[psa-crypto] Re: Question about tag names

On 01/08/2025 14:15, Andrea Pappacoda wrote:

Since we are talking about Git tags and releases: is it acceptable to start packaging from Git tags exclusively (i.e., not using the provided .tar.bz2)? In my packaging, I want to generate the auto-generated files from scratch (which, given the wide range of software which can be used during Debian package builds, is not an issue).

It's better to use the git tags, in fact. They're inherently fairly protected against tampering, unlike archives. GitHub doesn't track the history of releases or their attachments.

-- Gilles