[Caml-list] opam and versions

[Jon Ludlam <jonathan.ludlam@eu.citrix.com>]

Hi all,

Firstly I'd like to add another voice in support of opam - it's been a 
very pleasant experience using it despite it's beta status, and so many 
of the developers here have become dependent on it that we're changing 
our XenServer/XCP build system to build everything using it.

Before opam is officially announced (!) I'd like to raise an issue with 
versioning which people may like to consider. Currently opam has several 
ways of specifying the location of the source tarball for a package. By 
custom, the packages are broadly categorised into rapidly developing 
packages and stable packages. For rapidly developing packages, the 
source is often set to be a pointer to github to the master branch, 
often because no 'stable' version exists. For stable packages, the url 
is often a pointer to a tarball on the developers website, or sometimes 
a tagged release from github.

For our purposes, we need to be able to ensure that our builds are 
reproducible, and hence need to know exactly which versions are 
installed. We had hoped to achieve this by removing or disabling 
packages whose sources were got directly from a master branch in github. 
However, it turns out that some packages that are 'stable' are dependent 
upon these packages, which seems brittle. The question is how to fix it? 
Should the opam repository maintainers require that 'stable' packages 
aren't dependent on 'unstable' ones? Should opam itself be aware of the 
difference and enforce this policy? If someone really wants to release a 
stable version of their thing and it's dependent upon an upstream 
project with only a github repo, should the developer engage the 
upstream devs and request at least a tag, or should they make their own 
tarball/github fork?

Many of these questions are social rather than technical, hence I'm 
posting to the general ocaml list.

Cheers,

Jon