Re: [PATCH] gnu: add sparta-dsmc

[Lukas Gradl]

Leo Famulari <address@hidden> writes:

> On Sat, Apr 23, 2016 at 01:47:18AM -0500, Lukas Gradl wrote:
>> On Tue, Apr 05, 2016 at 08:21:35PM +0300, Efraim Flashner wrote:
>> > On Tue, Apr 05, 2016 at 12:04:56PM -0500, Lukas Gradl wrote:
>> > > On Tue, Apr 05, 2016 at 04:26:59AM -0400, Leo Famulari wrote:
>> > > > On Mon, Apr 04, 2016 at 03:55:51PM -0500, Lukas Gradl wrote:
>> > > > > Hello Guix!
>> > > > > 
>> > > > > Attached is a patch to add the SPARTA Direct Simulation Monte Carlo
>> > > > > Software.
>> > > > > 
>> > > > > There maybe is a problem with the source URL: The URL always points 
>> > > > > to
>> > > > > the latest version of the source tar ball which is constantly updated
>> > > > > and immediately released by upstream.  This means that the hash of 
>> > > > > the
>> > > > > source tar ball available at this URL changes several times a month. 
>> > > > >  Is
>> > > > > this acceptable or does anyone have an idea how this should be 
>> > > > > handled?
>> > > > 
>> > > > I assume you've looked for a more stable URL. Are there other distros
>> > > > that have solved this problem? Can you contact the SPARTA developers 
>> > > > and
>> > > > ask if there is a solution?
>> > > 
>> > > AFAIK this software is not packaged in any other distro.  I am already
>> > > in contact with the author of SPARTA, he provided the URL that I used in
>> > > the patch.  I explained the problem to him and I am waiting for his
>> > > response.
>> > > 
>> > > Thank you!
>> > 
>> > Not just for this package but potentially for others, could we stick a
>> > copy on archive.org with a date-stamp or something?
>> 
>> 
>> Sorry for the long delay!
>> 
>> My message to upstream is still unanswered, so I went ahead and uploaded
>> the tar ball to archive.org.  Attached is an updated patch.
>
> Do we at least know why the tarball keeps changing? For example, is it a
> new release? Have you inspected the differences from one to the next?

Yes, it is a new release.  When upstream releases a new version, they
publish it at this URL.  The old version that was available at that URL
before is then taken offline and can no longer be downloaded from their
website.

> If the upstream author could say, "use this tarball with hash xxx[...]",
> we could confidently distribute software from the author to our users.
>

At the moment, the tarball with hash XXX at the download URL is silently
replaced by another tarball with hash YYY but identical name
(sparta.tar.gz) whenever they release a new version, which happens up to
several times a month.  I tried to explain to the author that this is
problematic for the authentication of the tarball via SHA sums and for
reproducibility and I suggested to him to append the release date to the
tarball name and keep the old ones available.  Unfortunately I have not
received a reply yet.

> Thanks for you work on this so far!

Thank you for your review!  I am working with this software almost every
day on several computers managed by Guix so I would love to see this go
in.