Re: [PR REVIEW] New package: zam-plugins-3.14

[Logarithmus <Logarithmus@users.noreply.github.com>]

[-- Attachment #1: Type: text/plain, Size: 1493 bytes --]

New review comment by Logarithmus on void-packages repository

https://github.com/void-linux/void-packages/pull/31665#discussion_r659348039

Comment:
> It should be possible to download tarballs for all submodules or ask them to publish useful tarballs. Cloning a branch name is susceptible to force pushes and you should use commit hashes instead.

There isn't any difference between shallow-cloning a tag vs. downloading it in a tarball.
Specially for this case I've just conducted a little experiment to proof that force pushing doesn't alter a commit hash to which tag points to: https://github.com/Logarithmus/test-tag-force-push

> If there are too many submodules, reconsider if this is really packageable.

I don't really see why having submodules is an issue for being packageable. And please don't insist it's a distro policy to have no submodules. There are too many hidden "distro policies", don't you think? Why those policies are nowhere documented? Please, put them into `CONTRIBUTING.md` to avoid further misunderstandings.

AFAIK this package has a single submodule, which makes your complaints even more irrelevant.

Yes, surely it's possibly to manually extract commit hashes of each submodule and hardcode them into `template` file and then also manually correct them after each new version is released, but why do this unneded manual work if you can just assign it to `git`?

And AFAIK GitHub doesn't allow you to download a tarball for an arbitrary commit.