7 ms·
They have broken almost every open source project that builds external deps. Also broke homebrew apparently.
by swarfield 4y ago
They have broken almost every open source project that builds external deps. Also broke homebrew apparently.
- groestl 4y ago> every open source project that builds external deps and relies on checksumming ephemeral artefacts for integrity.
- pxc 4y agoSuch tools should definitely checksum package sources lol
- catiopatio 4y agoSource archives have never, in the entire history of open source, been considered ephemeral. GitHub unilaterally made that decision for their own convenience, and violated a decades-long universal community norm in the process.
- mardifoufs 4y agoI think this change only affects automatically (and dynamically) generated source archives, not those that are actually pushed to Github Releases beforehand.
- Denvercoder9 4y agoYou could also say that some maintainers made that decision for their convenience of not having to build and upload source archives. It is possible to upload your own artifacts to a release on GitHub, and lots of projects do. Those are correctly treated as immutable by GitHub.
- bentley 4y agoGitHub had no releases feature for many years. Most maintainers aren’t aware of the option, and of those who are, I doubt many are even aware that GitHub’s autogenerated tarballs are not stable or that they don’t include submodules.
- ecnahc515 4y agoI imagine GitHub would be equally upset if every project every started uploading their source tarballs themselves, as presumably the point of their source tarball feature was not needing to store the source tarball for every repository ever, but generating it on demand.
- JonChesterfield 4y agoBit of a shame they've just provided every project with huge incentive to upload their own source tarballs then. Coming soon, complaints that users upload too many opaque binaries.
- kzrdude 4y agoAll these projects relying on github, they are using a free service they don't control. It could go away someday. That will be a bigger crisis than this was..
- capableweb 4y agoGood test that the tooling actually works when the checksums are incorrect :) If your "build from source" tool/workflow DIDN'T break, I'd be worried.