Re: Upstream tarball hashes: debian/upstream/*SUMS

2024-11-28 Thread Simon Josefsson
Alec Leamas writes: > Hi, > > On 28/11/2024 09:01, Simon Josefsson wrote: >> The checksums will be different when Debian >> re-pack upstream's source tarball, but there is still value in recording >> the upstream tarball used as a basis for creating the Debian source >> tarball > > Personally, th

Re: Upstream tarball hashes: debian/upstream/*SUMS

2024-11-28 Thread sre4ever
Hi, Le 2024-11-28 11:28, Alec Leamas a écrit : Personally, the few packages I maintain are mostly repacked. Isn't there also value in storing the hash of the repacked tarball, the thing actually used? Not much value, as both the hash and the data would be stored at the same place (git repo

Re: Upstream tarball hashes: debian/upstream/*SUMS

2024-11-28 Thread Jonas Smedegaard
Quoting Alec Leamas (2024-11-28 11:28:02) > Hi, > > On 28/11/2024 09:01, Simon Josefsson wrote: > > The checksums will be different when Debian > > re-pack upstream's source tarball, but there is still value in recording > > the upstream tarball used as a basis for creating the Debian source > > t

Re: Upstream tarball hashes: debian/upstream/*SUMS

2024-11-28 Thread Alec Leamas
Hi, On 28/11/2024 09:01, Simon Josefsson wrote: The checksums will be different when Debian re-pack upstream's source tarball, but there is still value in recording the upstream tarball used as a basis for creating the Debian source tarball Personally, the few packages I maintain are mostly re

Re: Upstream tarball hashes: debian/upstream/*SUMS

2024-11-28 Thread Alec Leamas
Hi, On 28/11/2024 09:01, Simon Josefsson wrote: The checksums will be different when Debian re-pack upstream's source tarball, but there is still value in recording the upstream tarball used as a basis for creating the Debian source tarball Personally, the few packages I maintain are mostly re

Upstream tarball hashes: debian/upstream/*SUMS

2024-11-28 Thread Simon Josefsson
All, There is discussion in the 'Simpler git workflow for packaging with upstreamless repositories' thread about the merrits of pristine-tar. One important value people appear to see is to be able to assert that orig.tar.gz's integrity can be chained back into some data in the git repository. I