From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by yocto-www.yoctoproject.org (Postfix, from userid 118) id 2337EE00A45; Fri, 26 Jun 2015 07:43:17 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on yocto-www.yoctoproject.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1 X-Spam-HAM-Report: * 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider * (jon.szymaniak[at]gmail.com) * -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low * trust * [209.85.192.180 listed in list.dnswl.org] * -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.0000] * 0.0 HTML_MESSAGE BODY: HTML included in message * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's * domain * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily * valid * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Received: from mail-pd0-f180.google.com (mail-pd0-f180.google.com [209.85.192.180]) by yocto-www.yoctoproject.org (Postfix) with ESMTP id 67FE3E00A2C for ; Fri, 26 Jun 2015 07:43:15 -0700 (PDT) Received: by pdjn11 with SMTP id n11so76369066pdj.0 for ; Fri, 26 Jun 2015 07:43:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=7zcQ6rQMupAedWhyR978ehbesZWyVMAlqsJBjpV3S9w=; b=Gr8+cK4IY/oU8k+G8Tmf9gfZWt5KuMAYp+WajeINeh4nBJfTdbMO3JWBJ8JNmsBbeq /0xKdw6wcMPbE2BN5IeWYg7Lqv/2GPfdPgjEX5DWLgixv+1f2ONPJ2zPLptGzV096NTa 77va9xPSfEUqxT+e19XpZS3S2sIgqOZNihVCfWaHtN7+W8m3dCca1RwjeB6jKsVKAN3i e8TkpQL4eff9iRRnymLaUWoOlDlHduLKKf96iUmqUB42N2ceHuNbNsVIdjfpLAZraDUH oejeztLkkqdjZYIy9oU/lfdMXOnUglf0ks71SLTIgQv1KUZqXr8799QDPjPw5UBlBw8b gvVQ== X-Received: by 10.70.54.164 with SMTP id k4mr4107210pdp.61.1435329795333; Fri, 26 Jun 2015 07:43:15 -0700 (PDT) MIME-Version: 1.0 Received: by 10.66.157.98 with HTTP; Fri, 26 Jun 2015 07:42:55 -0700 (PDT) In-Reply-To: References: <1435292188-29514-1-git-send-email-jon.szymaniak@gmail.com> From: Jon Szymaniak Date: Fri, 26 Jun 2015 10:42:55 -0400 Message-ID: To: "Burton, Ross" Cc: "yocto@yoctoproject.org" Subject: Re: [meta-raspberrypi][PATCH] firmware.inc: Fetch a zip instead of cloning a git repo X-BeenThere: yocto@yoctoproject.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: Discussion of all things Yocto Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2015 14:43:17 -0000 Content-Type: multipart/alternative; boundary=089e0158c20e9623a305196cc2fa --089e0158c20e9623a305196cc2fa Content-Type: text/plain; charset=UTF-8 On Fri, Jun 26, 2015 at 10:19 AM, Burton, Ross wrote: > > > On 26 June 2015 at 15:16, Jon Szymaniak wrote: > >> I'm open to other suggestions as well, as this was just a first stab at >> it. I've been seeing that cloning this git repo containing binary firmware >> blobs takes an absurd amount of time, if it even finishes at all >> successfully. >> > > I believe github offers hosting of "release" tarballs too, so upstream > could take advantage of that. Having verified checksums of firmware is > useful from a security point of view as you can't really inspect the > sources for it... > That's actually what I looked for first, and definitely would use that if it were available. Generally when you apply a tag or manually create a release on GitHub, and etnry under "Tags" or "Releases" is created. It will automatically provide a zip and/or tar.gz of the repo sources -- I suspect this would suffer from the same risk of changing checksums that you expressed concern over. Therefore, it would require the upstream maintainer to upload a specific .tar.gz, preferably with .sha256sum and .md5sum files. Back to the git depth point... why is "--depth 1" not the default for all cases? Could anyone elaborate on some use cases where we'd actually want the entire history for builds? - Jon --089e0158c20e9623a305196cc2fa Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

= On Fri, Jun 26, 2015 at 10:19 AM, Burton, Ross <ross.burton@intel.com<= /a>> wrote:


<= div>Back to the git depth point... why is "--depth 1" not the def= ault for all cases?=C2=A0 Could anyone elaborate on some use cases where we= 'd actually want the entire history for builds?


--089e0158c20e9623a305196cc2fa--