-
Notifications
You must be signed in to change notification settings - Fork 12
Ticket29294 #332
base: master
Are you sure you want to change the base?
Ticket29294 #332
Conversation
Leave CHANGELOG.md until there's an actual new release, in case the unreleased changes are lost. Once CHANGELOG.md is removed, update the symlinks.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Most of these changes look ok: I didn't check them in detail.
I have questions about scripts/maint/release.py .
print("Obtaining Github tarball...") | ||
# This will overwrite local tarball, but that's fine since the hash file |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overwriting the local tarball is only fine if the user reads the output of the script, and notices when the GitHub tarball is different. Please put the tarballs in separate files.
) | ||
|
||
print("Verifying Github tarball and local one are the same...") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't understand why we do a sha256 check, rather than a file diff check.
In fact, I'm not sure why we do this check at all?
Please add a comment explaining why it is important that GitHub matches our local tarball.
Are tarballs reproducible?
What happens if the tarballs are different?
Can they be different on different OSes?
Does GitHub guarantee that their tarballs are created with particular git and tar versions on a particular OS?
No description provided.