Re: Validating tarballs against git repositories
Hi Thomas (2024.04.02_22:33:47_+0000)
> Anyways, on the 400+ packages that I maintain within the OpenStack team, I
> did come across some upstream using setuptools-scm. To my experience, using
> the:
>
> git archive --prefix=$(DEBPKGNAME)-$(VERSION)/ $(GIT_TAG) \
> | xz >../$(DEBPKGNAME)_$(VERSION).orig.tar.xz
>
> workflow out of an upstream always work, including for those that are using
> setuptools-scm.
Then you haven't come across any that are using this mechanism to
install data, yet. You're only seeing the version determination.
You will, at some point run into this problem. It's getting more
popular.
Stefano
--
Stefano Rivera
http://tumbleweed.org.za/
+1 415 683 3272
Reply to: