Issue on Google Sources

[luggesexe]

Hello,

Google provides several libs that are well used. Sadly Google does not have any type of concept of releases thus every commit is considered a stable release (rolling model).

Specifically I am looking at libyuv library (https://chromium.googlesource.com/libyuv/libyuv/).
For example there is a file in the repo (version) that has a custom string that has a some type version (1922).
Some distros have implementet a concept of having its own version number (such as 1922.DATEOFCOMMIT.COMMITCOUNT ON THIS DAY) (Debian f.e.).

This is important for tools such as Renovate to increment the version. Thus working with the raw commit id is not feasable.

We, over at StageX are using release-manager for our updates. I'd like to see if we have an option here to adress google's repositories.

Ideas we had:
Build this release version automatically using a git clone, defining the version string for every repo we encounter and do not update on every commit but rather once a week or something like this.

Do you have any idea?
It would be important to streamline this to also ensure other Distros use up to date versions of google libs and do not rely on manual updates.

[Zlopez]

Right now Anitya doesn't do any git operations and I would like to keep it that way. I assume this is more project specific how the releases are done. I don't know what we can do on our side if the project itself doesn't have any versions.

[satmandu]

We should really ask Google Devs to tag releases!

[luggesexe]

@satmandu yes that would be ideal.
AOMediaCodec/libavif#2071

Someone tried that already but never got a response from Google. If you have a direct contact I would highly encourage you to get Google to tag releases.

Otherwise, are there any alternatives? One could write a custom script out of a git operation but this could lead to an insecure update url possible. Even though I disagree with Googles approach, we are in need of a solution for packaging.

@Zlopez

[Zlopez]

I don't see any simple solution for this, tagging every commit as release is too much. Maybe better solution would be to find some other projects that is using this library and check the commits used on it and use those as releases for the project we would like to watch.

[luggesexe]

@Zlopez yes, libavif for example has a dependency on a specific commit
as seen here: https://github.com/AOMediaCodec/libavif/blob/main/ext/libyuv.cmd

How would this be implemented?

[Zlopez]

By using custom backend and regex to watch for the changes in this specific file.