On Mon, Oct 02, 2017 at 05:09:39PM +0200, Ludovic Courtès wrote: > What’s sad here is that we do have the right tarball at: > > > https://mirror.hydra.gnu.org/file/libgit2-0.25.1.tar.gz/sha256/1cdwcw38frc1wf28x5ppddazv9hywc718j92f3xa3ybzzycyds3s
It seems to me that there are several reasons someone may choose not to use substitutes. Some of those reasons (reproducibility and security concerns) are obviated for fixed-output derivations like upstream sources, and I think it would be fine to still use substitutes for these derivations. But the motivations of privacy, self-sufficiency, etc are not addressed by that idea.
signature.asc
Description: PGP signature
