consistent tarball md5 [was: Naming issue for meego 1.0 related packages]

[Paul Morgan]

On Fri, Jul 16, 2010 at 06:26, Chen Lei <supercyper1 at gmail.com> wrote:
> 2010/7/11 pbrobinson at gmail.com <pbrobinson at gmail.com>:
>>
>> I don't agree with the easier, and the releases are all built on tags.
>>
>> Well someone will have to get the policy added to the packaging
>> guidelines. There's guidelines for using VC repos but not for using
>> tar files from other distros source packages.
>>
>> Peter
>
> It seems no guideline forbid us to use tarballs extracted from
> upstream repo.  I think using git repo for meego packages have more
> harm than benefit, because the most important feature for rpm is
> people can validate the md5sum of the source tarball easily. Unless
> special case we can't find a way to get reliable souce tarballs, I
> think it's better to use tarballs rather than get source files from
> VCS.

Using git is not harmful, and it's certainly possible to get tarballs with
consistent md5 from git based on tagged releases.

Case in point: http://github.com/dgoodwin/tito

Among its features:

* Create reliable tar.gz's with consistent checksums from any tag.
* Build packages off an "upstream" git repository, where
  modifications in the "downstream" git repository will be
  applied as a patch in the source rpm.

I'm not suggesting that the project maintainer use tito; I'm saying
that tito can create tarballs with consistent md5's from any tag
in the repo. The project maintainer chooses what he feels
works best for his project, all things considered.

-paul

> Meego repo is reliable place to get source tarballs, they also
> have bugzilla against those modules and they are the upstream. Also,
> it seems some meego packages don't have a public VCS(e.g. fennec-qt)
> or public VCS is not active currently(e.g. scim-panel-vkb-gtk[1]).
> Meego 1.0 use scim-panel-vkb-gtk 0.1.7, meego 1.1 use 0.1.8. but the
> latest version in the git repo is 0.1.6.
>
> [1]https://bugzilla.redhat.com/show_bug.cgi?id=615047
>
> Regards,
> Chen Lei
> _______________________________________________
> mini mailing list
> mini at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/mini
>



-- 
Paul Morgan