From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Original-To: caml-list@sympa.inria.fr Delivered-To: caml-list@sympa.inria.fr Received: from mail1-relais-roc.national.inria.fr (mail1-relais-roc.national.inria.fr [192.134.164.82]) by sympa.inria.fr (Postfix) with ESMTPS id D9C717EDEE for ; Mon, 22 Oct 2012 15:42:20 +0200 (CEST) Received-SPF: None (mail1-smtp-roc.national.inria.fr: no sender authenticity information available from domain of jonathan.ludlam@eu.citrix.com) identity=pra; client-ip=66.165.176.89; receiver=mail1-smtp-roc.national.inria.fr; envelope-from="Jonathan.Ludlam@eu.citrix.com"; x-sender="jonathan.ludlam@eu.citrix.com"; x-conformance=sidf_compatible Received-SPF: Pass (mail1-smtp-roc.national.inria.fr: domain of Jonathan.Ludlam@eu.citrix.com designates 66.165.176.89 as permitted sender) identity=mailfrom; client-ip=66.165.176.89; receiver=mail1-smtp-roc.national.inria.fr; envelope-from="Jonathan.Ludlam@eu.citrix.com"; x-sender="Jonathan.Ludlam@eu.citrix.com"; x-conformance=sidf_compatible; x-record-type="v=spf1" Received-SPF: Pass (mail1-smtp-roc.national.inria.fr: domain of postmaster@SMTP.CITRIX.COM designates 66.165.176.89 as permitted sender) identity=helo; client-ip=66.165.176.89; receiver=mail1-smtp-roc.national.inria.fr; envelope-from="Jonathan.Ludlam@eu.citrix.com"; x-sender="postmaster@SMTP.CITRIX.COM"; x-conformance=sidf_compatible; x-record-type="v=spf1" X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Al4BAEBMhVBCpbBZlGdsb2JhbABFwRAjAQEBAQkLCQkUBSKCIj1APRYYAwIBAgE/DA0IAQGIAJpUoHSPK4MjA4glkzCNRQ X-IronPort-AV: E=Sophos;i="4.80,629,1344204000"; d="scan'208";a="178351381" Received: from smtp.citrix.com ([66.165.176.89]) by mail1-smtp-roc.national.inria.fr with ESMTP/TLS/RC4-SHA; 22 Oct 2012 15:42:19 +0200 X-IronPort-AV: E=Sophos;i="4.80,629,1344211200"; d="scan'208";a="42011229" Received: from ftlpmailmx02.citrite.net ([10.13.107.66]) by FTLPIPO01.CITRIX.COM with ESMTP/TLS/RC4-MD5; 22 Oct 2012 13:42:17 +0000 Received: from [10.80.118.170] (10.80.118.170) by FTLPMAILMX02.citrite.net (10.13.107.66) with Microsoft SMTP Server id 8.3.279.1; Mon, 22 Oct 2012 09:42:16 -0400 Message-ID: <50854D34.4000301@eu.citrix.com> Date: Mon, 22 Oct 2012 14:42:12 +0100 From: Jon Ludlam User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20120912 Thunderbird/15.0.1 MIME-Version: 1.0 To: Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit X-Validation-by: jonathan.ludlam@eu.citrix.com Subject: [Caml-list] opam and versions Hi all, Firstly I'd like to add another voice in support of opam - it's been a very pleasant experience using it despite it's beta status, and so many of the developers here have become dependent on it that we're changing our XenServer/XCP build system to build everything using it. Before opam is officially announced (!) I'd like to raise an issue with versioning which people may like to consider. Currently opam has several ways of specifying the location of the source tarball for a package. By custom, the packages are broadly categorised into rapidly developing packages and stable packages. For rapidly developing packages, the source is often set to be a pointer to github to the master branch, often because no 'stable' version exists. For stable packages, the url is often a pointer to a tarball on the developers website, or sometimes a tagged release from github. For our purposes, we need to be able to ensure that our builds are reproducible, and hence need to know exactly which versions are installed. We had hoped to achieve this by removing or disabling packages whose sources were got directly from a master branch in github. However, it turns out that some packages that are 'stable' are dependent upon these packages, which seems brittle. The question is how to fix it? Should the opam repository maintainers require that 'stable' packages aren't dependent on 'unstable' ones? Should opam itself be aware of the difference and enforce this policy? If someone really wants to release a stable version of their thing and it's dependent upon an upstream project with only a github repo, should the developer engage the upstream devs and request at least a tag, or should they make their own tarball/github fork? Many of these questions are social rather than technical, hence I'm posting to the general ocaml list. Cheers, Jon