[rkeene2]

Building from tarball has many advantages over building from a VCS, especially a DVCS. The main one is that tarballs are serialized, hash-able, cache-able, mirror-able, checkable objects. Unlike a tag from which some serialized version must be synthesized (and therefore has multiple interpretations) and may require multiple round-trips to do from a remote resource.

In my Linux distribution, if something doesn't have a release tarball then I do something similar to "pristine-tar" to create the synthetic version that's stable over the decades (since I may need to rebuild the same software 10 years into the future). This is done through an HTTP-based service so I can fetch the result as if it were a tarball, and use all of the caching (by hash, see [0])as a result.

Release tarballs are VASTLY preferred for this reason.

Languages that try to "help" by circumventing this -- making reproducible builds into the future difficult -- have special helpers which go and fetch the resources (again, as serialized, checkable, hash-able objects) and make them available.

Some projects also attempt to download things from the Internet during the "build" phase of the project, so I created a tool to drop network access during that phase as well [1].

[0] https://hashcache.rkeene.org/ [1] https://chiselapp.com/user/rkeene/repository/bash-drop-netwo...