Re: [Xen-devel] Different xen-3.4.3.tar.gz in Fedora RPM

[M A Young <m.a.young@xxxxxxxxxxxx>]

On Fri, 18 Jun 2010, Keir Fraser wrote:

> On 18/06/2010 13:10, "Joanna Rutkowska" <joanna@xxxxxxxxxxxxxxxxxxxxxx>
> wrote:
>
> > So, I downloaded xen-3.4.3.tar.gz from fedora mirror (using their
> > original Makefile for RPM building), and diffed the two versions --
> > changes (cosmetic cleanup mostly) are innocent, but, hey, why would
> > anybody do such a thing? After allm we would expect only one version of
> > xen-XXX.tar.gz, right? Patches should be the proper way for customizing
> > tarballs for packaging, no?
> >
> > Or am I missing something?
> Well, I think this and your other point have one simple answer. If I wanted
> the maximum possible confidence in the bits I was building, I would obtain
> them from the original source, as it were. In this case that means, for
> example:
> # hg clone -r RELEASE-3.4.3 http://xenbits.xensource.com/xen-3.4-testing.hg
> If you want your own tarball for some reason:
> # hg archive -t tgz xen-3.4.3.tar.gz
>
> It doesn't seem very hard to me. I maintain the repo and sign the releases
> myself. Downloading tarballs from Fedora, or even from our own xen.org
> website, introduces more people between you and me. And it seems you very
> likely care about that.
Though bear in mind that producing xen-3.4.3.tar.gz in this way means you 
will download the qemu parts from 
http://xenbits.xensource.com/git-http/qemu-xen-3.4-testing.git at build 
time, which might not be what you want.
        Michael Young

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel