On Fri, 28 Aug 2026 at 19:02, Pavel Lyalyakin <[email protected]> wrote:
> Hello, > > Depending on the scenario, someone who is building SVN can obtain its > dependencies either 1) from the OS package manager or 2) from version > control or from the source release packages of the dependencies themselves. > The latter requires configuring, building and installing each dependency > from source. As far as I understand, get-deps.sh only downloads the source > code of the dependencies but that's it. The user still has to build and > install them. So is the only benefit of get-deps.sh that it downloads the > tarballs and extracts them? Or am I missing something? Or rewording the > question, who is the indended user of the get-deps.sh script? > > I see that the script downloads fixed versions of the dependencies and > they aren't the latest (so I think that the versions aren't "best"), If I > use the script without modifications, I'll get outdated versions of the > components. > > This question came up while I was working on the INSTALL document > (r1937573[1] and r1937576[2]). Since get-deps.sh by default downloads > outdated versions of the dependencies and there is an easier alternative in > the form of a package manager, I don't think that recommending get-deps.sh > to everyone as the way to obtain the dependencies is a good advice. And if > a package maintainer builds the SVN and its deps from source code, wouldn't > they be using another path for downloading the source code of the > dependencies anyway? > > BTW, I think that get-deps.sh has an issue that it doesn't verify the > authenticity of what it downloads. Subversion historically provided a > special tarball distribution of its dependencies, which was later removed. > It seems to me that these deps tarballs were signed[3], so there was a > simple way to verify their authenticity. The get-deps.sh script was added > as a replacement then to help download the dependencies[4], but without any > verification of the downloaded source code. > I think I now understand why get-deps.sh was added, but I still don't fully understand whether it's actively used or needed. SVN stopped shipping the deps tarballs in 1.7.x[5] and get-deps.sh was added so that consumers would still have an easy way to get the dependencies. I'm not sure whether that was meant as a temporary utility until deps tarballs consumers migrated away from them[4]. If so, then the script has outlived its usefulness by more than a decade. The script that generated the deps tarballs[6] was regularly updated with recommended versions (see an example in r878427[7]). And get-deps.sh started out the same way with recommended versions, but the last version updates for most of the dependencies happened years ago. So what the script downloads is whatever was current when someone last updated it. My focus is the INSTALL document. The mention of get-deps.sh in the document looks like a historical artifact and, frankly, it confused me a lot to start this email thread. Getting the dependencies is quite simple today, so I'd remove the get-deps.sh summary and its other mentions from INSTALL entirely, replacing it with the steps for installing the dependencies via a package manager and link to the official download pages of the dependencies. > [1]: https://svn.apache.org/viewvc/?revision=1937573&view=revision > [2]: https://svn.apache.org/viewvc/?revision=1937576&view=revision > [3]: > https://web.archive.org/web/20120319033429/http://subversion.tigris.org/servlets/ProjectDocumentList?folderID=260&expandFolder=74 > [4]: https://svn.apache.org/viewvc/?view=revision&revision=945330 > [5]: https://subversion.apache.org/docs/release-notes/1.7.html#deps [6]: https://svn.apache.org/viewvc/subversion/trunk/tools/dist/construct-rolling-environment.sh?revision=878542&pathrev=878542&view=markup [7]: https://svn.apache.org/viewvc/?revision=878427&view=revision > -- > With best regards, > Pavel Lyalyakin > -- With best regards, Pavel Lyalyakin
