I'm seeing an increasing number of programs, whose configure and/or
makefile have been written, to open a connection to some remote url
(usually controlled by the project) download file(s) from there and
build them into the software.
I've also seen this routinely done by bootstrap scripts in GNU packages,
e.g., the one that's part of gnulib and used by many packages, but not
in releases.
I think this is a bad idea
I fully agree. I personally wish that even bootstrap scripts wouldn't
do it, but I think forbidding that would be going too far.
I think we should put a statement about it in the GCS.
Sounds fine to me, FWIW. You could draft some (concise) text ...
On a somewhat related front, the GCS could also mention that merely
putting a tag into a repository is not sufficient for what we call
"making a release".
karl
