Also compression programs sometimes improve (without changing the decompression routine), and/or their default parameters might be machine-dependent.
On Monday, January 12, 2015 at 3:22:53 PM UTC+1, Thierry (sage-googlesucks@xxx) wrote: > > On Mon, Jan 12, 2015 at 04:47:55PM +0530, Nathann Cohen wrote: > > Hello Thierry ! > > > > What about checking that there is nothing wrong without a hashsum ? > > > > 1) Download the author's .tar.bz2 file > > 2) Use the sage-src script to generate the .tar.bz2 file yourself > > 3a) If the hashed match you are done > > 3b) If they do not match, extract them both and compare their content > > with diff -r dir1 dir2 > > > > Doesn't it always work ? > > This is precisely what i would like to have ! But for 3a to work, the > spkg-src script must behave deterministically, which is not the case at > all, since the tarballs contain some info about timestamps, user, group, > it depends on the order in which files are stored and so on. > > Simple example (not really about tar but about its way to handle gzip): > > touch plop > for i in $(seq 10); do > tar czf plop.tar.gz plop > sleep 1 > shasum plop.tar.gz > done > > This is why i am looking for a way to rewrite spkg-src in a deterministic > way (across all machines). Currently, when i review a package, i have to > extract the tarball and hashsum every file and compare them to my own > build of the tarball. > > The aim of this thread is to check whether the line > > find matplotlib-1.4.2 | sort | tar --no-recursion -cj --format=gnu > --mtime='1970-01-01 01:00' --group=0 --owner=0 -f matplotlib-1.4.2.tar.bz2 > -T - > > does the job or if they are still some variations depending on the tar > version, the OS, the arch or whatever. > > Ciao, > Thierry > > > > > Nathann > > > > -- > > You received this message because you are subscribed to the Google > Groups "sage-devel" group. > > To unsubscribe from this group and stop receiving emails from it, send > an email to sage-devel+...@googlegroups.com <javascript:>. > > To post to this group, send email to sage-...@googlegroups.com > <javascript:>. > > Visit this group at http://groups.google.com/group/sage-devel. > > For more options, visit https://groups.google.com/d/optout. > > > -- You received this message because you are subscribed to the Google Groups "sage-devel" group. To unsubscribe from this group and stop receiving emails from it, send an email to sage-devel+unsubscr...@googlegroups.com. To post to this group, send email to sage-devel@googlegroups.com. Visit this group at http://groups.google.com/group/sage-devel. For more options, visit https://groups.google.com/d/optout.
