0.26 release re-tagged

Please don't re-roll releases. Always increment versions and issue a new release. Re-rolling causes grief for all downstream consumers and creates confusion among the public about which release is legitimate. It is a genuine security and integrity issue.

Thanks

[koobs]

Additionally, can you please:

1. Document (either in this issue, or in documentation) what changed between the two commits after moving the v0.26 tag.

The moving of the tag caused FreeBSD's nginx and nginx-devel packages to break with distribution file checksum mismatches, as they provide options to install headers-more and rely on fetching git archives (by tag) that are produced by github. Moving the tag caused these checksums to change on that archive.

[agentzh]

Oh, I'm very sorry for the inconvenience introduced by the moving tags and I'll avoid that in the future :)

The two commits between the old and new tags are:

commit d20bf26a8029bff6870b987994907d22b957f837 (tag: v0.26)
Author: Yichun Zhang (agentzh) <agentzh@gmail.com>
Date:   Thu Apr 2 12:26:51 2015 -0700

    fixed compilation failures with nginx 1.7.11+ configured with --with-threads.

commit a7f81f20bef3a4f73b7426c29cb1ae13d45cc647
Author: Yichun Zhang (agentzh) <agentzh@gmail.com>
Date:   Mon Dec 8 21:56:32 2014 -0800

    updated doc to reflect recent changes.

Will tagging a new 0.27 release help you solve the issue?

[agentzh]

Oh, and I will only tag formal releases upon OpenResty releases in the future. This can effectively keep me from the temptation of moving tags ;)

[koobs]

@agentzh Thank you for the detail, this helps alleviate any fears of any accounts being compromised or 'naughty' code being committed.

We've already updated the checksums for the FreeBSD Ports, but their may be other downstream consumers that rely on the tag->checksum, including other OS's.

A new v0.27 tag would be handy for those people who haven't yet updated, but I also wouldn't move the v0.26 tag back to where it was.

For any downstream consumers who have already updated checksums, it might be worth adding notes to your changelog, outlining the two extra commits added to the v0.26 tag, so they know what happened, and what was changed.

[koobs]

cc'ing @osokin our nginx port maintainer

[agentzh]

@koobs This module does not have its own changelog, rather, its changes are recorded in OpenResty's changlog:

https://openresty.org/#Changes

I've added a note there:

https://openresty.org/#ChangeLog1007010

[koobs]

Lovely, thank you Yichun!

[osokin]

Well, to be honest this is bad idea to re-tagged existing release - what's done cannot be undone.

Any chance to release the same with new tag 0.26.1 or 0.27?

[agentzh]

@osokin I've pushed the v0.261 tag.

[osokin]

@agentzh Well, I don't think that "0.26 < 0.261 < 0.27" is true, do you?
I mean what will be next release number? 0.262/0.27/whatever?

[agentzh]

@osokin They are decimal numbers so 0.26 < 0.261 < 0.27 holds.

Thanks a ton for doing this (and graciously accepting my sarcasm!!)

[agentzh]

@feld Sorry again for all the inconvenience :) I'm closing this ticket.