Then you need to rethink your build procedures, seriuosly. If you've
bothered to do a Subversion checkout, building a tarball with "tar czf
---exclude=.svn" of the  checked out copy is trivial. If you're SRPM's
do not include a tarball for a significantly sized source, you're
usually doing something wrong: building RPM's from SRPM's that do not
contain source is highly discouraged, and should be only used for
packages where licensing reasons prevent the inclusion of the actual
source code.

There are source control systems that can authenticate and verify the
upstream repository, but without this, you're completely reliable on
the upsteram source repository's security and authenticity for
rebuilding your RPM's. That's a fairly unfortunate practice.

Reply via email to