On Sun, Jun 27, 2010 at 1:29 AM, Ciaran McCreesh <[email protected]> wrote: > On Sat, 26 Jun 2010 21:46:39 +0200 > Enrico Weigelt <[email protected]> wrote: >> BTW: if upstream has an proper VCS and an canonical tagging >> scheme, they don't actually have to create release tarballs, >> just hack up a little script which creates them on-the-fly >> from an canonical URL scheme (eg. oss-qm does exactly that). > > Down that path lies madness. There's no guarantee that you'll get the > same tarball if you request the same URL twice in a row, particularly > if you're using one of those new-fangled new compression schemes. >
Or if they generate the tarball on-the-fly with no caching, which results in differing timestamps each time. Hence, each time you fetch it, you get a tarball with a different hash. No, don't ask where I saw such a thing :p -- ~Nirbheek Chauhan Gentoo GNOME+Mozilla Team
