{"id":6875,"date":"2015-10-21T20:31:39","date_gmt":"2015-10-22T00:31:39","guid":{"rendered":"http:\/\/esr.ibiblio.org\/?p=6875"},"modified":"2015-10-23T23:58:35","modified_gmt":"2015-10-24T03:58:35","slug":"are-tarballs-obsolete","status":"publish","type":"post","link":"http:\/\/esr.ibiblio.org\/?p=6875","title":{"rendered":"Are tarballs obsolete?"},"content":{"rendered":"<p>NTPsec is preparing for a release, which brought a question to the forefront of my mind. Are tarballs obsolete?<\/p>\n<p><!--more--><\/p>\n<p>The center of the open-source software-release ritual used to be making a tarball, dropping it somewhere publicly accessible, and telling the world to download it.<\/p>\n<p>But that was before two things happened: pervasive binary-package managers and pervasive git. Now I wonder if it doesn&#8217;t make more sense to just say &#8220;Here&#8217;s the name of the release tag; git clone and checkout&#8221;.<\/p>\n<p>Pervasive binary package managers mean that, generally speaking, people no longer download source code unless they&#8217;re either (a) interested in modifying it, or (b) a distributor intending to binary-package it. A repository clone is certainly better for (a) and as good or better for (b).<\/p>\n<p>(Yes, I know about source-based distributions, you can pipe down now. First, they&#8217;re too tiny a minority to affect my thinking.  Secondly, it would be trivial for their build scripts to include a clone and pull.)<\/p>\n<p>Pervasive git means clones are easy and fast even for projects with a back history as long as NTPsec&#8217;s. And we&#8217;ve long since passed the point where disk storage is an issue.<\/p>\n<p>Here&#8217;s an advantage of the clone\/pull distribution system; every clone is implicitly validated by its SHA1 hash chain. It would be much more difficult to insert malicious code in the back history of a repo than it is to bogotify a tarball, because people trying to push to the tip of a modified branch would notice sooner.<\/p>\n<p>What use cases are tarballs still good for?  Discuss,,,<\/p>\n","protected":false},"excerpt":{"rendered":"<p>NTPsec is preparing for a release, which brought a question to the forefront of my mind. Are tarballs obsolete?<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[49,24],"class_list":["post-6875","post","type-post","status-publish","format-standard","hentry","category-software","tag-ntp","tag-open-source","entry"],"_links":{"self":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts\/6875","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6875"}],"version-history":[{"count":4,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts\/6875\/revisions"}],"predecessor-version":[{"id":6879,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts\/6875\/revisions\/6879"}],"wp:attachment":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6875"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6875"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6875"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}