Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Unverified, volatile, non-summonable spell sources (example: libaccounts-glib)

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Treeve Jelbert <treeve AT scarlet.be>
  • To: <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] Unverified, volatile, non-summonable spell sources (example: libaccounts-glib)
  • Date: Tue, 28 Jul 2015 11:12:43 +0200

On Tue, 28 Jul 2015 09:40:57 +0200, Thomas Orgis wrote:
Treeve,

since you don't seem to notice my responses to the sm-commit list, I'm
trying it this way. I take issue with this change, and a second issue
that I just notice via this change:

commit 026cd74068aa0db9b8f722830d241d314f492520
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>

libaccounts-glib: => master

diff --git a/accounts-sso/libaccounts-glib/DETAILS b/accounts-sso/libaccounts-glib/DETAILS
index c4efca4..c08cf40 100755
--- a/accounts-sso/libaccounts-glib/DETAILS
+++ b/accounts-sso/libaccounts-glib/DETAILS
@@ -1,5 +1,5 @@
SPELL=libaccounts-glib
- VERSION=1.18
+ VERSION=master
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL
WEB_SITE=https://gitlab.com/accounts-sso/$SPELL
SOURCE_URL[0]=$WEB_SITE.git
@@ -8,7 +8,10 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL
KEYWORDS=""
SHORT=""
cat << EOF

You switch from a version tag to the head of a git repository as source
code for a spell. I would like us always to refer to some stable
verified version as default for a spell. A moving target means that the
stable grimoire is not stable. This is more rolling release than we
want. If you need to get a newer version than the released 1.18, then
refer to the current commit you are testing, not any newer version via
'master'.



the reason for the version change was that the previous relased tag nolonger builds.


That is my opinion. If there is no consensus about that, perhaps we
should have a policy vote (or have the Grimoire Lead step in to
clarify).

The second issue I have is that I had trouble figuring out the actual
download mechanism from DETAILS until I looked further:

shell$ gaze PRE_BU PRE_BUILD ILD libaccounts-glib
source $GRIMOIRE/clone_single_branch &&
clone_single_branch &&
cd $SOURCE_DIRECTORY &&
gtkdocize --copy --flavour no-tmpl
autoreconf -f -i --symlink



The reason that this code is in PRE_BUILD rather than DOWNLOAD, is that although it would download to my sourcedir, sorcery deletes it before calling PRE_BUILD.
I did not particularly like this solution either, but I needed these spells for something else.


And here, I just have to say "No!" and would pray, if so inclined, for
SMGL folks agreeing with me: There are now several issues with this
spell and its default version (not something that happens after the
mage said "give me the scm version").

1. It does not refer to a fixed version, hence no checksum and no hint
about the spell possibly working tomorrow.

2. Not even a detached signature that might work for a moving target.

3. It just pulls from git, hence no simple way to put a tarball onto my
fallback mirror.

4. It does not summon the spell when I do `summon $SPELL`.
This, again, also makes operating a fallback mirror difficult.

5. It accesses the internet in PRE_BUILD.


Points 1 and 2:

This is something I would like to see fixed for several spells: The
default version of a spell should always refer to a fixed upstream
version. We should stop releasing grimoire versions right now if we do
not want to ensure that. Would be pointless. The corrolary is that
integrity checking usually is also avoided by pulling from an SCM repo.
There is a huge gap between our standards and practices there.

If there is no sane way to automatically get a fixed release archive
from upstream, I propose fetching the sources by Guru and then putting
a tarball of it onto our mirrors for download. Then, DETAILS can haz
checksum, which me like. Also, the spell still works in case upstream
is sf.net, code.google.com or similar …


The project has moved its code to gitlab, which causes all of the other problems,
in particular there seems to be no way to get a properly versioned tarball, so I resorted to ta minimal git checkout.
This problem affects most of the spells in this section, some of which have a a lot of history which I did not want.
In some cases the difference was ~300K vs ~15M.
Also some of the spells have no official releases.

Does 'summon' process the DOWNLOAD file?
If so, I coud improve the clone_single_branch function, to give a reproducible result.

It might make sense to have a sorcery downloader which did something similar, so that the minimal download cound be kept and verified.


Points 3 and 4:

In this case, there actually is an alternative to get verifiable
tarballs:

SOURCE=libaccounts-glib-238b01e7.tar.bz2

SOURCE_URL[0]=https://gitlab.com/accounts-sso/libaccounts-glib/repository/archive.tar.bz2?ref=238b01e790021660eeefe3bd01f77c8eadd33aa6

That gives us a definite version of the code that we can also add a
checksum for. The archive is still not nice, as the contained directory
always has the same name, but that is a secondary problem. The
important part: With this, you get your fresher version and I get my
tarball and checksum, with my mirror being able to pick that up just
like that once I automated a summon run each night to get all stuff
from grimoire.


Point 5 is about me wanting the build process not needing any network
connection after summon is done. There are several reasons why one
would want that, perhaps the simplest one being operating secured
machines that do not have direct internet connection at all.



In this particular case, the spells are unlikely to be of interest on machines with no internet connection.


Can we agree on these points? Please note that I don't want to forbid
folks offering the option to build a spell from SCM head directly, but
I strongly argue for that not being the default version of the spell.


Alrighty then,

Thomas





Archive powered by MHonArc 2.6.24.

Top of Page