b112 3y ago
  A git repo can vanish overnight. Git is often used to snag source, but tarballs are still crafted after even then: https://news.ycombinator.com/item?id=39903813 https://news.ycombinator.com/item?id=39903813
  - kijin 3y ago
    Git repos only vanish if they have no clones. For the purpose of accountability, the "official" repo is not more privileged than any other clone that retains the same history, and can be verifiably recreated from any clone if it is ever lost or tampered with. (Assuming SHA-1 isn't too broken, that is.) For archival purposes, nothing prevents people from creating a tarball that contains the .git directory as well, which would preserve not only the current state of the project but its entire history.
    - b112 3y ago
      Git repos only vanish if they have no clones. And? You're speaking probabilities, not certainties. It's not relevant in terms of archiving. You don't guess, you don't hope, you simply 100% ensure that 10 days, 19 years, or a century from now you can build the same thing. I agree that adding "extra stuff" to a tarball isn't a bad idea, and in fact, many already do!
      - lupusreal 3y ago
        If you can archive the tarball, you can archive the git repos. If for some reason you can't, you can cut your own tarballs from the git repo and then you don't have to worry about them because you made them yourself.
        b112 3y ago
        Archiving an entire git repo is serious overkill, and untenable realistically. Debian has 30k packages, if not more, and some of them are the linux kernel. My responses in these threads has been to the "why not build from git" logic championed here. You want to build from a reliable, repeatable source. And as I mentioned, that can be git clone -> tarball, sure.