Hacker News new | ask | show | jobs
by naikrovek 1239 days ago
this is a git behavior, not a GitHub behavior.

files uploaded to GH Packages are not modified by GitHub.

only the "Source Code (.zip)" and "Source Code (.tgz)" files that are part of releases and tags are affected because git generates them on demand, and git does not guarantee hash stability.

if you upload a package to GH Packages or upload a release asset to a GitHub releases those are never modified, and you can rely on those hashes.
1 comments
philipwhiuk 1239 days ago
No, it's not.

GitHub chooses to do this. It's GitHub's choice to generate Source Code files on demand rather than when the release is made. It's a way of reducing their disk usage at the cost of this kind of potential problem.

The problem is they also presented it as if it was a stable reference. If people knew it was not stable they would have done what the Bazel devs are now talking about doing, which is also uploading the source code at release time, as an artifact (which is how it works on Nexus).

link
naikrovek 1239 days ago
> The problem is they also presented it as if it was a stable reference.

how? the docs state that the hashes of these files are not guaranteed to be stable.

the decision to generate those files on demand is a good one, provided that the behavior is documented, and it is.

others in this thread figured it out before this particular issue arose and made the necessary changes to their workflows so that their downloads would have stable hashes.

link