Re: [PATCH 4/6] docs: downloads: Change sources link for libvirt-ocaml

[Peter Krempa]

On Tue, Mar 14, 2023 at 08:43:48 -0400, Andrea Bolognani wrote:
> On Tue, Mar 14, 2023 at 12:11:07PM +0100, Peter Krempa wrote:
> > On Tue, Mar 14, 2023 at 06:36:38 -0400, Andrea Bolognani wrote:
> > > Well version 0.6.1.5, which is the latest one available on
> > > libvirt.org, is PGP signed by Rich himself, so at some point in the
> > > past we clearly got this to work :)
> >
> > The makefile even has specific code that does this upload as one of the
> > targets.
> >
> > > Could he have lost his access or something?
> >
> > Given the comment I linked to I thought the release process has
> > somehow changed and the makefile wasn't updated.
> >
> > I didn't want to investigate much more than to try to decouple the
> > webpages so that in the end we can host also the libvirt's page from
> > gitlab pages.
> 
> Yeah, I think we need to figure out and agree on a way forward for
> libvirt-ocaml releases, but while we wait for that to happen you can
> already push all the ACKed patches and effectively complete the
> transition to the separate download server, thus allowing you to move
> forward with transfering libvirt.org to GitLab Pages.

I've posted v2 where I've simply dropped this patch.

I need to patch libvirt-ocaml's page now because I've added similar
wording there when I was adding it and that one was already merged.

Re: [PATCH 4/6] docs: downloads: Change sources link for libvirt-ocaml

[Andrea Bolognani]

On Tue, Mar 14, 2023 at 12:11:07PM +0100, Peter Krempa wrote:
> On Tue, Mar 14, 2023 at 06:36:38 -0400, Andrea Bolognani wrote:
> > Well version 0.6.1.5, which is the latest one available on
> > libvirt.org, is PGP signed by Rich himself, so at some point in the
> > past we clearly got this to work :)
>
> The makefile even has specific code that does this upload as one of the
> targets.
>
> > Could he have lost his access or something?
>
> Given the comment I linked to I thought the release process has
> somehow changed and the makefile wasn't updated.
>
> I didn't want to investigate much more than to try to decouple the
> webpages so that in the end we can host also the libvirt's page from
> gitlab pages.

Yeah, I think we need to figure out and agree on a way forward for
libvirt-ocaml releases, but while we wait for that to happen you can
already push all the ACKed patches and effectively complete the
transition to the separate download server, thus allowing you to move
forward with transfering libvirt.org to GitLab Pages.

-- 
Andrea Bolognani / Red Hat / Virtualization

Re: [PATCH 4/6] docs: downloads: Change sources link for libvirt-ocaml

[Peter Krempa]

On Tue, Mar 14, 2023 at 06:36:38 -0400, Andrea Bolognani wrote:
> On Tue, Mar 14, 2023 at 11:29:06AM +0100, Peter Krempa wrote:
> > On Tue, Mar 14, 2023 at 10:14:33 +, Daniel P. Berrangé wrote:

[...]

> > > > The Fedora package still points to the libvirt.org server too[1], so
> > > > to me it appears that a few uploads were simply missed.
> > > >
> > > > Rich?
> >
> > In the following comment:
> >
> > https://gitlab.com/libvirt/libvirt-ocaml/-/issues/3#note_1292266414
> >
> > Rich specifically pointed users to the gitlab "release".
> 
> Well version 0.6.1.5, which is the latest one available on
> libvirt.org, is PGP signed by Rich himself, so at some point in the
> past we clearly got this to work :)

The makefile even has specific code that does this upload as one of the
targets.

> Could he have lost his access or something?

Given the comment I linked to I thought the release process has
somehow changed and the makefile wasn't updated.

I didn't want to investigate much more than to try to decouple the
webpages so that in the end we can host also the libvirt's page from
gitlab pages.

Re: [PATCH 4/6] docs: downloads: Change sources link for libvirt-ocaml

[Andrea Bolognani]

On Tue, Mar 14, 2023 at 11:29:06AM +0100, Peter Krempa wrote:
> On Tue, Mar 14, 2023 at 10:14:33 +, Daniel P. Berrangé wrote:
> > On Tue, Mar 14, 2023 at 06:12:33AM -0400, Andrea Bolognani wrote:
> > > On Tue, Mar 14, 2023 at 10:36:56AM +0100, Peter Krempa wrote:
> > > > The sources for new libvirt-ocaml releases are hosted via gitlab. Add
> > > > the link. Since old releases are not present there preserve also the old
> > > > link.
> > > ...
> > > >* - OCaml
> > > > -- `libvirt `__
> > > > +- `gitlab `__
> > > > +  `libvirt (old versions) `__
> > >
> > > Is the fact that no tarballs have been uploaded for the last few
> > > releases intentional, or an oversight?
> > >
> > > While I see tags for those releases in GitLab, in general git tags
> > > are not a replacement for proper release tarballs, which I'm not
> > > seeing anywhere on GitLab.
> >
> > Indeed, as was seen recently with github, the auto-generated tarballs
> > can change when the backend impl changes, which invalidate any hashes
> > vendors are using to validate tarballs. It is unwise to rely on the
> > auto-generated tarballs as the canonical release artifacts
> >
> > > The Fedora package still points to the libvirt.org server too[1], so
> > > to me it appears that a few uploads were simply missed.
> > >
> > > Rich?
>
> In the following comment:
>
> https://gitlab.com/libvirt/libvirt-ocaml/-/issues/3#note_1292266414
>
> Rich specifically pointed users to the gitlab "release".

Well version 0.6.1.5, which is the latest one available on
libvirt.org, is PGP signed by Rich himself, so at some point in the
past we clearly got this to work :)

Could he have lost his access or something?

