Ludovic Courtès <[email protected]> writes: > What about this radical proposal: we stop publishing source tarballs. > > Alternative proposal: we publish a tarball produced by ‘git archive’.
+1 I think GPG signed tarballs is better than relying only on git tags, for archival and auditing reasons. > Thoughts? It do seems problematic if 'make dist' does not work, so that should be fixed but maybe it doesn't have to be a release-blocker. Further, for bootstrapping reasons, what do you think about confirming that the following works? 1) Install guix system 1.5.0 on an offline machine, don't update it. 2) Transfer the guix 1.6.0 git-archive tarball to the system. 3) Unpack and build it, including 'make dist' step. Or is that unlikely to ever work be able to work, if guix 1.6.0 requires newer version of dependencies that are in guix 1.5.0? Maybe the pace of dependency updates should be done a bit conservative so tools in the last major release is still supported. They could be dropped in 1.7.0. /Simon
signature.asc
Description: PGP signature
