FS#15984 - Regression: makepkg --source still fetches build files from the web
Attached to Project:
Pacman
Opened by Devin Cofer (Ranguvar) - Wednesday, 19 August 2009, 03:29 GMT
Last edited by Allan McRae (Allan) - Saturday, 22 May 2010, 12:49 GMT
Opened by Devin Cofer (Ranguvar) - Wednesday, 19 August 2009, 03:29 GMT
Last edited by Allan McRae (Allan) - Saturday, 22 May 2010, 12:49 GMT
|
Details
Summary and Info:
From 'man makepkg': --source Do not actually build the package, but build a source-only tarball that does not include sources that can be fetched via a download URL. This is useful for passing a single tarball to another program such as a chroot, remote builder, or a tarball upload. So, makepkg --source should not pull in build files from the web. However, since pacman-3.3.0 I believe, it does. I don't believe makepkg --source places those files in the source archive it creates, but it's still annoying when it downloads the source files for a package before it will let you use --source to make an AUR package. Steps to Reproduce: Pick any AUR package that has a web file in its source=(), download the PKGBUILD and such from the AUR, and makepkg --source. |
This task depends upon
Closed by Allan McRae (Allan)
Saturday, 22 May 2010, 12:49 GMT
Reason for closing: Fixed
Additional comments about closing: git commit http://projects.archlinux.org/pacman.git /commit/?id=c1fc0050
Saturday, 22 May 2010, 12:49 GMT
Reason for closing: Fixed
Additional comments about closing: git commit http://projects.archlinux.org/pacman.git /commit/?id=c1fc0050
"It wouldn't be very nice to ship a PKGBUILD with the wrong checksums."
Or would it?
1.) This should be documented in the man page. Right now it says that external build files will NOT be fetched.
2.) An override switch should exist. I sometimes use mirrors with limited bandwidth, and I already _know_ the sums will check out, or I may be using a metered connection, etc.
I am undecided. I use "makepkg --source" only after actually building the package. In that case, the source and md5sums need to have been present anyway. But if it was a minor version update and md5sums were given on a projects homepage and I had limited or costly bandwidth, I might be tempted to skip the building...
No matter how simple the update is, there is always something that can go wrong. Too many times, I saw very simple changes, untested, which were actually wrong. This is also the reason why I was against an on-line AUR editor.
That said, I don't care so much. We can keep it as is, or revert the above commit, or add an override, it would not change anything to me.
Ranguvar : what would that override be ?
FS#15830) here too?Can we at the very least get a documentation update for 3.3.1? And I'm not convinced we should ever allow skipping, but I do see the valid reasons. I just don't want that to become the norm...
Do not actually build the package, but build a source-only tarball that
does not include sources that can be fetched via a download URL. This is
useful for passing a single tarball to another program such as a chroot,
remote builder, or a tarball upload. Because integrity checks are verified,
all source files of the package need to be present or downloadable.
And Dan said : "I'm not convinced we should ever allow skipping, but I do see the valid reasons"
So it's not sure at all it will be done.
But in any cases, the doc had to be updated.
So is there a decision of whether we can use --skipinteg here too. I'm +/- 1. Maybe more +1 than -1 as we already have the option there and it makes sense to use it again.
The question is rather : do we implement this or not ?
See what Dan said : "And I'm not convinced we should ever allow skipping, but I do see the valid reasons. I just don't want that to become the norm..."
But if no one provides a patch, I guess there is no question :)