I remember a similar breakage happening before due to internal git changes, and thought it was common knowledge to upload your own signed tarballs for releases.
Git archive checksums may change
11–20 of 255 posts
Re: Git archive checksums may change
#12Im thinking of all the bazel build rules that are about to break from my last company. Someone will have a fun day updating hundreds of hashes.
Re: Git archive checksums may change
#13GitHub will need to revert this change. They've just crippled pretty much every "from source" package manager out there.
Per the post, this was a change to git itself: https://github.com/git/git/commit/4f4be00d302bc52d0d9d5a3d47...
Re: Git archive checksums may change
#14Lol... I was being burned by this just about an hour ago. Cloned a repo, did a build of the project (which uses bezel to fetch dependencies) and it reported errors due to mismatch in expected checksums.
Re: Git archive checksums may change
#15GitHub will need to revert this change. They've just crippled pretty much every "from source" package manager out there.
If those tools incorrectly assume an API contract which doesn't exist, isn't the right answer to fix those tools?
Re: Git archive checksums may change
#16Earlier quoted context omitted.
I prefer that tool be adapted to be more resilient and not depend on github particular implementation.
Using SHA hashes when building guarantees that the code that you are building is what you think it is. How else would you verify dependencies like this, GPG signatures would have the same issue if you change the underlying bits.
a git checkout of the code at that particular tag hasn't changed. Just the tarball that git archive generates has.
Re: Git archive checksums may change
#17Hyrum's Law strikes again. It kind of doesn't matter what you document. If you weren't randomizing your checksum previously [1], you can't just spring this on the community and blame it for the fallout. I'm more shocked that there's resistance from the GitHub team saying "but we documented this isn't stable". Default stance for the team should be rollback & reevaluate an alternate path forward when the scope is this wide (e.g. only generating the new tarballs for future commits going forward).
[1] Apparently googlesource did do this and just had people shift to using GitHub mirrors to avoid this problem.
Re: Git archive checksums may change
#18Im thinking of all the bazel build rules that are about to break from my last company. Someone will have a fun day updating hundreds of hashes.
If they're using multiple URLs like a good Bazel user then they shouldn't be impacted.
Re: Git archive checksums may change
#19[deleted]
Re: Git archive checksums may change
#20Hey folks. I'm the product manager for Git at GitHub. We're sorry for the breakage, we're reverting the change, and we'll communicate better about such changes in the future (including timelines).
Also posted here: https://github.com/bazel-contrib/SIG-rules-authors/issues/11...