Re: [Buildroot] Hash verification from GitHub

["Yann E. MORIN" <yann.morin.1998@free.fr>]

Danilo, All,

On 2022-01-17 11:24 +0100, Danilo Bargen spake thusly:
> On 1/17/22 11:17, Yann E. MORIN wrote:
> >I.e. it means that we prefer using tarballs as-is from their upstreams,
> >when they are vendored; we only vendor packages which upstreams have
> >not.
> That makes sense! I am the maintainer of tealdeer, and I'll provide a
> vendored source tarball for the next release. (I've heard of "cargo vendor"
> before, but I haven't used it so far.)

Note that vendoring is definitely not a requirement we impose on
upstreams.

We do prefer when the vendoring has been done by upstream, because it
means (at least we hope it does!) that upstream has validated the fully
vendored package, and thus we have some confidence everything works as
expected.

It also avoids the case where an uppstreams for a dependency mucks
around with their releases: we already noticed the case where an
upstream for a dependency did a re-tag of their release, thus breaking
the vendoring of the dependees because it would no longer match the
expected hashes in the cargo.toml (or go.mod?). Also (but that's mostly
for go, IIRC), we also already noticed that some of the points of
distribution (goproxies?) are serving some incorrect archives, thus
causing download issues...

However, if an upstream decides to not vendor (for whatever reason),
then this is perfectly fine for Buildroot; this is exactly why the cargo
infra has been made to support doing the vendoring.

All in all, it is better that upstream vendors their releases, because
it avoids any of the pitfals I mention above.

Regards,
Yann E. MORIN.

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot