[aur-general] AUR4 refuses to accept *any* commit that doesn't have a .SRCINFO

[Jiachen Yang]

IMHO, the ability to run complex script to generate metadata in PKGBUILD is
important.
Consider the pkgver field for most VCS packages (ex. -git ones) that use
VCS command
with text manipulation tools (sed, awk, etc.) to extract current version
from VCS repositories.
The corresponding field in the .SRCINFO file is only the execution output
of PKGBUILD,
but not the duplication of information already in PKGBUILD.

In the other hand, running arbitrary commands in user uploaded PKGBUILD on
aur server may be insecure. Therefore we have users to run their PKGBUILD
on their machines to extract the .SRCINFO and then upload .SRCINFO together
with PKGBUILD to the aur server.

On Tue, May 26, 2015 at 12:56 PM, Kyle <kyle at gmx.ca> wrote:

> I can see that .SRCINFO is completely different from the fields in
> PKGBUILD after all. It isn't just the spaces left and right of the =
> sign as I first thought. Apparently it doesn't show arrays in the same
> way either, instead putting the same key on multiple lines with one
> value per key. So this isn't exactly as trivial as I thought, although I
> still think there would have to be a way to keep from having to
> duplicate metadata, but as long as there is something that can take the
> info from the PKGBUILD and generate the file, it isn't really a big
> problem.
> Sent from the horns of a goat
> --
> "Don't judge my disability until you are able to see my ability."
> ~Kyle: https://kyle.tk/
> My chunk of the internet: https://chunkhost.com/r/Kyle
>



-- 
--------------------------------------------------------------------------------
Jiachen Yang 楊嘉晨
Graduate School of Information Science and Technology, Osaka University
Tel:   080-3853-2770
MSN:   firechildren at hotmail.com
GMail: farseerfc at gmail.com