incubator-general mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Niclas Hedhman <nic...@hedhman.org>
Subject Re: Votes for git repos - commit id vs tag
Date Sat, 20 Dec 2014 06:16:36 GMT
Tags are at best a convenience, and nothing else. But so are commit id,
since in the long-term, GIT may not prevail and the commit id is in effect
an internal artifact of Git itself, not the concept of version control
systems. Compare how commit numbers from Subversion are imported to Git
repositories, or not... But tags are imported, if the ttb structure in
subversion is used.

Releases are the tarball(s) prepared by the release manager, not a pointer
into the source control system. It is the tarball that is released to the
public, not the commit id, and it is the tarball that must be vetted by the
community, not their local copy of the particular commit ID.

So, to make this clear to the community, I would discourage to publish the
commit ID in the vote request, and only provide the URL link to the
tarball(s). It would be totally possible for the release manager (and build
system) to include the commit id into the tarball as additional
information, for instance a footer in README.

Cheers
Niclas

On Sat, Dec 20, 2014 at 6:15 AM, David Nalley <david@gnsa.us> wrote:
>
> >
> > I recently found this confusing with the first parquet-format release. I
> > thought that both commit id and tag were optional, given that the actual
> > release candidate is a signed tarball (actually, the "necessary source
> code
> > to build the project" [1]).
> >
>
> Commit id is not optional. Tag is.
> The release candidate is a signed tarball, but I should be able to
> take your source tree from the commit id, and get the exact same
> tarball by following your release process. (Note that this applies
> only to source tarballs - but those are the ones that matter). If I
> can't arrive at the same exact tarball there's something amiss with
> the release or the process.
>
> > We can't necessarily recover the commit id from the tarball because the
> > parent information is lost [2], so requiring the commit id is only useful
> > for convenience and validating that a new tarball from git at the commit
> id
> > matches the vote tarball. Is this validation done? Is it a requirement?
> >
> > If it isn't a requirement for a commit to match what is being voted on,
> then
> > does it matter whether we use a tag for convenience or a commit id?
> >
> > We could also accept signed tags, though I don't know if there are issues
> > that would prevent it.
> >
> > rb
> >
> >
> > [1]: https://www.apache.org/dev/release-publishing.html#valid
> > [2]: Unless using `git archive`: http://git-scm.com/docs/git-archive
> >
> > --
> > Ryan Blue
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > For additional commands, e-mail: general-help@incubator.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>

-- 
Niclas Hedhman, Software Developer
http://www.qi4j.org - New Energy for Java

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message