GitHub Hosted upstream 'Source0'

Stanislav Ochotnicky sochotnicky at
Wed Feb 16 16:15:49 UTC 2011

On 02/16/2011 04:58 PM, Andreas Schwab wrote:
> Stanislav Ochotnicky <sochotnicky at> writes:
>> On 02/16/2011 03:36 PM, Matej Cepl wrote:
>>> Dne 16.2.2011 11:06, Stanislav Ochotnicky napsal(a):
>>>>> Which basically takes the tag name and creates a nice tarball from it.
>>>> Although I should pipe it through gzip/bzip2 :-/
>>> And you really don't resolve the issue with unstable MD5 checksum.
>> Why would that be? I am creating the tarball from the same git tag. Yes
>> I am using tag name, so theoretically if upstream is ugly enough to
>> overwrite their tags with different contents, this will be a problem.
>> But normally I can re-create the tarball using "git archive" and the md5
>> checksum will stay the same. Can you tell me how exactly this won't work?
> That does not mean that the compressed contents will always be the same.

$ git clone -q git://
$ GIT_DIR=sisu/.git git archive --prefix="sonatype-sisu-" \
   --format=tar sisu- | bzip2 > tarball1.tar.bz2
$ rm -rf sisu/
$ git clone -q git://
$ GIT_DIR=sisu/.git git archive --prefix="sonatype-sisu-" \
    --format=tar sisu- | bzip2 > tarball2.tar.bz2
$ md5sum tarball*
085fc5da0a7b504482e5e6449349316d  tarball1.tar.bz2
085fc5da0a7b504482e5e6449349316d  tarball2.tar.bz2

True, this is just one test run and's enough for the git or
bzip2 defaults to change and this will stop working. But as long as they
stay the same the MD5 is stable. Bonus points for using git hash instead
of tag name I guess...

> At least the gzip compressed tarballs from github contain a time stamp.

True, but git-archive doesn't do that by default. That's just their
"improvement" AFAIK

Stanislav Ochotnicky <sochotnicky at>
Associate Software Engineer - Base Operating Systems Brno

PGP: 7B087241
Red Hat Inc.                     

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
Url : 

More information about the devel mailing list