Subject: Re: bug#28745: tarballs generated on github are generated on demand (leading to different hash sums)

From: Ricardo Wurmus <[email-masked]>
Date: Sun, 08 Oct 2017 23:58:48 +0200

ng0 <[email-masked]> writes:

> Right now we have around 449 packages with tarball sources from
> github in our gnu/packages.

I assume that this problem does not exist for tarballs that have been
signed and uploaded by the maintainer.  This is only a problem for
auto-generated tarballs for tags, so it’s probably less than 449
packages.

> - Move them all to use git-download and just use
>   the commit that has been tagged in the versions that produce
>   the tarballs on github.

This doesn’t seem like a bad idea.  It’s not great that we’ll have to
bootstrap the build systems for all these packages.

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net