Make it possible to build production GnuPG's from git tags

Simon Josefsson <[email protected]> Sun, 23 Aug 2026 13:24:34 +0200

Newsgroups	gmane.comp.encryption.gpg.devel
Message-ID	<[email protected]>

Hi

There is a discussion in the Guix community about building GnuPG
directly from git tags:

https://codeberg.org/guix/guix/issues/10622

What do you think about making it possible to build GnuPG's intended for
production use from git tags?

I see two things that would help, besides the necessary autoconf
source-code tweaking:

1) Declaring some public git server (or mirror) as officially supported,
one that doesn't fall over due to AI scrapers.

-and/or-

2) Publishing 'git-archive' tarballs, which could be used as long-term
archival copies of the git repository in case it goes away.  They would
contain the exact same content as git tag but without the .git
sub-directory.  Typically created like this:

   git archive --prefix=gnupg-v2.5.21/ -o gnupg-v2.5.21-src.tar.gz v2.5.21

or programmatically something like:

   git archive --prefix=gnupg-$(git describe)/ -o gnupg-$(git describe)-src.tar.gz $(git describe)

which also works for non-releases.  This is the same as various forges
publishes as their "download git" tarball links, modulo leading path and
naming differences.  Of course, GPG signing them would be useful.

I'm doing 2) for several GNU tools, published as foo-v1.2.3-src.tar.gz
tarballs.  Some notes:
https://blog.josefsson.org/2024/04/01/towards-reproducible-minimal-source-code-tarballs-please-welcome-src-tar-gz/

/Simon

_______________________________________________
Gnupg-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-devel

signature.asc (application/pgp-signature, 1.3 KB)