[Gpephone-devel] silently updated releases

[Nils Faerber]

YE NAN RD-ILAB-PEK schrieb:
> Dear Florian,
> 
> I think this would be caused by the checksum syncrohnization during our G(PE)^2 release. Since, some packages CANNOT pass "make distcheck", we fixed all those bugs and refreshed the packages on download page of our website. Maybe, this caused the checksum verfication failure.
> 
> So I wonder if it's convenient for you to update the checksum of OpenEmbedded to solve this problem?

The correct way is to increase the least signifcant version number of
the tar-ball and release new tar balls. Everything else is pure
confusion. You then have different versions with exactly the same name
floating around in the world.
You must keep in mind that once you have released a tar-ball into the
public it will be downloaded and consumed by many many people. How do
you want to tell those people that the contents of the very same named
package has silently changed at some point? People will report "Version
1.2.3-r4 (or whatever) has a problem. And you say then? "Oh, please
download again, there is a new version now." "But how do I tell which
version I have?". And here you get in trouble.

So please please do not do this ever again ;) This causes major pain
with a lot of people and projects. It is not only that md5sums of
OpenEmbedded are wrong now - this is merely the tip of the iceberg.


So back to business... how can we clean up the "mess"?

Do you have fixed tar-balls at hand that contain a version that passes
distcheck? Yes? Then release new versions of those with the least
significant version number incremented. Put them up into the file
release system. You should do that right away. Projects like
OpenEmbedded will then (almost) automatically catch the new versions and
create new md5sums for them.
And never ever again change those tar-balls ;) The upload kind of casts
them in stone...

Sencond: Do you have archives of the old original archives? The ones
that *failed* distcheck? If yes then please replace the updated but not
newly versioned tar-balls with the old ones so that the md5sums match
again. If you do not have copies of those "old" tar-balls please tell us
so that we can try to browse our archives. If we cannot find the ols
ones again we will have to remove the arcives from the release system
altogether.


And finally: Please do *not* take this personally or in any way too
critical! What hapened is simply a matter of you not knowing and nobody
can blame you. But from now on it should not happen again in order not
to confuse so many other people again ;)
It is good work you are doing and we all appreciate it very much!

> Best regards,
> Nan YE
Cheers
  nils faerber

-- 
kernel concepts GbR        Tel: +49-271-771091-12
Sieghuetter Hauptweg 48    Fax: +49-271-771091-19
D-57072 Siegen             Mob: +49-176-21024535
--