News for hackers. Stuff that matters.
Re:Git archive checksums may change by Denvercoder9 on Monday January 30, 2023 @06:53PM (#34588522)
> For literally the entire multi-decade history of open source, the norm has been — for very good reason — that source archives are immutable and will not change.

Well, the norm has been that maintainers generated and distributed a source archive, and that archive being immutable. That workflow is still perfectly fine with GitHub and not impacted by this change.

The problem is that a bunch of maintainers stopped generating and distributing archives, and instead started relying on GitHub to automatically do that for them.

Re:Git archive checksums may change by ilyt on Monday January 30, 2023 @10:43PM (#34590639)
The problem was people assuming github works like that - saves a archive of every commit, which is obviously silly if you think about it (why save it if you can regenerate it on a whim from any commit you want?)
Re:Git archive checksums may change by account42 on Tuesday January 31, 2023 @06:07AM (#34593726)
> That workflow is still perfectly fine with GitHub

It would be perfectly fine if you could prevent GitHub from linking the autogenerated archives from the releases or at least distinguish them in a way that makes it clear that they are not immutable maintainer-generated archives.