Re: GNULIB_REVISION

[Bruno Haible]

Hi Simon,

> you can ... via
> GNULIB_REVISION pick out exactly the gnulib git revision that libpaper
> needs. ...
> [1] 
> https://blog.josefsson.org/2024/04/13/reproducible-and-minimal-source-only-tarballs/
> [2] https://salsa.debian.org/auth-team/libntlm/-/tree/master/debian

I see GNULIB_REVISION as an obsolete alternative to git submodules, and
would therefore discourage rather than propagate its use.

Currently libntlm has this in its bootstrap.conf:

  GNULIB_REVISION=dfb71172a46ef41f8cf8ab7ca529c1dd3097a41d

and GNU make has this:

  GNULIB_REVISION=stable-202307

Both can be done with git submodules. Git submodules do support branches [1],
and the command 'git submodule update --remote gnulib' updates the
submodule while staying on the indicated branch.

When using submodules, the target revision is stored in a versionable way,
that both gitweb and cgit can show appropriately [2][3]. If a branch is
used, it is stored in the .gitmodules file.

The differences between both approaches are:

  - GNULIB_REVISION works only with the 'bootstrap' program. The submodules
    approach works also without 'bootstrap'.

  - For GNULIB_REVISION, the user is on their own regarding tooling, aside
    from 'bootstrap'. In the submodules approach, the 'git' suite provides
    the tooling, and many developers are familiar with it.

  - .tar.gz files created by the gitweb "snapshot" link, by the cgit "refs >
    Download" section, or the GitHub "Download ZIP" button contain an empty
    directory in place of the submodule, and no information about the revision.
    Whereas they contain the file with the GNULIB_REVISION assignment.

> I should write a post to debian-devel describing this pattern on
> how to use gnulib in Debian packages

It feels wrong to me if, in order to get meta-information about required
dependencies of a package, Debian tools grep a particular file for a specific
string. This approach is simply too limited.

The correct way, IMO, would be that 'git' provides this meta-information,
either embedded in the .tar.gz generated by the web tooling, or in a
separate .tar.gz. AFAICT, 'git' currently does not have this ability.
Therefore we need to approach the 'git' team, in order to find a solution
that scales across the whole set of software package — not specific to
gnulib and not specific to 'bootstrap'.

Bruno

[1] 
https://stackoverflow.com/questions/1777854/how-can-i-specify-a-branch-tag-when-adding-a-git-submodule
[2] https://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=tree
[3] https://git.savannah.gnu.org/cgit/coreutils.git/tree/