mikeb added a new comment to an issue you are following: `` Creating the tarball directly from git actually gives you *better* auditability, because it removes the human from the process. You can look at the tarball and know (based on naming) exactly what git commit it came from, and trace the history from there. With a release tarball, you don't know what the person did to generate it, or exactly what commit it was based on. You only have a release number, which may or may not correlate to a git tag and/or branch.
If maintainers of other SCMs want to opt-in to this approach, we could investigate adding support for those SCMs as well. Most SCMs have the ability to generate tarballs from a commit. ``
To reply, visit the link below or just reply to this email https://pagure.io/releng/issue/7498