DarkRadiant 3.0.0 released

[greebo]

1 hour ago, coldtobi said:

One thing that might work is to re-normalize the git repo before doing a release:  (requires * text=auto in .gitattributes)

$ git add --renormalize .
$ git status        # Show files that will be normalized
$ git commit -m "Introduce end-of-line normalization"

(Stolen from https://git-scm.com/docs/gitattributes)

Yes, I came across the same page. I'll try to do that some time and will try to keep it in mind before the next release.

[OrbWeaver]

I've set the export-ignore attribute on .gitattributes itself, so I guess we'll see if this makes any difference to what GitHub produces.

4 hours ago, coldtobi said:

Another approach could be to make the release tarballs manually, (and possibly also GPG sign them afterwards to ensure that supply chain attacks can not happen -- Debian would appreciate a GPG signature, but I digress)

I'd like to avoid creating "upstream" tarballs, as it is recommendation within Debian to use the upstream tarball unmodified when ever possible; (even if there is no GPG signature to break…)

Another possible source for the tarball would be the one attached to the Ubuntu package, which is effectively a "pristine upstream" tarball since I am generating that package myself without any Ubuntu-specific patches. It would also be (indirectly) signed as part of the PPA publishing process.

However I don't know if you or Debian would have a problem with basing a Debian package off an Ubuntu package source, since it's usually the other way around.

[coldtobi]

11 hours ago, OrbWeaver said:

I've set the export-ignore attribute on .gitattributes itself, so I guess we'll see if this makes any difference to what GitHub produces.

nice! Lets see if/how that works

11 hours ago, OrbWeaver said:

Another possible source for the tarball would be the one attached to the Ubuntu package, which is effectively a "pristine upstream" tarball since I am generating that package myself without any Ubuntu-specific patches. It would also be (indirectly) signed as part of the PPA publishing process.

However I don't know if you or Debian would have a problem with basing a Debian package off an Ubuntu package source, since it's usually the other way around.

Yes, it would be odd to get the sources from a PPA instead of directly…  Aslo, uscan(1), the tool responsible to import new upstream tarballs only can verify detached gpg signatures, not taking them from .dsc, that won't help in that part…

 

[OrbWeaver]

On 8/18/2022 at 8:44 AM, coldtobi said:

nice! Lets see if/how that works

I just checked the tarball which can be downloaded from my GitLab repository (https://gitlab.com/orbweaver/DarkRadiant/-/tree/maint/3.1.0) and .gitattributes is not appearing in the resulting archive, so it looks like GitLab at least is honouring the export-ignore attribute.