Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider a grace period before a new version is reported as available #74

Open
jcar87 opened this issue Aug 4, 2022 · 0 comments
Open

Comments

@jcar87
Copy link

jcar87 commented Aug 4, 2022

We have recently had an issue in Conan Center where users were reporting hash mismatches between the source tarball downloaded from GitHub, and the SHA in the recipe:
conan-io/conan-center-index#11801

Upon further investigation, it appears that the v1.6.2 tag for google benchmark was replaced twice (see discussion here) in a short period of time, to address an issue in the commit that the tag originally pointed to.

While this is typically unusual, given the volume of recipes/packages we have in Conan Center, retagging does happen with relative frequency. Having investigated this further, it would appear that in a lot of cases this is more likely to happen in a very short period after the original release.

We have noticed that the PR that introduced 1.6.2 was created from this bot, in a remarkably short period of time after release was originally tagged: conan-io/conan-center-index#11794

While it is an impressive feat to be able to propagate recipes and packaged binaries to users so short after the release - we are wondering if it would be possible for this bot to only report new versions if they have been already available for more than a "grace" period - perhaps 24 hours.

As it turns out with this case with the Benchmark library, it was re-tagged (twice) in a short period of time, and in practice due to this, the recipe was almost immediately broken after the re-tagged version resulting in the SHA of the source tarball changing shortly after. I've not been able to find evidence of other package managers being affected, because they simply cut their 1.6.2 with the "final" version of the tag: we were unfortunate in that we got there too quickly :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant