Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122825
Precedence: bulk
MIME-Version: 1.0
References: <AM8P250MB01705B564C0F9B2F460F56B0E2392@AM8P250MB0170.EURP250.PROD.OUTLOOK.COM>
 <9008050F-4EE1-4E19-B513-654602E118A7@benramsey.com> <3d90e236-49d8-4f80-a6dd-3584267a83e3@php.net>
 <586c3320-b38b-47bb-9c06-6762f1eb242b@gmail.com> <cc1e1415-a4cd-4bb2-99f0-e5b05ef6582c@gmail.com>
In-Reply-To: <cc1e1415-a4cd-4bb2-99f0-e5b05ef6582c@gmail.com>
Date: Sat, 30 Mar 2024 14:22:08 +0000
Message-ID: <CAEKnhAEMAmgoFmgCPOnV_0sxpaB5SNwRo-qFcE_YeLSduq+bHg@mail.gmail.com>
Subject: Re: [PHP-DEV] Consider removing autogenerated files from tarballs
To: Daniil Gentili <daniil.gentili@gmail.com>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary="000000000000f4cf9f0614e17bb6"
From: bukka@php.net (Jakub Zelenka)

--000000000000f4cf9f0614e17bb6
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi

On Sat, Mar 30, 2024 at 1:39=E2=80=AFPM Daniil Gentili <daniil.gentili@gmai=
l.com>
wrote:

> Hi,
>
>
> >The idea is that we would setup worklfow on CI that would run on tag pus=
h
> and it would call (authenticated https request) downloads.php.net server
> that could do the actual build
>
> I strongly believe that source tarballs should contain *only* the source
> code contained in the VCS.
>
That would break lots of tools as it requires extra dependencies so it is
not something that would could in stable versions. It is also pretty
standard thing to distribute configure files (which is the file that
probably matters most). Also don't forget that we need to also provide
Windows builds which are binaries so we need some sort of verification of
this type in any case.

>
> Distributing "half-built" source code (even if it's generated by a CI, an=
d
> especially by a build server on downloads.php.net, which can be
> compromised) defeats the reproducibility and transparency purposes of
> building from source.
>

It would require compromising the CI as well as the download serves
happening at the same time which seems to me like an impossible scenario.

Regards

Jakub

--000000000000f4cf9f0614e17bb6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi</div><br><div class=3D"gmail_quote"><div dir=3D"lt=
r" class=3D"gmail_attr">On Sat, Mar 30, 2024 at 1:39=E2=80=AFPM Daniil Gent=
ili &lt;<a href=3D"mailto:daniil.gentili@gmail.com">daniil.gentili@gmail.co=
m</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin=
:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"=
><u></u>

 =20
   =20
 =20
  <div>
    <p>Hi,<br>
    </p>
    <p><br>
      &gt;The idea is that we would setup worklfow on CI that would run
      on tag push and it would call (authenticated https request) <a href=
=3D"http://downloads.php.net" target=3D"_blank">downloads.php.net</a> serve=
r
      that could do the actual build<br>
      <br>
    </p>
    <p>I strongly believe that source tarballs should contain *only* the
      source code contained in the VCS.<br></p></div></blockquote><div>That=
 would break lots of tools as it requires extra dependencies so it is not s=
omething that would could in stable versions. It is also pretty standard th=
ing to distribute configure files (which is the file that probably matters =
most). Also don&#39;t forget that we need to also provide Windows builds wh=
ich are binaries so we need some sort of verification of this type in any c=
ase.=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0=
px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><p>
      <br>
      Distributing &quot;half-built&quot; source code (even if it&#39;s gen=
erated by a
      CI, and especially by a build server on <a href=3D"http://downloads.p=
hp.net" target=3D"_blank">downloads.php.net</a>, which
      can be compromised) defeats the reproducibility and transparency
      purposes of building from source.<br></p></div></blockquote><div>=C2=
=A0</div><div>It would require compromising the CI as well as the download =
serves happening at the same time which seems to me like an impossible scen=
ario.</div><div><br></div><div>Regards</div><div><br></div><div>Jakub</div>=
<div><br></div></div></div>

--000000000000f4cf9f0614e17bb6--