GNU bug report logs - #21784
xz-5.0.4.tar.gz is unavailable upstream

Previous Next

Full log

View this message in rfc822 format

From: ludo <at> gnu.org (Ludovic Courtès)
To: Lasse Collin <lasse.collin <at> tukaani.org>
Cc: 21784 <at> debbugs.gnu.org
Subject: bug#21784: Old XZ tarballs
Date: Sun, 01 Nov 2015 11:20:07 +0100

Lasse Collin <lasse.collin <at> tukaani.org> skribis:

> On 2015-10-30 Ludovic Courtès wrote:

[...]

>> Guix does automatically mirror tarballs via its “substitute”
>> mechanism. However, users can turn it off, in which case they end up
>> downloading the tarball from the upstream URL specified in the
>> package recipe.
>
> OK. :-) Why would users turn it off though?

The substitute mechanism is very generic; it’s not just about mirroring
tarballs:

  http://www.gnu.org/software/guix/manual/html_node/Substitutes.html

Some people might prefer to build things locally rather than download
pre-built items.

> I would guess that one good mirror would be more reliable than dozens
> of upstream sites of which just one needs to be down to be a problem
> for a user. A package manager should know the hash or signature of the
> file, so from security point of view it doesn't matter where the file
> comes.

Yes exactly, all we need is to mirror it somewhere.

>> > By the way, is there a reason why you use 5.0.4 instead of 5.0.8 (or
>> > even 5.2.2)?
>> 
>> No good reason!  We’ll upgrade it as soon as this can be done without
>> triggering too much rebuild/redownloads for users.
>
> API/ABI is backward compatible so one shouldn't need to rebuild other
> packages. There's a mailing list "xz-announce" in case you want a
> notification when a new version is released:
> <http://tukaani.org/xz/lists.html>

Noted, thanks!

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.