[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Validating tarballs against git repositories



On 30/03/24 10:05, Simon Josefsson wrote:
Antonio Russo <aerusso@aerusso.net> writes:

1. Move towards allowing, and then favoring, git-tags over source tarballs

Some people have suggested this before -- and I have considered adopting
that approach myself, but one thing that is often overlooked is that
building from git usually increase the Build-Depends quite a lot
compared to building from tarball, and that will more likely trigger
cyclic dependencies.  People that do bootstrapping for new platforms or
cross-platform dislike such added dependency.

Most of the time such added dependencies could be worked around with build profiles and cross building. More widespread support for <nodoc>, <nocheck> and Multi-Arch annotations can greatly reduce the number of deps needed to bootstrap an architecture.

Just as an example, bootstrapping coreutils currently requires bootstrapping at least 68 other packages, including libx11-6 [1]. If coreutils supported <nodoc> [2], the transitive closure of its Build-Depends would be reduced to 20 packages, most of which in build-essential.

[1] https://buildd.debian.org/status/fetch.php?pkg=coreutils&arch=amd64&ver=9.4-3.1&stamp=1710441056&raw=1
[2] https://bugs.debian.org/1057136

Regards,

--
Gioele Barabucci


Reply to: