On Tue, Apr 26, 2016 at 9:11 AM, Branko Čibej <brane_at_apache.org> wrote:
> On 26.04.2016 03:55, Stefan wrote:
>> Hi,
>>
>> during the verification process of the tarballs I spotted that some
>> files have a different HeadURL and/or different timestamp records in
>> the files when comparing the archives with the content from the tagged
>> revisions.
>>
>> Is that expected?
>>
>> For instance win-tests.py in 1.8.16:
>>
>> zip file:
>>
>> # $HeadURL:
>> http://svn.apache.org/repos/asf/subversion/branches/1.8.x/win-tests.py $
>>
>> tag:
>>
>> # $HeadURL:
>> https://svn.apache.org/repos/asf/subversion/tags/1.8.16/win-tests.py $
>>
>>
>> Not that it worried me enough to not sign the zip-archives. Just a bit
>> wondering whether something is odd here.
>
> Could be that the archive was built from the branch instead of from the
> tag. Our release scripts allow for both, but releases really should be
> cut from the tag. Could be an oversight ...
I always verify the contents (of the Windows zip files) against an
export of the tag and of the branch the tag was created from
(branches/1.8.x_at_1740329 in this case). I recursively diff both
directories against each other (gnu 'diff -r' inside cygwin actually),
and manually / diagonally verify the differences [1]. Indeed, HeadURL
and Date keywords can differ, but I ignore those.
- HeadURL either pops up when diffing to the branch export or to the
tag export, but not both (indeed, it might be that usually it's
identical to the tag export, and not to the branch export -- maybe
it's reversed this time). Note: I perform the "export for content
verification" with the plain http URL, not https, since that's what
apparently is always used when creating the tarballs / zips.
- Date pops up as a difference because of timezone issues. If I change
my own timezone (on Windows) to UTC, before executing the export, then
the Date keywords are identical, so they don't appear in the diff. It
has made me wonder if there was a way to influence the timezone used
for "Date" expansion during export, on Windows. I haven't found a way
to do that (only by changing the system timezone).
So if you export from http, and change your timezone to UTC before
exporting, then you get the least amount of unnecessary diff when
comparing the zip with the exported directories.
Other differences I ignore are:
- expected differences in svn_version.h (different when comparing to
the branch, should be identical when comparing with the tag).
- some symlinks vs. actual contents (consequence of running this
verification on Windows, I guess): for svnpubsub and svnwcsub (plus
nominate.pl in 1.9.x). In the exports you get "link svnwcsub.freebsd"
or something like that, in the zip you have the actual content of the
file.
- some generated files (only present in the zip, not in the tag / branch).
- and some directories / files are not in the zip (but they are in the
tag / branch), like the CONTRIB directory, which is expected too.
[1] See my usual statement when submitting my signature to the mailing list:
[[[
Contents of subversion-1.8.16.zip are identical to tags/1.8.16, and
to branches/1.8.x_at_1740329 (except for expected differences in svn_version.h
and svnpubsub and svnwcsub (symlinks vs. file contents), and
generated files).
]]]
which I borrowed and modified from Paul Burba's signature statements
back in the day ...
--
Johan
Received on 2016-04-26 10:27:59 CEST