On Mon, Feb 19, 2024 at 06:01:54PM +0800, George Dunlap wrote: > Hey all, > > One of the questions we had with respect to changing our release > practice (for instance, making the process more light-weight so that > we could do a point release after every XSA) was, "How many people are > actually using the tarballs?"
What would this more lightweight process involve from a downstream PoV? IOW: in what would the contents of the tarball change compared to the current releases? > I finally got access (again) to > downloads.xenproject.org, and took a look at the logs. It appears > that we only keep about 2 weeks of logs there. > > Short answer: It's pretty clear from looking at the logs that there > are large numbers of automated build systems building various versions > of Xen from tarballs. It *looks* like there are over 300 people a > week downloading 4.18.0 specifically from various web browsers. As someone who packages Xen for FreeBSD, I've recently switched the build to use the git sources directly, as otherwise keeping up with XSA tends to be a pain, specially when XSAs happen to depend on the context of some of the backports that happened between the point release and the XSA disclosure. Overall as a consumer of Xen it would be helpful if we could make a release for each (batch) or XSAs, as that would possibly make me switch to build from the release tarballs instead of git. I don't think it would be much of a disruption if such change to generate more lightweight tarball is done starting from a major release (ie: 4.19) and minor releases of previous versions (4.18.x) are kept using the non-lightweight process. Thanks, Roger.