-- 
Andrea Bolognani / Red Hat / Virtualization

Re: [PATCH 4/6] docs: downloads: Change sources link for libvirt-ocaml

[Andrea Bolognani]

On Tue, Mar 14, 2023 at 10:14:33AM +, Daniel P. Berrangé wrote:
> On Tue, Mar 14, 2023 at 06:12:33AM -0400, Andrea Bolognani wrote:
> > On Tue, Mar 14, 2023 at 10:36:56AM +0100, Peter Krempa wrote:
> > > The sources for new libvirt-ocaml releases are hosted via gitlab. Add
> > > the link. Since old releases are not present there preserve also the old
> > > link.
> > ...
> > >* - OCaml
> > > -- `libvirt `__
> > > +- `gitlab `__
> > > +  `libvirt (old versions) `__
> >
> > Is the fact that no tarballs have been uploaded for the last few
> > releases intentional, or an oversight?
> >
> > While I see tags for those releases in GitLab, in general git tags
> > are not a replacement for proper release tarballs, which I'm not
> > seeing anywhere on GitLab.
>
> Indeed, as was seen recently with github, the auto-generated tarballs
> can change when the backend impl changes, which invalidate any hashes
> vendors are using to validate tarballs. It is unwise to rely on the
> auto-generated tarballs as the canonical release artifacts

Not only that: you also miss all the stuff generated during the dist
step, so the forge-generated tarballs are going to be unusable or at
the very least require additional steps on the user's part.

Plus no PGP signatures, which libvirt-ocaml seems to have finally
started using recently.

-- 
Andrea Bolognani / Red Hat / Virtualization

Re: [PATCH 4/6] docs: downloads: Change sources link for libvirt-ocaml

[Peter Krempa]

On Tue, Mar 14, 2023 at 10:14:33 +, Daniel P. Berrangé wrote:
> On Tue, Mar 14, 2023 at 06:12:33AM -0400, Andrea Bolognani wrote:
> > On Tue, Mar 14, 2023 at 10:36:56AM +0100, Peter Krempa wrote:
> > > The sources for new libvirt-ocaml releases are hosted via gitlab. Add
> > > the link. Since old releases are not present there preserve also the old
> > > link.
> > ...
> > >* - OCaml
> > > -- `libvirt `__
> > > +- `gitlab `__
> > > +  `libvirt (old versions) `__
> > 
> > Is the fact that no tarballs have been uploaded for the last few
> > releases intentional, or an oversight?
> > 
> > While I see tags for those releases in GitLab, in general git tags
> > are not a replacement for proper release tarballs, which I'm not
> > seeing anywhere on GitLab.
> 
> Indeed, as was seen recently with github, the auto-generated tarballs
> can change when the backend impl changes, which invalidate any hashes
> vendors are using to validate tarballs. It is unwise to rely on the
> auto-generated tarballs as the canonical release artifacts
> 
> > 
> > The Fedora package still points to the libvirt.org server too[1], so
> > to me it appears that a few uploads were simply missed.
> > 
> > Rich?

In the following comment:

https://gitlab.com/libvirt/libvirt-ocaml/-/issues/3#note_1292266414

Rich specifically pointed users to the gitlab "release".

Re: [PATCH 4/6] docs: downloads: Change sources link for libvirt-ocaml

[Daniel P . Berrangé]

On Tue, Mar 14, 2023 at 06:12:33AM -0400, Andrea Bolognani wrote:
> On Tue, Mar 14, 2023 at 10:36:56AM +0100, Peter Krempa wrote:
> > The sources for new libvirt-ocaml releases are hosted via gitlab. Add
> > the link. Since old releases are not present there preserve also the old
> > link.
> ...
> >* - OCaml
> > -- `libvirt `__
> > +- `gitlab `__
> > +  `libvirt (old versions) `__
> 
> Is the fact that no tarballs have been uploaded for the last few
> releases intentional, or an oversight?
> 
> While I see tags for those releases in GitLab, in general git tags
> are not a replacement for proper release tarballs, which I'm not
> seeing anywhere on GitLab.

Indeed, as was seen recently with github, the auto-generated tarballs
can change when the backend impl changes, which invalidate any hashes
vendors are using to validate tarballs. It is unwise to rely on the
auto-generated tarballs as the canonical release artifacts

> 
> The Fedora package still points to the libvirt.org server too[1], so
> to me it appears that a few uploads were simply missed.
> 
> Rich?
> 
> 
> [1] 
> https://src.fedoraproject.org/rpms/ocaml-libvirt/c/2559c77a711c7d82aef5110e4dada3adf653444c
> -- 
> Andrea Bolognani / Red Hat / Virtualization
> 

With regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

Re: [PATCH 4/6] docs: downloads: Change sources link for libvirt-ocaml

[Andrea Bolognani]

On Tue, Mar 14, 2023 at 10:36:56AM +0100, Peter Krempa wrote:
> The sources for new libvirt-ocaml releases are hosted via gitlab. Add
> the link. Since old releases are not present there preserve also the old
> link.
...
>* - OCaml
> -- `libvirt `__
> +- `gitlab `__
> +  `libvirt (old versions) `__

Is the fact that no tarballs have been uploaded for the last few
releases intentional, or an oversight?

While I see tags for those releases in GitLab, in general git tags
are not a replacement for proper release tarballs, which I'm not
seeing anywhere on GitLab.

The Fedora package still points to the libvirt.org server too[1], so
to me it appears that a few uploads were simply missed.

Rich?


[1] 
https://src.fedoraproject.org/rpms/ocaml-libvirt/c/2559c77a711c7d82aef5110e4dada3adf653444c
-- 
Andrea Bolognani / Red Hat / Virtualization