From debbugs-submit-bounces@debbugs.gnu.org Mon Oct 02 16:23:06 2017 Received: (at 28659) by debbugs.gnu.org; 2 Oct 2017 20:23:06 +0000 Received: from localhost ([127.0.0.1]:44581 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dz7F2-0005B8-G7 for submit@debbugs.gnu.org; Mon, 02 Oct 2017 16:23:06 -0400 Received: from eggs.gnu.org ([208.118.235.92]:59974) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dz7F1-0005AR-1i for 28659@debbugs.gnu.org; Mon, 02 Oct 2017 16:23:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dz7Er-0006WC-P3 for 28659@debbugs.gnu.org; Mon, 02 Oct 2017 16:22:57 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-0.5 required=5.0 tests=BAYES_05,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:47492) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dz7Eb-0006C3-17; Mon, 02 Oct 2017 16:22:37 -0400 Received: from peder.onsbrabantnet.nl ([88.159.206.46]:51076 helo=dundal.peder.onsbrabantnet.nl) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1dz7Ea-0003Xl-IH; Mon, 02 Oct 2017 16:22:36 -0400 From: Jan Nieuwenhuizen To: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: bug#28659: v0.13: guix pull fails; libgit2-0.26.0 and 0.25.1 content hashes fail Organization: AvatarAcademy.nl References: <877ewf18d4.fsf@gnu.org> <87o9ppoabw.fsf@gnu.org> <20171002182208.GB10773@jasmine.lan> <878tgt721q.fsf@gnu.org> X-Url: http://AvatarAcademy.nl Date: Mon, 02 Oct 2017 22:22:33 +0200 In-Reply-To: <878tgt721q.fsf@gnu.org> ("Ludovic \=\?utf-8\?Q\?Court\=C3\=A8s\=22'\?\= \=\?utf-8\?Q\?s\?\= message of "Mon, 02 Oct 2017 22:00:33 +0200") Message-ID: <87a8198fli.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: 28659 Cc: 28659@debbugs.gnu.org, Leo Famulari X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) Ludovic Court=C3=A8s writes: > Right. Jan suggested checking the content-addressed mirrors *before* > the real upstream address. That would address the problem of upstream > sources modified in-place, but at the cost of privacy/self-sufficiency > as you note. (Though it=E2=80=99s not really making =E2=80=9Cprivacy=E2= =80=9D any worse in this > case: it=E2=80=99s gnu.org vs. github.com.) Yes, that may not preferrable in general without override. > Perhaps we should make content-addressed mirrors configurable in a way > that=E2=80=99s orthogonal to derivations, something similar in spirit to > --substitute-urls? The difficulty is that content-addressed mirrors are > not just URLs; see (guix download). Hmm. I'm not sure what problem we are solving. Should we only do this for github(-like) tarballs? Do we see this problem with other sources, should we prevent it? Possibly github will never do something like this again. Or we could banish github/gitlab(?) auto-generated tarballs and go for git checkouts+commits? janneke --=20 Jan Nieuwenhuizen | GNU LilyPond http://lilypond.org Freelance IT http://JoyofSource.com | Avatar=C2=AE http://AvatarAcademy.com