The question is am I provided the build source that constructed these files. Mistral did not hand edit these files to construct them, there's source out there that built them.
Like, come on, a 14GB of a dump of mainly numbers that were constructed algorithmically are not "source".
Did you read all those lines yourself? Did you even confirm checksums matched before running them?
I think that's the parent's point. You can build from source, but how do you trust the source? Is it any more egregious to trust a prebuilt binary from a specific website than it is the raw source? If you can't trust the binary being hosted by the author/caretaker, can you really trust the source being hosted or maintained by the author/caretaker?
Yes, definitely source+build instructions should be uploaded rather than binaries.
You can still support proprietary software by just uploading the binaries as source (and maybe doing some build-process to adapt it to the packaging format)
If you don't have the source that produced those binaries your only choice is to have them downloadable from somewhere else (which is a real hassle for the developer) or just check them into the repo.
1. people should compile their own binary, since there is no easy way to know if you actually made only those edits in the provided binary (don't take it personally, really)
2. it's sad that Apple forked OpenSSH, since I can't have their integrations with a recent version
They say the binaries are being made under Apache 2.
They don't say anything about the source code being published. That's why (to me) this is so interesting. I've never seen binaries released without source code before.
The question is am I provided the build source that constructed these files. Mistral did not hand edit these files to construct them, there's source out there that built them.
Like, come on, a 14GB of a dump of mainly numbers that were constructed algorithmically are not "source".
reply