search

antonmedv / fx

Terminal JSON viewer & processor
https://fx.wtf
MIT License
19.08k stars 438 forks source link

Please don't re-tag! #194

Closed alerque closed 2 years ago

alerque commented 2 years ago

The tag for 21.0.0 was posted yesterday or the day before, then changed 9 hours ago. In the mean time I packaged and shipped it it for Arch Linux. In fact prior to my official package somebody bumped the AUR build as well.

These builds have been invalidated because the upstream checksum changed when the tag was removed and reposted. Please don't do this again. This is a moderately successful project with a lot of downstream users, and checksums changing upstream is a problem for distro packagers.

In the future if need arises to fix something with the release process just do a small patch release, say 21.0.1 or whatever until things are right. Most packaging processes are more amenable to small bumps than they are to unexplained invalidated checksums.

Thanks (and thanks for the project of course!).

alerque commented 2 years ago

Just FYI, here are some distros that have packaged fx and their current version status:

Packaging status

antonmedv commented 2 years ago

Wow, awesome. Sorry didn’t know about this one. I was messing around with by build/release process.

What do you think if we include Arch release in this repo actions?

alerque commented 2 years ago

No, unfortunately the upstream packaging process by most distros needs to be done by somebody from the distro. In Arch's case for example it is supposed to be manually checked for function by the packager, then must be GPG signed as part of the deploy process. I can't GPG sign anything built from this repo's CI jobs — it has to be built using Arch build systems (we have reproducible build verification going on so it has to be 100% identical).

At most a handful of systems are open to Git pull requests and submitting those can be semi automated for simple bumps. They still need to be validated with the upstream CI and signed off by a repo manager though.

alerque commented 2 years ago

By the way just a tip: if you want to muck around with build/release process including tagging that would normally trigger downstream notifications, start yourself a scratch Org on GitHub, then fork this project there and mess with branches and tags all you like, then when you know it works you can push here again. That way you don't make noise / mess up anybody of the 13,000+ people that have this tagged and/or notifications turned on, but you can fiddle with CI including using the default/canonical branch to see how the build process works.