Re: Recording VCS information in the source package info

[Jonathan Nieder <jrnieder@gmail.com>]

Hi again,

Three more thoughts and I’ll shut up.  (Is there a web page and
mailing list for this VCS-based archive project?)

James Westby wrote:

> We want to confirm that each source package is in the VCS. We don't want
> the VCS getting out of date as someone forgot to commit, that's just a
> pain.

Longer term, IIUC you could eliminate the source packages, but I
understand that it takes time to migrate.

> On Thu, 18 Feb 2010 11:40:51 -0600, Jonathan Nieder <jrnieder@gmail.com> wrote:

>> What you are describing does not have as much to do with the Vcs-foo
>> repository as I was imagining.  What you need is a hash of the source
>> tree used to build the package; the history is not at all relevant,
>> and in fact you would want to ignore it.  The main thing this has to
>> do with version control systems is that each one has its own format
>> for the hash of a file system tree, I guess.
>
> Yes, I guess you are right. It could be an independent hash, but
> allowing it to be VCS specific will usually be much more efficient when
> checking.
> 
> I don't mind too much either way, the reason I suggested Vcs-*-tree was
> that I came from Vcs-*-revision and realised tree information would be
> useful too.

The main not-so-nice thing about only providing the tree would be that
whoever checks this would have to iterate over revisions looking for
that tree hash.  To avoid this, it might even be worth just using the
revision (sorry for the wobble --- it just took me a while to understand
what you’re doing).  Whatever tool you use to build the source package
and insert this field (bzr-buildpackage --ubuntu, I guess) could
disallow building from a dirty tree.

Using just a tree hash would allow lower-level tools to compute the
hash.  That is, as long as it is clear what format to use, dpkg-source
could compute the hash, or the archive software could compute the hash
itself and add it to Sources.

Jonathan