Experimental Physics and
Industrial Control System

NICOLE Remi via Tech-talk <tech-talk at aps.anl.gov> · Fri, 25 Nov 2022 08:33:16 +0000

Hello! Rémi here,

> Of course I never download the tarball from git, so I did not notice.
> The content of the .VERSION file is generated on the git server at
> each download (by .gitattributes).

Thanks for the pointer, it makes sense now.

I think I recall that several build systems download GitHub archive as
a faster way of downloading a specific version of a GitHub repository
(same with GitLab).

The issue I'm having is that the %D substitution may change depending
on what happens at a later date in the repository. Our build system
enforces reproducible builds, so I have to check the hash to make sure
nothing in the build chain changed. It also makes sure that the
repository or the internet connection wasn't compromised.

Would you accept removing the REFS line? I would have liked to propose
something like %(describe:abbrev=12,tags) but I think even then it's
not guaranteed to be reproducible, as you can always add tags in
earlier commits.

If you'd prefer not removing it, I think we can work around it by
cloning the repo at a specific revision instead of fetching the zip
archive. But I think it might bite other people in the future.

Thanks a lot!
-- 
Rémi NICOLE <remi.nicole at cea.fr>
CEA/DRF/IRFU/DIS/LDISC

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System