Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://todon.nl/users/janneke/statuses/116710771902354124">Janneke (janneke@todon.nl)'s status on Monday, 08-Jun-2026 05:44:17 JST</a><a href="https://todon.nl/@janneke" title="janneke@todon.nl"><img src="https://gnusocial.jp/avatar/114964-48-20260205141245.webp" width="48" height="48" alt="Janneke" style="position: absolute; left: 0; top: 0;">Janneke</a><div><a href="https://todon.nl/@janneke/116710226650795438" rel="in-reply-to">in reply to</a><ul><li></ul></div></section><article><p><a href="https://fosstodon.org/@tdose">@tdose</a> <br>For quite a while I took pride in making source tarballs reproducible.  First, I did it for Dezyne (<a href="https://cgit.git.savannah.nongnu.org/cgit/dezyne.git/commit/?id=7db1b91b65499464ed9829d17b808453f5f6e5e4" rel="nofollow">https://cgit.git.savannah.nongnu.org/cgit/dezyne.git/commit/?id=7db1b91b65499464ed9829d17b808453f5f6e5e4</a>) then (a bit harder) for GNU Guix (<a href="https://issues.guix.gnu.org/70169/" rel="nofollow">https://issues.guix.gnu.org/70169/</a>).</p><p>In Guix, it has always been a puzzle: Do we prefer tarballs, or do we prefer Git?  Well, thanks to the xz-utils fiasco, that problem has been solved: <a href="https://codeberg.org/guix/guix/milestone/66679" rel="nofollow">https://codeberg.org/guix/guix/milestone/66679</a>.</p><p>We now know what to do, we only have to do it.</p><p>On the tarball front, I believe it would be good to remove pre-built artifacts, and only include true sources from Git.</p><p>Thoughts?</p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/6459020#notice-12715442">In conversation</a><time datetime="2026-06-08T05:44:17+09:00" title="Monday, 08-Jun-2026 05:44:17 JST">about a month ago</time> <span>from <span><a href="https://todon.nl/@janneke/116710771902354124" rel="external" title="Sent from todon.nl via ActivityPub">todon.nl</a></span></span><a href="https://todon.nl/@janneke/116710771902354124">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: cgit.git.savannah.nongnu.org</div><h5><a href="https://cgit.git.savannah.nongnu.org/cgit/dezyne.git/commit/?id=7db1b91b65499464ed9829d17b808453f5f6e5e4">build: Reproducible tarball. - dezyne.git -</a></h5><div></div></header><div></div><footer></footer></article></li><li><label><a rel="external" href="https://gnusocial.jp/attachment/6152744">Untitled attachment</a></label><br><div>Invalid filename.</div></li><li><label><a rel="external" href="https://gnusocial.jp/attachment/6152745">Untitled attachment</a></label><br><div>Invalid filename.</div></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Janneke (janneke@todon.nl)'s status on Monday, 08-Jun-2026 05:44:17 JSTJanneke
in reply to
- T-DOSE
@tdose
For quite a while I took pride in making source tarballs reproducible. First, I did it for Dezyne (https://cgit.git.savannah.nongnu.org/cgit/dezyne.git/commit/?id=7db1b91b65499464ed9829d17b808453f5f6e5e4) then (a bit harder) for GNU Guix (https://issues.guix.gnu.org/70169/).
In Guix, it has always been a puzzle: Do we prefer tarballs, or do we prefer Git? Well, thanks to the xz-utils fiasco, that problem has been solved: https://codeberg.org/guix/guix/milestone/66679.
We now know what to do, we only have to do it.
On the tarball front, I believe it would be good to remove pre-built artifacts, and only include true sources from Git.
Thoughts?
In conversationabout a month ago from todon.nlpermalink
Attachments
1. Domain not in remote thumbnail source whitelist: cgit.git.savannah.nongnu.org
  build: Reproducible tarball. - dezyne.git -
2. Untitled attachment
  Invalid filename.
3. Untitled attachment
  Invalid filename.

Public

Embed Notice

HTML Code

Corresponding Notice