Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] Unverified, volatile, non-summonable spell sources (example: libaccounts-glib)

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Thomas Orgis <thomas-forum AT orgis.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Cc: treeve AT sourcemage.org
  • Subject: [SM-Discuss] Unverified, volatile, non-summonable spell sources (example: libaccounts-glib)
  • Date: Tue, 28 Jul 2015 09:40:57 +0200

Treeve,

since you don't seem to notice my responses to the sm-commit list, I'm
trying it this way. I take issue with this change, and a second issue
that I just notice via this change:

> commit 026cd74068aa0db9b8f722830d241d314f492520
> Author: Treeve Jelbert <treeve AT sourcemage.org>
> Commit: Treeve Jelbert <treeve AT sourcemage.org>
>
> libaccounts-glib: => master
>
> diff --git a/accounts-sso/libaccounts-glib/DETAILS
> b/accounts-sso/libaccounts-glib/DETAILS
> index c4efca4..c08cf40 100755
> --- a/accounts-sso/libaccounts-glib/DETAILS
> +++ b/accounts-sso/libaccounts-glib/DETAILS
> @@ -1,5 +1,5 @@
> SPELL=libaccounts-glib
> - VERSION=1.18
> + VERSION=master
> SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL
> WEB_SITE=https://gitlab.com/accounts-sso/$SPELL
> SOURCE_URL[0]=$WEB_SITE.git
> @@ -8,7 +8,10 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL
> KEYWORDS=""
> SHORT=""
> cat << EOF

You switch from a version tag to the head of a git repository as source
code for a spell. I would like us always to refer to some stable
verified version as default for a spell. A moving target means that the
stable grimoire is not stable. This is more rolling release than we
want. If you need to get a newer version than the released 1.18, then
refer to the current commit you are testing, not any newer version via
'master'.

That is my opinion. If there is no consensus about that, perhaps we
should have a policy vote (or have the Grimoire Lead step in to
clarify).

The second issue I have is that I had trouble figuring out the actual
download mechanism from DETAILS until I looked further:

shell$ gaze PRE_BUILD libaccounts-glib
source $GRIMOIRE/clone_single_branch &&
clone_single_branch &&
cd $SOURCE_DIRECTORY &&
gtkdocize --copy --flavour no-tmpl
autoreconf -f -i --symlink


And here, I just have to say "No!" and would pray, if so inclined, for
SMGL folks agreeing with me: There are now several issues with this
spell and its default version (not something that happens after the
mage said "give me the scm version").

1. It does not refer to a fixed version, hence no checksum and no hint
about the spell possibly working tomorrow.

2. Not even a detached signature that might work for a moving target.

3. It just pulls from git, hence no simple way to put a tarball onto my
fallback mirror.

4. It does not summon the spell when I do `summon $SPELL`.
This, again, also makes operating a fallback mirror difficult.

5. It accesses the internet in PRE_BUILD.


Points 1 and 2:

This is something I would like to see fixed for several spells: The
default version of a spell should always refer to a fixed upstream
version. We should stop releasing grimoire versions right now if we do
not want to ensure that. Would be pointless. The corrolary is that
integrity checking usually is also avoided by pulling from an SCM repo.
There is a huge gap between our standards and practices there.

If there is no sane way to automatically get a fixed release archive
from upstream, I propose fetching the sources by Guru and then putting
a tarball of it onto our mirrors for download. Then, DETAILS can haz
checksum, which me like. Also, the spell still works in case upstream
is sf.net, code.google.com or similar …

Points 3 and 4:

In this case, there actually is an alternative to get verifiable
tarballs:

SOURCE=libaccounts-glib-238b01e7.tar.bz2
SOURCE_URL[0]=https://gitlab.com/accounts-sso/libaccounts-glib/repository/archive.tar.bz2?ref=238b01e790021660eeefe3bd01f77c8eadd33aa6

That gives us a definite version of the code that we can also add a
checksum for. The archive is still not nice, as the contained directory
always has the same name, but that is a secondary problem. The
important part: With this, you get your fresher version and I get my
tarball and checksum, with my mirror being able to pick that up just
like that once I automated a summon run each night to get all stuff
from grimoire.


Point 5 is about me wanting the build process not needing any network
connection after summon is done. There are several reasons why one
would want that, perhaps the simplest one being operating secured
machines that do not have direct internet connection at all.


Can we agree on these points? Please note that I don't want to forbid
folks offering the option to build a spell from SCM head directly, but
I strongly argue for that not being the default version of the spell.


Alrighty then,

Thomas

Attachment: pgpfYCZ8j6zwG.pgp
Description: Digitale Signatur von OpenPGP




Archive powered by MHonArc 2.6.24.

Top of Page