On Tue, Jun 09, 2020 at 06:41:33AM -0400, The Wanderer wrote: > (Please stop CCing me on replies [...]
Sorry. [...] > FWIW, I have tried, at least in part. Thanks for taking the time to do, and thanks for reporting back. [...] > Even a successful build from a repository like that would not > demonstrate that you can actually completely rebuild the project from > scratch [...] Yes, this is a well-known problem with many facets. ISTR that there was a Lisp which only could build itself: the whole buildery (which, this being Lisp included everything, compiler, assembler and all) was written in Lisp, and took advantage of newer and newer features. A full bootstrap involved unearthing "old versions" and following the historical evolution of that thing. Some "ecosystems", like Java, tend to build up a huge network of dependencies on "well-known" components -- something I used to call it the "Java Disease". Until Javascript came with npm, or PHP with composer. It can get worse. Building something significant, like Jitsi, lands you in this hell, and to survive, you end up ingesting those dependencies (that's what is called "vendoring" -- imo the Euphemism of the Decennium). On the other end there are heroes, like the Guix folks [1], or the reproducible build folks [2] working relentlessly on disentangling those things. Debian packaging belongs into that class of heroism. So from my POV there is a lot to critizice there, and a lot to fix -- but "this is not free software just because I'm too lazy to check thoroughly", as some have basically said here is simply unfair -- and counterproductive. Cheers [1] https://guix.gnu.org/ [2] https://reproducible-builds.org/ -- tomás
signature.asc
Description: Digital signature
