Path: csiph.com!newsfeed.xs4all.nl!newsfeed8.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Simon McVittie Newsgroups: linux.debian.maint.python Subject: Re: DPT repositories checks/"violations" report Date: Sat, 27 Nov 2021 12:20:01 +0100 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Sat Nov 27 11:15:41 2021 Old-Return-Path: X-Amavis-Spam-Status: No, score=-7.949 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIMWL_WL_HIGH=-0.049, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, LDO_WHITELIST=-5, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Mailing-List: archive/latest/19536 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/YaITRNlA+KpeuVCN@momentum.pseudorandom.co.uk Approved: robomod@news.nic.it Lines: 30 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Sat, 27 Nov 2021 11:15:16 +0000 X-Original-Message-ID: X-Original-References: <318988FB-253F-499D-9B9F-385634035A28@kitterman.com> Xref: csiph.com linux.debian.maint.python:13733 On Sat, 27 Nov 2021 at 09:38:41 +0000, Scott Kitterman wrote: > I don't think the pypi tarball "issue" should be presumed to be a > problem at all. I wasn't paying attention to Debian when that discussion > happened, but in my experience there was a lot wrong with the idea. > A properly constructed sdist is exactly what we want to build a package > from. That's almost never found on GitHub. I think the closest we got to a conclusion was "it depends": if your upstream reliably produces a properly constructed sdist (or at least is happy to accept pull requests to make their sdist properly constructed) then it makes an ideal source package, but if your upstream treats sdists in closer to the same way a C programmer would treat a prebuilt binary release (omitting source and including content generated from that source instead), then a git clone is probably more appropriate. To me, at least, it makes sense for this to be a case-by-case decision made by someone who is familiar with this specific upstream - and wanting to have someone familiar with this specific upstream is why we have named maintainers, rather than having everything collectively-maintained like some distributions do. (For what it's worth, the GNOME team uses a mixture of `meson dist` and git clones, and that's with an upstream that is a single project that is in principle meant to be team-maintained with a single cohesive policy - so if we can't standardize on one source format being "always the right one" for GNOME, I would be very surprised if the Python team was able to standardize on one source format for a large number of separate upstreams linked only by their implementation language.) smcv