May 2024: whatsrc.org distro status

[Richard Purdie]

On Wed, 2024-05-29 at 18:38 +0200, kpcyrd wrote:
> Dear list,
> 
> As of May 2024, I have imported source code data from the following 
> distributions:
> 
> - Alpine Linux edge
> - Arch Linux
> - Debian sid, stable, stable-updates, stable-backports, stable-
> security
> - Fedora rawhide
> - Gentoo
> - Guix
> - Homebrew
> - Kali Linux Rolling
> - openSUSE Tumbleweed
> - Ubuntu 24.04 (jammy, jammy-updates, jammy-security, jammy-
> backports)
> - Void Linux
> - WolfiOS
> 
> In total, at the time of writing, I've collected and indexed 224,790 
> unique source code archives, and 33,193 dependency lockfiles 
> (Cargo.lock, go.sum, package-lock.json, ...).
> 
> Think of this as "myspace for source code", you can check which 
> operating systems a specific tar-file is friends with.
> 
> Or, put differently, each operating system gets a vote what they 
> consider the source code for a given software release.

There is such data in Yocto Project too, although it would be spread
into the layers that contain the software components in question.

Taking bash as an example, you can see information from the layer
index:

https://layers.openembedded.org/layerindex/recipe/81/

which doesn't list the checksum but does point at the recipe:

https://git.openembedded.org/openembedded-core/tree/meta/recipes-extended/bash/bash_5.2.21.bb?h=master

which does list it:

SRC_URI[tarball.sha256sum] = "c8e31bdc59b69aaffc5b36509905ba3e5cbb12747091d27b4b977f078560d5b8"

Ours tools parse and validate the sources match the checksums or we use
specific git (or other source control) revisions. I'm wondering if
there is interest in exporting that information for comparision
somehow...

Cheers,

Richard