On Thu, Apr 05, 2012 at 02:00:57PM -0500, Ryan Schmidt wrote: > In MacPorts we would prefer to go to almost extraordinary lengths to > use tarballs and patchfiles rather than fetching from a version > control system. This is because we can mirror distfiles and > patchfiles* so that in case the upstream files go away our users can > still install the ports.
Interesting point. I hadn't thought about this. > We also list checksums for each distfile and patchfile* so our users > are ensured the software they're installing is the same software the > maintainer tested. In the case of Mercurial (or Git) you still get the same cryptographic integrity. If you set hg.tag (or git.branch) to a specific hash identifier, you will always be assured you're getting the same set of files and that those files contain the same data. I am fairly sure both tools verify hashes during normal operations, but if you want to be extra sure, you could include a run of 'hg verify' (or 'git fsck'). I don't know the complete set of vcs's that you support, but I do know that this does NOT apply to subversion. In that case this is perfectly valid reason to prefer tarballs and patchfiles with listed checksums. > If no distfiles are available and fetching from a version control > system seems like the only solution, it would still be preferable for > the maintainer to package up a distfile of it and upload it and make > the port use that. But we're often lazy and resort to fetching > directly from the vcs in those cases. Some day we might write a script > to automate the creation of such distfiles, at which point we'll have > fewer valid excuses. Ok, so I guess its up to Rainer if he feels like the benefit is worth the added effort of creating/uploading a distfile. I personally think it is worth the effort, but then again I'm not the one that is going to have to do it! For everyone's benefit, here is a concrete example of how this affects MacPorts vim. I am running vim @7.3.462_0 (the newest and most up-to-date in MacPorts as of today). The version of netrw included with this vim installation is 140 $ grep '^" Version' /opt/local/share/vim/vim73/autoload/netrw.vim " Version: 140 Vim patch 462 is recorded in the vim Mercurial repo with a date of Wed Feb 29 19:20:02 2012 +0100 (changeset 70eff6af1158). The inclusion of netrw.vim version 140 is recorded with a date of Wed Jul 28 18:17:41 2010 +0200 (changeset e52d87a2bb3e). Since that time (but before the date of patch 462) there have been these updates that we have missed: 141: Fri Apr 01 18:03:16 2011 +0200 (changeset b0d34143ebfc) 142: Sun Jun 19 05:09:16 2011 +0200 (changeset fd09a9c8468e) 143: Thu Oct 20 22:22:38 2011 +0200 (changeset 37ecb8ff4560) Personally, I rarely use netrw and I have no idea if any of these upgrades fix any critical bugs or provide any killer features. This is just an example. Chris _______________________________________________ macports-dev mailing list [email protected] http://lists.macosforge.org/mailman/listinfo.cgi/macports-dev
