Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@parpok Would you be able to share the repo/sources for how this package is being built and distributed?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@shahmishal
Here's a Swift forum post about the apt repo
There's also more information on the repository project website with included link to scripts code for adding the repository
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This doesn't provide sources for the build and packaging scripts unfortunately, which makes it impossible to verify that these packages were built correctly or to understand what modifications were done to the original source.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I used
pkgdiff
on both the official tar.gz file from swift.org and deb file from swiftlang.xyz repository (downloaded usingapt download swiftlang
) and the result came that files were different. If anyone interested in auditing the difference I'm leaving the reportpkgdiff
provided.Also if the community repo doesn't suit needs I can delete any mentions of it.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@shahmishal @MaxDesiatov As the creator and maintainer of the https://swiftlang.xyz repository I can verify that all packages have been built without any modifications to the original source.
Where possible the packages are created from the original .tar.gz files from swift.org.
OS versions that swift.org does not supply are created from https://github.com/futurejones/swift-arm64/releases.
As I also build and maintain these packages I can also verify that they are built from the original source.
Build logs from https://ci.swiftlang.xyz/ show that no patches currently are needed for builds on ubuntu/debian on amd64 or arm64.
I use https://github.com/jordansissel/fpm to create the .deb packages from the .tar.gz files.
fpm
does not change or modify any files contained in the .tar.gz files, it simply repackages them into .deb files.@parpok
pkgdiff
can not be used to check for diffs between two different file types like .tar and .deb.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@shahmishal do we list non-swift.org produced installers / artifacts on this page, or is it limited to the ones the swift.org produces?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We currently don't post installer or artifacts urls from outside of swift.org.