Source URL guidelines (was Re: source file audit - 2009-02-15)

[Tom Lane]

Kevin Fenzi <kevin at scrye.com> writes:
> Here's attached another run of my sources/patches url checker. 

I've got several failures in this list, which reminds me that there's a
pretty serious problem with the entire concept of source URL as defined at
https://fedoraproject.org/wiki/Packaging/SourceURL

Namely, that it assumes there's a nice static URL for you to point at.
There are a *lot* of upstreams that obfuscate the URL to some extent
or other.  I notice that an exception has been made for sourceforge,net,
without explaining why; but of course the reason why is that they like
to throw random mirror names into the actual URL.  mysql.com does the
same, and some other sites have setups that throw package numbers or
session IDs or other useless crud into the URL.

Not only does this sort of stuff make it hard to usefully provide "the
URL at which you can download an exact copy of this tarball", but it
makes it even harder to provide "the URL at which you should start
looking if you want to find the next updated version of this package".
Which to my mind is a *far* more important use of the site portion of a
Source: line than the first usage.

Let me give a concrete example of one of the cases that Kevin's script
is complaining about.  According to my browser log, the URL I actually
downloaded the latest mysql source tarball from was
http://dev.mysql.com/get/Downloads/MySQL-5.1/mysql-5.1.31.tar.gz/from/http://mysql.mirrors.hoobly.com/
Not only is this an inappropriate link for 90% of the planet to be
using, but it flat out won't work as a Source: line because the filename
isn't the last component.  And what's considerably worse IMNSHO is that
it's unhelpful for someone who wants to get the next version of mysql
when that comes out.  There is no way that you'd intuit from this that
the page to visit is http://dev.mysql.com/downloads/mysql/5.1.html.
(The apparent solution of looking at /get/Downloads/MySQL-5.1/ does not
work.)

Out of the thirteen packages I maintain, five have some issue of this
sort, so it hardly seems like this is an ignorable corner case.

I don't know what an appropriate set of rules is, but I wish that the
Source-URL packaging guidelines bore some resemblance to the real world
of modern web design.  (Or misdesign, perhaps, but that's what's out
there.)  The special exception for sourceforge needs to be replaced
with some more general discussion of what to do with bizarre website
layouts.

			regards, tom lane