civodul pushed a commit to branch master
in repository guix-artwork.
commit 48767bc59a8c6155dd68287d3f1baca47aed4ba1
Author: Ludovic Courtès <[email protected]>
AuthorDate: Sun Dec 29 22:23:53 2024 +0100
website: bootstrapping-mono: Typographical tweaks.
* website/posts/bootstrapping-mono.md: Adjust tag list.
Use em dashes instead hyphens where relevant; fix spelling of “GitHub”.
---
website/posts/bootstrapping-mono.md | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/website/posts/bootstrapping-mono.md
b/website/posts/bootstrapping-mono.md
index a5deff4..6a55c9b 100644
--- a/website/posts/bootstrapping-mono.md
+++ b/website/posts/bootstrapping-mono.md
@@ -1,7 +1,7 @@
title: Adding a fully-bootstrapped Mono
date: 2024-12-28 04:17
author: unmush
-tags: Bootstrapping, Reproducible builds, C#, .NET, Security
+tags: Bootstrapping, Reproducible builds, Security
---
We used to have a Mono package. It was introduced on August 8 2016 by commit
@@ -29,8 +29,8 @@ I started down this road because someone I'm working on a
project with decided
to depend on a C# package that requires C# 12.0 features, and my personal Mono
package based on the tarball releases (which include bootstrap binaries) only
went up to C# 7.0. This meant that the C# package in question de facto
required
-strictly Microsoft's (er, I mean, "the .NET foundation"'s) .NET implementation
-
-hereafter referred to as "dotnet" - and a very recent version no less. The
+strictly Microsoft's (er, I mean, "the .NET foundation"'s) .NET implementation
—
+hereafter referred to as "dotnet" — and a very recent version no less. The
bootstrapping story with dotnet is [very
bad](https://github.com/dotnet/source-build/issues/1930); even beginning to
untangle it would probably require a relatively modern C# compiler, and
@@ -114,7 +114,7 @@ the `git://` protocol.
This is notable for a few reasons.
-First, github dropped support for the `git://` protocol in 2021, so
+First, GitHub dropped support for the `git://` protocol in 2021, so
recursive clones won't work now. This means I have to explicitly list
out every submodule, its commit, and its sha256 hash, for every Mono
version until they switched to using http or https. mono-2.11.4 has
@@ -122,7 +122,7 @@ only 4 submodules, but that doesn't last for long: by
mono-4.9.0 it has
14 submodules. A significant portion of these patches is just listing
these submodules and their hashes. It's a bit annoying.
-The more concerning reason, though, is *why* github dropped support for the
+The more concerning reason, though, is *why* GitHub dropped support for the
`git://` protocol: it is unencrypted and unauthenticated. This is mitigated
somewhat by the use of sha-1 hashes to identify commits in the referenced
submodules, putting a significant computational burden on anyone who would try
@@ -146,7 +146,7 @@ arbitrary entities to make whatever commits they want
accessible under any
arbitrary repository URL, rather mitigate this security issue.
This usage of `git://` URLs lasted all the way until September 28, 2021, when
-github's removal of support for it forced the developers to change them to
+GitHub's removal of support for it forced the developers to change them to
https.
# Meanwhile, in reality
@@ -162,15 +162,15 @@ absolute pain in the neck to build from source, because
they consistently depend
on new C# features *before* they implement them.
To go on a brief tangent: does anyone remember back when youtube-dl was
-temporarily taken down from github due to the RIAA's DMCA request? Many were
+temporarily taken down from GitHub due to the RIAA's DMCA request? Many were
unhappy about that. One such unhappy person made news when they [made the full
contents of youtube-dl's repository available to access through the DMCA
request
repository](https://gist.github.com/lrvick/02088ee5466ca51116bdaf1e709ddd7c).
-It turns out that there are many actions that one can take on github that will
+It turns out that there are many actions that one can take on GitHub that will
make arbitrary commits available under arbitrary repository URLs.
So, in reality, for the span of time from November 28, 2016 to
-September 28, 2021, anybody sitting on the network path between github
+September 28, 2021, anybody sitting on the network path between GitHub
and any Mono developer updating the roslyn-binaries submodule could
decide on any arbitrary new commit to be used. Of course, merely
inspecting the diff for the commit will reveal nothing of use, because
