mirror of
https://github.com/flatpak/flatpak.git
synced 2026-01-24 15:48:18 -05:00
2aed100945
This makes the flatpak project more self-contained, and would have avoided the problems we encountered with unintended changes in the 1.14.7 release. See <https://diziet.dreamwidth.org/14666.html> for an opinionated description of some of the problems with submodules. If we can eliminate submodules altogether, then it will become possible to build Flatpak from a simple `git clone` or `git archive`, or from the source tarballs auto-generated by Github (which are equivalent to a `git archive`), without needing an extra step to populate the submodules. As well as reducing the support burden from users periodically complaining that our source releases are incomplete, this is a useful "nothing up my sleeve" mechanism to make it easy to verify that our source releases do not contain malicious changes hidden in vendored or generated files, like the one that made CVE-2024-3094 possible. Added with: git remote add --no-tags libglnx https://gitlab.gnome.org/GNOME/libglnx.git git fetch libglnx git subtree add -P subprojects/libglnx202b294e60git commit --amend -s To compare with upstream: git remote add --no-tags libglnx https://gitlab.gnome.org/GNOME/libglnx.git git fetch libglnx git diff HEAD:subprojects/libglnx libglnx/master After checking the diff, updates can be merged into this project with: git subtree merge -P subprojects/libglnx libglnx/master git commit --amend -s The commit merged here is the same one that was previously a submodule. A subsequent commit will update it to the latest version of libglnx, demonstrating how to review such updates. git-subtree-dir: subprojects/libglnx git-subtree-mainline: 7df25d63dfde9b4755479950f5b87bafe85cd277 git-subtree-split:202b294e60Signed-off-by: Simon McVittie <smcv@collabora.com>