mikeb added a new comment to an issue you are following: `` @kevin Every build contains a srpm which contains a tarball with all the sources, as they were checked out at the time of the build. If you want to reproduce something, you can rebuild that srpm or exact the tarball from it and inspect it. Why is this any worse than what we have today, with a tarball in the lookaside cache, with very little provenance. The download links for release tarballs can (and do) go away as well.
But in the common case, the dist-git repo will point to the upstream repo and commit, and a user can go to that repo and view the full history of the source that was built into the srpm. Isn't that a better experience than what we have today, when that chain of custody always ends at the tarball in our lookaside cache? ``
To reply, visit the link below or just reply to this email https://pagure.io/releng/issue/7498