#10 dotnet-clean uses branches, not tags to build
Closed None Opened 7 years ago by omajid.

Using branches makes the build less reproducible. If someone builds it in Dec 2016, they get .NET Core 1.1.0. If someone builds it in Dec 2017, they may get .NET Core 1.1.9 or another version.

Fedora packaging docs have some tips on how to make builds from github projects more reproducible: https://fedoraproject.org/wiki/Packaging:SourceURL?rd=Packaging/SourceURL#Git_Hosting_Services


Metadata Update from @omajid:
- Issue assigned to omajid

Can we use source tarballs, and skip git alltogether? I will look into it.

Metadata Update from @rhea:
- Issue tagged with: package

source-tarballs are pretty much the only option longer term. Fedora's official builds are done offline so git won't work to begin with.

I has assumed that you chose to use git because of download/upload constraints.

I was planning to look into this, but if you want to do this, please assign this to yourself and I won't duplicate the work.

Metadata Update from @nmilosev:
- Issue assigned to nmilosev (was: omajid)

Already done, pushed changes, and a new build is on copr. Offline built too :)

https://pagure.io/fedora-dotnet/blob/f25/f/dotnetcore.spec

F26 still broken though, even with the patch you sent me.

Also cleaned up the spec a lot, please take a look.

Looks great! Thanks for doing this!

Thank you! Spec file looks really clean after your modifications. Just need to fix build for F26 now. :)

Closing this one!

Metadata Update from @nmilosev:
- Issue status updated to: Closed (was: Open)

Hey, sorry, I missed this bit at first, but the guidelines suggest to always use a tag/commit id, not the branch name, which is what %{version} as used in the spec file ends up being. Unless we use git tags or (better) commit version, the source ends up being non-reproducible if any bugfixes are pushed to a release-branch.

Makes sense, I will just note the commit ID's and use that.

Trying to fix F26 first, adding this to todo list. :)

Metadata Update from @nmilosev:
- Issue status updated to: Open (was: Closed)

Added commit id's to the spec file, and made the appropriate modifications.

Please see: https://pagure.io/fedora-dotnet/blob/f25/f/dotnetcore.spec#_47

Build in progress on COPR.

Closing! :)

Metadata Update from @rhea:
- Issue assigned to nmilosev
- Issue tagged with: package

5 years ago

Login to comment on this ticket.

Metadata