search

conda / conda-build

Commands and tools for building conda packages
https://docs.conda.io/projects/conda-build/
Other
379 stars 420 forks source link

Checksum for source RPMs in CDT #3552

Open jakirkham opened 5 years ago

jakirkham commented 5 years ago

It looks like the CDT template ignores source RPMs' checksums. Based on the note it sounds like we lack verified checksums to use here. Raising to see if there is any other way we might be able to add a checksum for the source RPMs.

cc @mingwandroid

mingwandroid commented 5 years ago

A lot of the RPM stuff parses xml with code developed through trial and error. I wonder if using dnf would be better in some ways. I did look at this once though and it looked like a lot of work!

jakirkham commented 5 years ago

AIUI source RPMs don't actually have verified checksums in the repo. So we would be generating these ourselves by downloading the RPM and computing a checksum. This is a bit kludgy, but I guess we can do that. Or is there a better option that I'm missing?

scopatz commented 5 years ago

Is there a way for the skeleton to generate the checksum for you?

jakirkham commented 5 years ago

Not currently no. We would need to add this. It's important to note this checksum would not be externally validated.

Assuming external validation doesn't matter, here are the rough things we would need to do. We would need to change this line to keep the checksum. Then we'd need to update the template and what gets filled in there. There's probably also some work to pass the checksum around to get it into the template.

isuruf commented 5 years ago

@jakirkham, you can also do what R folks do and have a script that updates the recipe that the conda skeleton gives you.

isuruf commented 5 years ago

xref: https://github.com/bgruening/conda_r_skeleton_helper

jakirkham commented 5 years ago

I'd rather just get the intended behavior into conda-build.

jakirkham commented 5 years ago

For now, I've proposed dropping source RPMs until we have solved this issue (especially given they do not appear to be used) ( https://github.com/conda/conda-build/pull/3580 ).

Though there may be cases where we want them like packaging license files ( https://github.com/conda/conda-build/issues/3568 ). So we still will want to solve this issue.

github-actions[bot] commented 1 year ago

Hi there, thank you for your contribution!

This issue has been automatically marked as stale because it has not had recent activity. It will be closed automatically if no further activity occurs.

If you would like this issue to remain open please:

  1. Verify that you can still reproduce the issue at hand
  2. Comment that the issue is still reproducible and include:
    • What OS and version you reproduced the issue on
    • What steps you followed to reproduce the issue

NOTE: If this issue was closed prematurely, please leave a comment.

Thanks!

jakirkham commented 1 year ago

Let's keep this open. Also there is a PR linked above that could use a review (when someone has a moment)