Re: Different xen-3.4.3.tar.gz in Fedora RPM

[Keir Fraser <keir.fraser@eu.citrix.com>]

On 18/06/2010 13:10, "Joanna Rutkowska" <joanna@invisiblethingslab.com>
wrote:

> So, I downloaded xen-3.4.3.tar.gz from fedora mirror (using their
> original Makefile for RPM building), and diffed the two versions --
> changes (cosmetic cleanup mostly) are innocent, but, hey, why would
> anybody do such a thing? After allm we would expect only one version of
> xen-XXX.tar.gz, right? Patches should be the proper way for customizing
> tarballs for packaging, no?
> 
> Or am I missing something?

Well, I think this and your other point have one simple answer. If I wanted
the maximum possible confidence in the bits I was building, I would obtain
them from the original source, as it were. In this case that means, for
example:
# hg clone -r RELEASE-3.4.3 http://xenbits.xensource.com/xen-3.4-testing.hg
If you want your own tarball for some reason:
# hg archive -t tgz xen-3.4.3.tar.gz

It doesn't seem very hard to me. I maintain the repo and sign the releases
myself. Downloading tarballs from Fedora, or even from our own xen.org
website, introduces more people between you and me. And it seems you very
likely care about that.

 -- Keir

> joanna.
>