Skip to content
This repository has been archived by the owner on May 4, 2021. It is now read-only.

Ticket29294 #332

Open
wants to merge 10 commits into
base: master
Choose a base branch
from
Open

Ticket29294 #332

wants to merge 10 commits into from

Conversation

juga0
Copy link
Contributor

@juga0 juga0 commented Feb 6, 2019

No description provided.

Leave CHANGELOG.md until there's an actual new release, in case
the unreleased changes are lost.
Once CHANGELOG.md is removed, update the symlinks.
Copy link
Contributor

@teor2345 teor2345 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Most of these changes look ok: I didn't check them in detail.

I have questions about scripts/maint/release.py .

scripts/maint/release.py Outdated Show resolved Hide resolved
CONTRIBUTING.rst Show resolved Hide resolved
scripts/maint/release.py Outdated Show resolved Hide resolved
scripts/maint/release.py Outdated Show resolved Hide resolved
print("Obtaining Github tarball...")
# This will overwrite local tarball, but that's fine since the hash file
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overwriting the local tarball is only fine if the user reads the output of the script, and notices when the GitHub tarball is different. Please put the tarballs in separate files.

)

print("Verifying Github tarball and local one are the same...")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand why we do a sha256 check, rather than a file diff check.
In fact, I'm not sure why we do this check at all?
Please add a comment explaining why it is important that GitHub matches our local tarball.

Are tarballs reproducible?
What happens if the tarballs are different?
Can they be different on different OSes?
Does GitHub guarantee that their tarballs are created with particular git and tar versions on a particular OS?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants