GitHub is a terrible upstream

[Andy Grover]

On 04/23/2012 06:27 AM, Adam Williamson wrote:
> On Fri, 2012-04-20 at 20:51 -0700, Eric Smith wrote:

>> #!/bin/sh
>> # usage: tcplay-get-snapshot.sh <hash>
>> git clone git://github.com/bwalex/tc-play
>> ( cd tc-play && \
>>    git archive --format=tar --prefix=tcplay-$1/ $1 \
>> ) | xz - >tcplay-$1.tar.xz
> 
> We could probably add something like this to the 'snippets' bit of the
> packaging guidelines, since github is pretty significant. Just to try
> and help packagers do it in a uniform and guideline-complaint way.
> 
> As a reminder for packagers following the thread - any time you have to
> 'generate' a source tarball like this (i.e. it is not possible to
> provide a Source: URL that can be expected to remain valid), you should
> ensure the tarball is reliably reproducible by others and include all
> necessary instructions to produce it, using comments in the .spec file
> and/or a script like Eric's - so if you wanted to use Eric's script, you
> should ensure you actually check the script itself into git (and
> probably cite it as a Source itself, so it winds up in the .src.rpm),
> then have a comment in the .spec file which specifies the invocation of
> the script that was used to generate the source tarball.

"wget --content-disposition https://github.com/$user/$project/tarball/$tag"

lets you download a tarball named $user-$project-$tag-0-$gitsha1.tar.gz.
That saves the maintainer from having to document how to generate the
tarball, in exchange for dealing with a tarball name that contains
random content (the sha1). The path of files in the tarball also
contains the sha1.

Even so, this still seems preferable to me than making packagers
generate the tarball each time and document the process, which seems
very prone to error.

Regards -- Andy

ps btw that wget w/o --content-disposition gets you a tarball named $tag.
pps I both package and maintain upstream code in github, guidelines on
the wiki would be great.