[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Validating tarballs against git repositories



On Apr 05, Simon McVittie <smcv@debian.org> wrote:

> I find that having the upstream source code in git (in the same form that
> we use for the .orig.tar.*, so including Autotools noise, etc. if present,
> but excluding any files that we exclude by repacking) is an extremely
> useful tool, because it lets me trace the history of all of the files
> that we are treating as source - whether hand-written or autogenerated -
> if I want to do that. If we are concerned about defending against actively
I agree: it would be untinkable for me to not have the complete history 
immediately available while I am working on a package.

-- 
ciao,
Marco

Attachment: signature.asc
Description: PGP signature


Reply to: