Repository navigation
Sources of binaries?, Architecture-sensitive installation? #34
Description
This bundles binary libraries.
But what is their source?
Please bundle their source (and build recipe), or link to their source.
Also, installing this python module installs binary libraries for all architectures, not just for the one where this module is installed. This is useless bloating. Please make the installation procedure architecture-sensitive by only installing libraries for the current architecture.
I have made ↗ an Arch Linux package, where I have tackled the second part by a workaround by deleting the libraries not suiting.
Regards!
Activity
acheong08 commentedon Feb 15, 2023
Source of binaries is https://github.com/bogdanfinn/tls-client. The hashes matched
acheong08 commentedon Feb 15, 2023
The source is linked in the readme
dreirund commentedon Mar 16, 2023
Suggestion:
Split source code repository and distribution of prebuilt library binaries.
So that a repository clone is smaller, and users are not confused whether prebuilt binaries are always up to date with souce code.
Having large binaries in version control also is not a good idea.
And prebuilt binaries are available via separate download URL. (For people who do not want to compile them but to install them precompiled, you can link to the original place, then it is made sure that they are always up to date.)
My Arch Linux package actually does depend on the original project, and compiles the libraries from source, and does not use any precompiled stuff. You can use it as inspiration for documentation/ automation scripts for "lazy people".
Regards!
Note: I have filed a similar request of splitting prebuilt libraries and source code at the original source bogdanfinn/tls-client.
Pin library checksums in SHA256SUMS and document where the libraries …
FlorianREGAZ commentedon Oct 10, 2026
Both parts of this are now done:
scripts/fetch_library.pydownloads them from the upstream release and checks each one against a pinned SHA-256, andtls_client/dependencies/SHA256SUMSships in every wheel so an installed library can be verified (Fix 32-bit Linux and Raspberry Pi loading, load the library lazily, document binary provenance #158).Thanks for the Arch package and the suggestion!