Requesting versioned snapshots

UnitedMarsupials commented 3 years ago

Hello!

I'd like to make a FreeBSD port of ccan -- because I need it for some other software. The ports work best, when the "upstream" releases have versions in the filenames.

Could I trouble you to place ccan-1.0.tar.bz2 (or .xz) next to the ccan.tar.bz2 you already publish? The version-less name can continue pointing -- as a symlink or, better yet, an HTTP-redirect -- at the latest, whatever it is, but people seeking a specific release (for which there is a known checksum, etc.) will continue to be able to download it explicitly.

Thank you in advance!

dgibson commented 3 years ago

This kind of seems like a bad idea to me. ccan isn't really a unified project but a bunch of disparate modules. We don't aim to - and really can't - do any kind of overall release management. Making versioned packages seems like it would imply that we do.

@rustyrussell thoughts?

UnitedMarsupials commented 3 years ago

can't do any kind of overall release management.

Come on, no one seriously expects that -- for better or worse, that idea is gone for as long as printed manuals are, if not longer...

Making versioned packages seems like it would imply that we do.

Well, call them "snapshots" then :) If it was good enough to upload as ccan.tar.bz2, it is a snapshot... You can use sortable dates (YYYY-MM-DD) instead of release-numbers to prevent anyone with 20th century idea of "release" getting a misconception. Or just add a permanent beta to all file-names...

Just provide some means for downloading not only the most recent tarball, but also the earlier ones -- keeping them for, at least, a year. This is not "just a good idea", this is necessary for other projects to be able to rely on yours. Without it:

Those downloading the code will have no way to be certain of its integrity -- a hacker could, one day, inject an exploit somewhere, and no one will ever know. Because there are no checksums -- due to content of the file subject to change without the file getting a new name.
Even without any malice, some of the bundled libraries may change API, deliberately or by mistake, between ~~releases~~ snapshots, rendering depending code uncompilable -- both without a warning nor means of rolling back.

rustyrussell commented 3 years ago

I did this, but there's a twist. I let ccodearchive.net expire, and it's being served elsewhere. I no longer have control of the domain, so I will need to host tarballs here...

UnitedMarsupials commented 3 years ago

I did this, but there's a twist

I haven't checked yet, but it seems like the version is derived from the git hash, no? If yes, this will make versions impossible to sort...

I let ccodearchive.net expire, and it's being served elsewhere. I no longer have control of the domain

The readme and other places still refer to the domain -- you, probably, want to change that too. But, have you tried asking the new owners of the domain nicely?

rustyrussell commented 3 years ago

No, it's derived as commits-since-init. e.g. ccan-2516.tar.bz2

rustyrussell commented 3 years ago

Good question re: contacting them, but I'm not sure how. They seem to be using cloudflare, and whois is understandably non-useful.

UnitedMarsupials commented 3 years ago

Good question re: contacting them, but I'm not sure how.

The front page now links to a casino web-site at the bottom. Maybe, there is contact information there?

rustyrussell / ccan

Requesting versioned snapshots #90