Re: [RFC] General Resolution to deploy tag2upload

[Joerg Jaspert <joerg@debian.org>]

On 17265 March 1977, Russ Allbery wrote:

> The point is to support a wide variety of workflows and not impose a
> workflow on the maintainer.  The cost is a source package build step.
> Maybe there are some workflows that can be supported without that, but
> that's not the point; in the general and hardest cases, the build step 
> is
> required and the transformations are not trivial.  The goal is that 
> the
> maintainer doesn't have to reproduce that step and sign the results; 
> they
> can sign a Git tag and let tag2upload do the work.

> You and Joerg both sounded like you were considering accepting that.
> Specifically, you said:

> | A downside is that integrity verification and third parties 
> (possibly)
> | verifying the data falls flat. For me integrity verification would 
> be
> | somewhat nice and third parties a bit less interesting (given they 
> can
> | get the tag, compare files and possibly redo what tag2upload does if
> | they also care about .dsc and stuff).

> "Somewhat nice" is not "this is a blocking requirement."  It's "I 
> don't
> like that we don't have this, but maybe there's some room here." 
> So... is
> there some room here?

> From my side, it hasn't changed. A new way of representing things is not 
a blocker.
--
bye, Joerg