search

luvit / lit

Toolkit for developing, sharing, and running luvit/lua programs and libraries.
http://lit.luvit.io/
Apache License 2.0
245 stars 58 forks source link

No files timestamps in zip file #153

Open joerg-krause opened 8 years ago

joerg-krause commented 8 years ago

Unzipping the zipped release file fetched from https://lit.luvit.io/packages/luvit/lit using unzip on Linux gives a wrong timestamp:

$ unzip v2.3.1.zip -d lit-2.3.1

$ ls -l /home/joerg/lit-2.3.1/main.lua 
-rw-r--r-- 1 joerg joerg 1951 31. Dez 1979  /home/joerg/lit-2.3.1/main.lua

$ stat /home/joerg/lit-2.3.1/main.lua
Access: 1979-12-31 00:00:00.000000000 +0100
Modify: 1979-12-31 00:00:00.000000000 +0100
Change: 2015-12-23 22:15:55.132868757 +0100

I've checked the zip files, and the files have a zero timestamp now. I'm not sure, if this may cause some trouble in some systems.

EDIT: I realized that the files are not fetched from lit install, but from wget and using unzip on the fetched zip file.

creationix commented 8 years ago

Yes, I no-longer include the timestamps because it's very hard to get the actual timestamp and I need something that doesn't change between builds.

I suppose I could walk back in history of the git tags (by decrementing the version number and seeing if such a tag exists) and seeing when the contents of a file at a certain path change. This would be a very expensive and hard to do algorithm.

joerg-krause commented 8 years ago

How about caching a release file?

creationix commented 8 years ago

Caching could be done, but if the cache was ever cleared then the release hash would change. So this is more than just caching for optimization sake, it would need stronger guarantees.

Also is there any real problem with files not having valid timestamps?

joerg-krause commented 8 years ago

Sorry for my ignorance, but why not create a release tarball (by the author), store it on the server (like github does), and fetch it by lit?

There are some cloud data tools relying on a files timestamps, e.g. ownCloud. Maybe there are some other reasons (maybe security?) I do not know of.

creationix commented 8 years ago

What if all files had the timestamp of the git tag for the release? Then they would be consistent and relatively accurate. I would need to add in the functionality to miniz to allow custom timestamps (currently the only options are "current time" or "no timestamp"). But this wouldn't be the first time I've added features or fixed bugs in miniz for luvi.

joerg-krause commented 8 years ago

Good idea! This way the files would have a sane timestamp.

creationix commented 8 years ago

See https://github.com/luvit/luvi/issues/133 for progress. Then adding the functionality to lit should be easy.