Source URL guidelines (was Re: source file audit - 2009-02-15)

[Michael Schwendt]

On Sun, 22 Feb 2009 15:52:00 +0100, Ralf wrote:

> If a source-url doesn't work, the packager should update the URL and 
> respin the package

Even further updates just for cosmetical fixes and pedantry?

In all honesty, a changing URL does not make a "respin" mandatory.
I've seen projects move from domain 1 to domain 2 and back again some
time later, and that doesn't mean I need to publish updates.

> > In particular, packagers and reviewers must visit upstream web sites
> > and verify release-versions and download-locations manually anyway.
>
> Right, as well as arbitrary people, who are investigating bugs, people 
> want to reuse a package etc.

So, conclusively you agree that there are more important steps during
verification of tarballs than keeping an eye on whether an old Source-URL
changes months after release of a package.

> Please Michael, you are beginning to sound laughable.

Stay serious, present convincing arguments.
 
> A broken URL is a _hint_ that something might be in limbo.

Fine. I like automation, I really do. Nothing wrong about notifying
packagers about URLs that have changed. Still, a package respin just
because of changed URLs is an exaggeration.

> A URL alone doesn't buy you anything.

Agreed. The downloaded file and its contents matter.

> > https://fedoraproject.org/wiki/Packaging/SourceURL#Sourceforge.net
> >
> > Fortunately, the current wording does not read like a strict MUST. 
>
> Have you been to a beginners seminar of "rhetoric tricks"?

And I could ask who has brain-washed you to back up such bureaucracy?
 
> The wording has always intended to be a must.

Then you're going to lose a reviewer. I won't sit and wait until
such urls will work in all cases where a connection cannot be established
while the interactive mirror-chooser offers _working_ urls.
This is just silly. I've been one of those who supported the old sf.net URL
scheme when we were only few reviewers. It has always been only a hint
to packagers, to make them understand the benefit of cmdline-compatible
download locations. If at the time of doing a review (or at the time
of downloading a tarball), these Fedora sf.net urls don't work, I won't
use them and won't approve them either when other _direct links_ work
flawlessly.