Do not rebuild packages when an extra-source's url changes but not its checksum #5258
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kit-ty-kate
force-pushed
the
effectively-extra-sources
branch
from
6f22733
to
c65fb48
Compare
|
We might want to do this only in the presence of strong checksums, given the attacks on both md5 and sha1? The alternative would be to actually download the patch and check that it really is the same as the one used, but that's highly invasive to the code (network access before confirmation, etc.) |
|
I agree this is an issue but it's not specific to this change (and is much worse for the main urls or even with the new software heritage feature for instance). Could you open a separate issue to discuss it more fully? |
|
That's a good point - I'd forgotten that the cache already works this way |
rjbou
approved these changes
Aug 29, 2022
rjbou
reviewed
Aug 30, 2022
rjbou
force-pushed
the
effectively-extra-sources
branch
from
c65fb48
to
dde9627
Compare
|
Updated with a test |
kit-ty-kate
commented
Aug 30, 2022
kit-ty-kate
force-pushed
the
effectively-extra-sources
branch
3 times, most recently
from
164a840
to
3f31f07
Compare
kit-ty-kate
force-pushed
the
effectively-extra-sources
branch
from
3f31f07
to
876b4f0
Compare
rjbou
force-pushed
the
effectively-extra-sources
branch
from
876b4f0
to
666db40
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Detected in ocaml/opam-repository#22016