Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122823
Content-Type: multipart/alternative;
 boundary="------------xa51q20cUHxCgHrITK0WrYKm"
Message-ID: <cc1e1415-a4cd-4bb2-99f0-e5b05ef6582c@gmail.com>
Date: Sat, 30 Mar 2024 14:36:41 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] Consider removing autogenerated files from tarballs
To: internals@lists.php.net
References: <AM8P250MB01705B564C0F9B2F460F56B0E2392@AM8P250MB0170.EURP250.PROD.OUTLOOK.COM>
 <9008050F-4EE1-4E19-B513-654602E118A7@benramsey.com>
 <3d90e236-49d8-4f80-a6dd-3584267a83e3@php.net>
 <586c3320-b38b-47bb-9c06-6762f1eb242b@gmail.com>
Content-Language: en-US
In-Reply-To: <586c3320-b38b-47bb-9c06-6762f1eb242b@gmail.com>
From: daniil.gentili@gmail.com (Daniil Gentili)

This is a multi-part message in MIME format.
--------------xa51q20cUHxCgHrITK0WrYKm
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi,


 >The idea is that we would setup worklfow on CI that would run on tag 
push and it would call (authenticated https request) downloads.php.net 
<http://downloads.php.net> server that could do the actual build

I strongly believe that source tarballs should contain *only* the source 
code contained in the VCS.

Distributing "half-built" source code (even if it's generated by a CI, 
and especially by a build server on downloads.php.net, which can be 
compromised) defeats the reproducibility and transparency purposes of 
building from source.

 > For upstream packagers like distros I'd likely recommend using these 
tools directly anyway, and not rely on what's in the package.

Distros like arch linux already re-generate the configure scripts from 
scratch, but I believe that no distinction should be made, *everyone* 
should get a tarball containing *only* the bare source code, without 
leaving to the user the choice to re-generate the build files, or use a 
potentially compromised build script.


Regards,

Daniil Gentili.

--------------xa51q20cUHxCgHrITK0WrYKm
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Hi,<br>
    </p>
    <p><br>
      &gt;The idea is that we would setup worklfow on CI that would run
      on tag push and it would call (authenticated https request) <a
        href="http://downloads.php.net">downloads.php.net</a> server
      that could do the actual build<br>
      <br>
    </p>
    <p>I strongly believe that source tarballs should contain *only* the
      source code contained in the VCS.<br>
      <br>
      Distributing "half-built" source code (even if it's generated by a
      CI, and especially by a build server on downloads.php.net, which
      can be compromised) defeats the reproducibility and transparency
      purposes of building from source.<br>
      <br>
      &gt; For upstream packagers like distros I'd likely recommend
      using these tools directly anyway, and not rely on what's in the
      package. <br>
      <br>
    </p>
    <p>Distros like arch linux already re-generate the configure scripts
      from scratch, but I believe that no distinction should be made,
      *everyone* should get a tarball containing *only* the bare source
      code, without leaving to the user the choice to re-generate the
      build files, or use a potentially compromised build script.</p>
    <p><br>
    </p>
    <p>Regards,</p>
    <p>Daniil Gentili.<br>
    </p>
  </body>
</html>

--------------xa51q20cUHxCgHrITK0WrYKm--