Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #13448

Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided upstream source tarballs

Path csiph.com!aioe.org!bofh.it!news.nic.it!robomod
From Paul Wise <pabs@debian.org>
Newsgroups linux.debian.maint.python
Subject Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided upstream source tarballs
Date Sat, 26 Jun 2021 04:10:01 +0200
Message-ID <Cu5VD-7Vg-1@gated-at.bofh.it> (permalink)
References <Cu0VX-4MG-5@gated-at.bofh.it> <Cu1p0-5bB-11@gated-at.bofh.it> <Cu2uK-5Mv-3@gated-at.bofh.it> <Cu3K9-6qc-1@gated-at.bofh.it>
X-Original-To debian-python@lists.debian.org
X-Mailbox-Line From debian-python-request@lists.debian.org Sat Jun 26 02:05:07 2021
Old-Return-Path <paul.is.wise@gmail.com>
X-Amavis-Spam-Status No, score=-6.5 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no
X-Policyd-Weight NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .mail-wm1-f44.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5
X-Gm-Message-State AOAM531LlEj3bjosmapoO5lNReYbaKytsOxrGq4mdGx0ynpVpYzlq4Hh 7tjgzVwlfHlT6wiCh+bEQcR3YGfkVBZiYi75+zA6w9rUi+Uv+g==
X-Google-SMTP-Source ABdhPJxcTcg6TPViKaVExM+S5WxW6bA1uVHzVEqgzmBk/FSY1nUEtYvngYO5iOTfyzLn2ngwgadvMLEDyhZOS/AMaAQ=
X-Received by 2002:a05:600c:4417:: with SMTP id u23mr14060902wmn.26.1624673091279; Fri, 25 Jun 2021 19:04:51 -0700 (PDT)
MIME-Version 1.0
Content-Type text/plain; charset="UTF-8"
X-Mailing-List <debian-python@lists.debian.org> archive/latest/19238
List-ID <debian-python.lists.debian.org>
List-URL <https://lists.debian.org/debian-python/>
List-Archive https://lists.debian.org/msgid-search/CAKTje6FMCJtzKctudYQ8mqFTAW1MbotBCtEFPTpgVXDjawPWiA@mail.gmail.com
Approved robomod@news.nic.it
Lines 34
Organization linux.* mail to news gateway
Sender robomod@news.nic.it
X-Original-Date Sat, 26 Jun 2021 02:04:40 +0000
X-Original-Message-ID <CAKTje6FMCJtzKctudYQ8mqFTAW1MbotBCtEFPTpgVXDjawPWiA@mail.gmail.com>
X-Original-References <877dihvfp9.fsf@DigitalMercury.dynalias.net> <20210625211721.eluslf3hee5eug7r@yuggoth.org> <877dihd1ds.fsf@DigitalMercury.dynalias.net> <20210625234144.vwfjk6xprvqzscx3@yuggoth.org>
Xref csiph.com linux.debian.maint.python:13448

Show key headers only | View raw

On Fri, Jun 25, 2021 at 11:42 PM Jeremy Stanley wrote:

> 1. Cryptographically signed tags in a Git repository, with
>    versioning, revision history, release notes and authorship either
>    embedded within or tied to the Git metadata.
>
> 2. Cryptographically signed tarballs of the file tree corresponding
>    to a tag in the Git repository, with versioning, revision
>    history, release notes and authorship extracted into files
>    included directly within the tarball.

I would like to see #2 split into two separate tarballs, one for the
exact copy of the git tree and one containing the data about the other
tarball. Then use dpkg-source v3 secondary tarballs to add the data
about the git repo to the Debian source package.

> Saying that a raw dump of the file content from a revision control
> system is recommended over using upstream's sdists presumes all
> upstreams are the same. They're not, and which is preferable (or
> doable, or even legal) differs from one to another. Just because
> some sdists, or even many, are not suitable as a basis for packaging
> doesn't mean that sdists are a bad idea to base packages on. Yes,
> basing packages on bad sdists is bad, it's hard to disagree with
> that.

Probably we should start systematically comparing upstream VCS repos
with upstream sdists and reacting to the differences. So far, I've
reacted by ignoring the sdists completely.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

Back to linux.debian.maint.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Nicholas D Steeves <sten@debian.org> - 2021-06-25 22:50 +0200
  Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-25 23:20 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Scott Talbert <swt@techie.net> - 2021-06-25 23:40 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Nicholas D Steeves <sten@debian.org> - 2021-06-26 00:50 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Nicholas D Steeves <sten@debian.org> - 2021-06-26 00:30 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-26 01:50 +0200
        Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Nicholas D Steeves <sten@debian.org> - 2021-06-26 02:10 +0200
        Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Paul Wise <pabs@debian.org> - 2021-06-26 04:10 +0200
          Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-26 06:20 +0200
          Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Martin <debacle@debian.org> - 2021-06-26 11:30 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Simon McVittie <smcv@debian.org> - 2021-06-26 12:20 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Paul Wise <pabs@debian.org> - 2021-06-26 04:00 +0200
  Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Simon McVittie <smcv@debian.org> - 2021-06-26 00:10 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Nicholas D Steeves <sten@debian.org> - 2021-06-26 01:10 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-26 02:00 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Brian Thompson <brian@hashvault.io> - 2021-06-26 05:50 +0200
        Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided upstream source tarballs Donald Stufft <donald@stufft.io> - 2021-06-26 06:30 +0200
  Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Paul Wise <pabs@debian.org> - 2021-06-26 04:00 +0200
  Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Louis-Philippe Véronneau <pollo@debian.org> - 2021-06-27 01:00 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-27 02:20 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Emmanuel Arias <eamanu@yaerobi.com> - 2021-06-28 04:50 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-28 18:30 +0200

csiph-web