Automatically generated tarballs from googlesource.com have unstable checksum,
making those unsuitable for downstream consumption. To make builds reproducible
Unix distributions often have to host a local copy that no longer matches upstream.
Some (e.g., Gentoo) have switched to signed tarballs (posted here, on av1-discuss)
but those are limited to to few releases (e.g., 1.0.0* and *-rc* are missing).
However, a downstream may need an arbitrary snapshot or cherry-pick fixes from
later releases.
https://github.com/archlinux/svntogit-packages/commit/7522d6aabb7b
https://github.com/netbsd/pkgsrc/commit/e89d1445e870
Can someone setup a mirror on GitHub in official capacity (marked as "public mirror")
under AOMediaCodec, webmproject, google, VideoLAN or maybe another account?
Steps to reproduce:
$ curl -O https://aomedia.googlesource.com/aom/+archive/v3.2.0-rc1.tar.gz
$ sha256 v3.2.0-rc1.tar.gz
SHA256 (v3.2.0-rc1.tar.gz) = 145ae6eb1d022079892eee1732c4138f1861134fa69308e009372e1b3a745ea0
$ curl -O https://aomedia.googlesource.com/aom/+archive/v3.2.0-rc1.tar.gz
$ sha256 v3.2.0-rc1.tar.gz
SHA256 (v3.2.0-rc1.tar.gz) = 32d869d8546ed8fb75cc9533effbce8ff911c7750fa496f6b9c6b6b61a2d0bb8
$ curl -o 86874609267d.patch 'https://aomedia.googlesource.com/aom/+/86874609267d%5E%21/?format=TEXT'
$ patch -p1 -i 86874609267d.patch -d /path/to/libaom-3.1.0
Hmm... I can't seem to find a patch in there anywhere.
$ b64decode 86874609267d.patch
b64decode: 86874609267d.patch: missing or bad "begin" line
$ file 86874609267d.patch
86874609267d.patch: ASCII text, with very long lines, with no line terminators
Existing non-official up-to-date mirrors:
* https://github.com/jbeich/aom set up via cronjob, used by FreeBSD and OpenBSD packages
* https://github.com/m-ab-s/aom set up via GitLab hook, doesn't prune obsolote tags
Note, I'm planning to kill my mirror once the official one is up.
--
You received this message because you are subscribed to the Google Groups "AV1 Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to av1-discuss...@aomedia.org.
To view this discussion on the web visit https://groups.google.com/a/aomedia.org/d/msgid/av1-discuss/sfx8-aj55-wny%40FreeBSD.org.
I was using hand rolled tarballs for 1.0.0 snapshots, but switched to
GitHub for 2.0.0 and newer.
--
You received this message because you are subscribed to the Google Groups "AV1 Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to av1-discuss...@aomedia.org.
To view this discussion on the web visit https://groups.google.com/a/aomedia.org/d/msgid/av1-discuss/077919f1-b625-e9b6-6454-ac3c93c05836%40comstyle.com.
Hi,
On Sun, Oct 10, 2021 at 1:28 PM Jan Beich <jbe...@freebsd.org> wrote:
Automatically generated tarballs from googlesource.com have unstable checksum,
making those unsuitable for downstream consumption. To make builds reproducible
Unix distributions often have to host a local copy that no longer matches upstream.
Some (e.g., Gentoo) have switched to signed tarballs (posted here, on av1-discuss)
but those are limited to to few releases (e.g., 1.0.0* and *-rc* are missing).
However, a downstream may need an arbitrary snapshot or cherry-pick fixes from
later releases.
https://github.com/archlinux/svntogit-packages/commit/7522d6aabb7b
https://github.com/netbsd/pkgsrc/commit/e89d1445e870
Can someone setup a mirror on GitHub in official capacity (marked as "public mirror")
under AOMediaCodec, webmproject, google, VideoLAN or maybe another account?
Stable archives for the final release are available similar to what's done for libvpx for this purpose. Maybe that's lacking some visibility.
I used to use tarballs for libvpx pulled from
https://storage.googleapis.com/downloads.webmproject.org/releases/webm/
but there hasn't been any uploaded there since 1.6.1.
I looked at the tarballs in the URL above and they're not usable
as is. The tarballs need to be
created with the source code rooted in a subdir, as in for 3.20.0
in a dir of the name aom-3.20.0.
On 10/11/2021 7:34 PM, James Zern wrote:
Hi,
On Sun, Oct 10, 2021 at 1:28 PM Jan Beich <jbe...@freebsd.org> wrote:
Automatically generated tarballs from googlesource.com have unstable checksum,
making those unsuitable for downstream consumption. To make builds reproducible
Unix distributions often have to host a local copy that no longer matches upstream.
Some (e.g., Gentoo) have switched to signed tarballs (posted here, on av1-discuss)
but those are limited to to few releases (e.g., 1.0.0* and *-rc* are missing).
However, a downstream may need an arbitrary snapshot or cherry-pick fixes from
later releases.
https://github.com/archlinux/svntogit-packages/commit/7522d6aabb7b
https://github.com/netbsd/pkgsrc/commit/e89d1445e870
Can someone setup a mirror on GitHub in official capacity (marked as "public mirror")
under AOMediaCodec, webmproject, google, VideoLAN or maybe another account?
Stable archives for the final release are available similar to what's done for libvpx for this purpose. Maybe that's lacking some visibility.I used to use tarballs for libvpx pulled from https://storage.googleapis.com/downloads.webmproject.org/releases/webm/
but there hasn't been any uploaded there since 1.6.1.
I looked at the tarballs in the URL above and they're not usable as is. The tarballs need to be
created with the source code rooted in a subdir, as in for 3.20.0 in a dir of the name aom-3.20.0.
The only tarballs I see are the weird ones of the v1.7.0.tar.gz
variety.
https://storage.googleapis.com/downloads.webmproject.org/releases/webm/libvpx-1.11.0.tar.gz
shows 404.
I don't use the libwebp tarballs either. Same thing.
I don't use the libwebp tarballs either. Same thing.