tech-pkg archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

misc/vym distinfo checksum update



On Oct 31, the distinfo file for misc/vym was
changed, with this log message (from CVS $Id$ 1.3 to 1.4)...

        - Updated the PLIST file
        - corrected the checksum in distinfo
        - added LICENSE term inside Makefile
        - bumped revision

It is too late to do anything about this now, but the
2nd of those was done the wrong way, it is inappropriate to
"correct a distinfo checksum" - if the distinfo file has
changed, we need to find out why (to make sure the change is
not the introduction of a trojan - usually it is just an
ignorant upstream developer who doesn't know that a changed
file should have a change revision, but ...)

And second, when it is confirmed OK, and updated, the new
(updated) distfile needs to go ion a DIST_SUBDIR - otherwise
people (like me in this case) who had the original distfile,
never fetch the updated one, we just get "distfile checksum error"
instead (or words to that effect.)

So, please, everyone, remember, if you ever see a situation
where you need yo update a distinfo checksum, for a distfile
whose version number has not changed, you MUST add a DIST_SUBDIR
(and you really should verify that the change is harmless, ask
upstream if there's no other way to check.)

The one and only case I can think of where not adding a DIST_SUBDIR
might be safe (and even then, not recommended) is when you *know*
that no-one could possibly have fetched the old distfile via pkgsrc
(ie: when the packeta is new, and was committed using the developer's
copy of the distfile they obtained earlier, then after committing the
package, they notice the distfile has altered on the master site,
before pkgsrc got the package).   In that case, if you're sure, leaving
out the DIST_SUBDIR is harmless, it is also harmless to include it,
and then you don't need to be sure, which is lots easier...

kre


Home | Main Index | Thread Index | Old Index