[csw-users] How can I get blastwave's package sources?

[Trygve Laugstøl]

Yann Rouillard wrote:
>> Specifically I want to be able to build any package from Blastwave when 
>> I want to, assuming I'm online. The main motivation for me is not 
>> paranoia (I do trust binaries built by you) but learning how to build 
>> Solaris and Blastwave packages.
>>
>> I don't quite see the relevance of the cost of hosting the sources, the 
>> cost of hosting the binaries will be (is!) *way* bigger.
>>
>>>> I would like to have an
>>>> assurance of that when I build a package I build from the *exact* same
>>>> sources as the one in the archive was built.
>>> Why?
>> Because if I have a patch to a package I want to decrease the risk of 
>> breaking anything by upgrading to the latest upstream sources.
>>
> 
> It is also useful if you need a binary with a different compile-time 
> option than the original blastwave package.
> 
>>>> I bet that today it is
>>>> practically impossible to rebuild any Blastwave release older than a
>>>> year or even a half year.
>>> I take on your bet, but you have already lost.  The practical problem
>>> is reconstructing the environment to build an old package but I have
>>> already done it when we needed a back compatible package.  Normally
>>> there is no reason to do it.
>> I thought (or assumed rather) that the build machine was a plain Solaris 
>> 8 installation with GCC and/or Sun Studio which should be fairly easy to 
>> set up locally.
>>
> 
> I think it would be easy with some coordination to create a branch for 
> each blastwave release, but as James told you the problem is that, to be 
> able to rebuild a package reliably, you need the same headers, so you 
> would need every dependancies of this package to be in the svn gar 
> system and that's not guaranted right now.

True, but for people who are paranoid they will rebuild all of blastwave 
on a machine that they control and know how work. But anyway, this is 
not my case here, I just want to be able to rebuild the packages.

> Each maintainer is free to build its package the way he wants, the svn 
> gar system is just one way.

That is kinda annoying, I would think that having a single, 
authoritative builder which build from SVN and using the (signed) source 
tarballs from blastwave.org would be useful as it should ensure that the 
binaries are re-producible. Each time a package is released it should be 
tagged so I can go back in time and re-produce a binary with my patch.

--
Trygve