On 2026-10-12, Ludovic Courtès wrote: > Jelle Licht <[email protected]> skribis: > >> The source tarball is one release artifact that nobody can reproduce >> easily. ... > What about this radical proposal: we stop publishing source tarballs. > > Alternative proposal: we publish a tarball produced by ‘git archive’. > > This would be in line with our stance on bootstrapping and with > <https://...codeberg....org/guix/guix/milestone/66679>. > > In practice, the only people impacted by this would be distros providing > Guix, such as Debian. I doubt it would make a difference though: Debian > discards non-source artifacts, such as files produced by the autotools, > so that’s fine.
With my Debian hat on, that would be great! We indeed try to throw most of the things away that are added to the tarball away or regenerate them. With... the obvious caveat, as long as it works! In the past I have tried to package git snapshots and many parts of the build simply did not work, and then I ended up developing a process to make my own "release" for experimental versions for Debian with "make dist" and such... (accidentally even pushing an annoying tag at one point, and unsuccessfully deleting it as people kept pushing it again) I might appreciate the alternate proposal (git archive tarballs) in addition, as that would allow effectively signing the tarball's contents, which may have stronger provenance properties that just the signed tag itself... ? pristine-tar is a tool that attempts to reliably create bit-for-bit identical tarballs out signed tags, if you wanted to explore that route... (I think there are some of the usual caveats) live well, vagrant
signature.asc
Description: PGP signature
