Re: [PATCH 7/8] Makefile: don't delete dist tarballs directly by name

From: Junio C Hamano <gitster@pobox.com>
Date: Nov 5, 2020, 23:05 UTC
Message-ID: <xmqqeel7h0aj.fsf@gitster.c.googlers.com>
In-Reply-To: <xmqqr1p7h38t.fsf@gitster.c.googlers.com>

Junio C Hamano <gitster@pobox.com> writes:

Show 28 quoted lines

> Ramsay Jones <ramsay@ramsayjones.plus.com> writes:
>
>> diff --git a/.gitignore b/.gitignore
>> index 6232d33924..425b8cc2a4 100644
>> --- a/.gitignore
>> +++ b/.gitignore
>> @@ -191,6 +191,7 @@
>>  /gitweb/static/gitweb.min.*
>>  /config-list.h
>>  /command-list.h
>> +/dist-tars
>>  *.tar.gz
>>  *.dsc
>>  *.deb
>> diff --git a/Makefile b/Makefile
>> index 90e91a2185..bc9ce28bc3 100644
>> --- a/Makefile
>> +++ b/Makefile
>> @@ -3083,6 +3083,7 @@ dist: git-archive$(X) configure
>>  		--prefix=$(GIT_TARNAME)/ HEAD^{tree} > $(GIT_TARNAME).tar
>>  	@$(RM) -r .dist-tmp-dir
>>  	gzip -f -9 $(GIT_TARNAME).tar
>> +	@echo $(GIT_TARNAME).tar.gz >>dist-tars
>
> Sorry, but I'd rather not to see such a longer-term "list of files
> to be removed" on the filesystem.  This invites attackers to write a
> rogue test addition that writes into ../../dist-tars something like
> "~/.gitconfig" and wait for me to say "make clean".

Having said that, I also think that "make clean" target should help your desire to keep tarballs that would not have been generated by the current checkout (e.g. the last release), and I do not think

	$(RM) git-htmldocs-*.tar.gz git-manpages-*.tar.gz

is an unconditionally better alternative to what you did in this step.

How about moving removal of these "distribution" artifacts that are created by "make dist$something" targets from "clean" to "distclean"?