Path: csiph.com!aioe.org!bofh.it!news.nic.it!robomod From: Paul Wise Newsgroups: linux.debian.maint.python Subject: Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided upstream source tarballs Date: Sat, 26 Jun 2021 04:10:01 +0200 Message-ID: References: X-Original-To: debian-python@lists.debian.org X-Mailbox-Line: From debian-python-request@lists.debian.org Sat Jun 26 02:05:07 2021 Old-Return-Path: X-Amavis-Spam-Status: No, score=-6.5 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .mail-wm1-f44.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5 X-Gm-Message-State: AOAM531LlEj3bjosmapoO5lNReYbaKytsOxrGq4mdGx0ynpVpYzlq4Hh 7tjgzVwlfHlT6wiCh+bEQcR3YGfkVBZiYi75+zA6w9rUi+Uv+g== X-Google-SMTP-Source: ABdhPJxcTcg6TPViKaVExM+S5WxW6bA1uVHzVEqgzmBk/FSY1nUEtYvngYO5iOTfyzLn2ngwgadvMLEDyhZOS/AMaAQ= X-Received: by 2002:a05:600c:4417:: with SMTP id u23mr14060902wmn.26.1624673091279; Fri, 25 Jun 2021 19:04:51 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" X-Mailing-List: archive/latest/19238 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/CAKTje6FMCJtzKctudYQ8mqFTAW1MbotBCtEFPTpgVXDjawPWiA@mail.gmail.com Approved: robomod@news.nic.it Lines: 34 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Sat, 26 Jun 2021 02:04:40 +0000 X-Original-Message-ID: X-Original-References: <877dihvfp9.fsf@DigitalMercury.dynalias.net> <20210625211721.eluslf3hee5eug7r@yuggoth.org> <877dihd1ds.fsf@DigitalMercury.dynalias.net> <20210625234144.vwfjk6xprvqzscx3@yuggoth.org> Xref: csiph.com linux.debian.maint.python:13448 On Fri, Jun 25, 2021 at 11:42 PM Jeremy Stanley wrote: > 1. Cryptographically signed tags in a Git repository, with > versioning, revision history, release notes and authorship either > embedded within or tied to the Git metadata. > > 2. Cryptographically signed tarballs of the file tree corresponding > to a tag in the Git repository, with versioning, revision > history, release notes and authorship extracted into files > included directly within the tarball. I would like to see #2 split into two separate tarballs, one for the exact copy of the git tree and one containing the data about the other tarball. Then use dpkg-source v3 secondary tarballs to add the data about the git repo to the Debian source package. > Saying that a raw dump of the file content from a revision control > system is recommended over using upstream's sdists presumes all > upstreams are the same. They're not, and which is preferable (or > doable, or even legal) differs from one to another. Just because > some sdists, or even many, are not suitable as a basis for packaging > doesn't mean that sdists are a bad idea to base packages on. Yes, > basing packages on bad sdists is bad, it's hard to disagree with > that. Probably we should start systematically comparing upstream VCS repos with upstream sdists and reacting to the differences. So far, I've reacted by ignoring the sdists completely. -- bye, pabs https://wiki.debian.org/PaulWise