On Tue, Jun 23, 2015 at 04:46:15PM -0700, Gerald B. Cox wrote:
>    Michael,
>    My belief is that if someone uses the "Release" mechanism, that is covered
>    by
>    the sentence which states: A
>    "If the upstreamA doesA create tarballs you should use themA as tarballs
>    provide an easier trail for people auditing the packages."
>    By creating the tag, upstream has clearly indicated their intent; A who
>    are we to second-guess them? A

I disagree on this as tags are not something that is definitive.
There is a way in github to upload a given tarball and that is then definitive
but just pushing a tag isn't.
There are really too many upstream moving a tag around.

The whole point of the guidelines is to address this specific problem: tags in
github are not definitive, which means they cannot be approach like a version on
pypi or cpan or other platform.


>    The commit hash part comes into play when a Revision or Tag has not been
>    created.

Well, if there is not release, there is no other way than using the hash, but
tags are not releases and thus should not be consider as such.