[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#21784: Old XZ tarballs

From: Ludovic Courtès
Subject: bug#21784: Old XZ tarballs
Date: Sun, 01 Nov 2015 11:20:07 +0100
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)

Lasse Collin <address@hidden> skribis:

> On 2015-10-30 Ludovic Courtès wrote:


>> Guix does automatically mirror tarballs via its “substitute”
>> mechanism. However, users can turn it off, in which case they end up
>> downloading the tarball from the upstream URL specified in the
>> package recipe.
> OK. :-) Why would users turn it off though?

The substitute mechanism is very generic; it’s not just about mirroring


Some people might prefer to build things locally rather than download
pre-built items.

> I would guess that one good mirror would be more reliable than dozens
> of upstream sites of which just one needs to be down to be a problem
> for a user. A package manager should know the hash or signature of the
> file, so from security point of view it doesn't matter where the file
> comes.

Yes exactly, all we need is to mirror it somewhere.

>> > By the way, is there a reason why you use 5.0.4 instead of 5.0.8 (or
>> > even 5.2.2)?
>> No good reason!  We’ll upgrade it as soon as this can be done without
>> triggering too much rebuild/redownloads for users.
> API/ABI is backward compatible so one shouldn't need to rebuild other
> packages. There's a mailing list "xz-announce" in case you want a
> notification when a new version is released:
> <http://tukaani.org/xz/lists.html>

Noted, thanks!


reply via email to

[Prev in Thread] Current Thread [Next in Thread]