No way to tell what code is in the daily snapshot

[dfandrich]

I did this

Until PR #14331, the daily snapshot contained the file CHANGES that contained the git log of the code in the tar ball. Since that has been removed, there is no longer any way to tell what code is in the daily snapshot. The date itself lets you make an approximate guess, but it can't get you closer than about 7 commits (on average).

I expected the following

There should be a way to tell exactly which commit the snapshot represents to replace CHANGES. Some possibilities:

• A file "commit.txt" containing the git hash. This probably isn't realistic for the official release tarballs because of the same reason log2changes was removed (the code might come from the tar ball itself, not git). But, it's reasonable to have in the daily snapshots.
• A git tag for each snapshot build. While this would work, it doesn't help users who just download the tarball or don't have git and want to track the code. It will also bloat the number of tags by more than 50×.
• An external mapping of snapshot date and commit number. A JSON file or API hosted on the curl.se site would make this data available to those interested, although it's not nearly as convenient as having it in the snapshot itself.

This is an issue for Test Clutch, since there is now no way to associate test results from a snapshot build to the code that generated those results.

curl/libcurl version

8.10.0-DEV (commit 8a9c227)

operating system

OS independent

[bagder]

Would adding the short HEAD commit hash to the filename work?

Like : curl-8.10.0-20240803-b6089c35d.tar.bz2 ?

[dfandrich]

That would work, but it means that the daily snapshot name is no longer predictable. The autocurl script at https://curl.se/dev/howto.html would break and any builds people are running based on it, the autobuilds I used to run would also have broken, as would anyone else doing snapshot builds but assuming the name. Test Clutch uses the trick of searching for the "NEWEST" comment at https://curl.se/snapshots/ so it should survive, unless the directory name inside the tar ball also changes to include the hash which would break it. All these things can be fixed, so I'm fine with it if you think that's the best way forward.

[bagder]

but it means that the daily snapshot name is no longer predictable

The latest snapshot is not truly predictable now either since there is no telling exactly when there is a new snapshot to download - which has shown the times where the daily snapshot builds have failed . That's why we offer the NEWEST comments. But I see what you mean.

The autocurl script at https://curl.se/dev/howto.html would break

Hm, yes right. I suppose that approach might still be used...

[bagder]

How about this. A generated docs/snapshot-commit.txt file with the latest commit hash?

$ tar xOf curl-8.9.11.tar.xz curl-8.9.11/docs/snapshot-commit.txt
acbc6b703

I'll make a PR with the necessary changes and then we can make the snapshots done using this option. It does break the reproducibility, but we would only use this for daily snapshots and not for actual releases.

[dfandrich]

That sounds fine to me. Having "snapshot-" in the name seems unnecessary; should this ever be added to a regular release, it would need a new name. And it might as well be a full hash instead of the short version.