Release 1.0.17 missing

[PKizzle]

I stumbled upon a failure in a script today and found out it's due to libsodium's 1.0.17 release missing. What is the reasoning behind the removal of that version?

[jedisct1]

1.0.17 is not supported any more.

It's been moved to the old/unsupported directory. The last update to it was 5 years ago. so unless you have a support contract, using a more recent version wouldn't be a bad idea.

[PKizzle]

Okay, I was just wondering what happened as there is now a gap between 1.0.16 and 1.0.18 on the releases page. wal-g has been using that particular version of libsodium in one of their scripts but it seems there are already open PRs to fix the failing download.

[str4d]

The problem here is more specifically that the 1.0.17 tag, that was present in the repository for the past 5 years and is what the 1.0.17 GitHub release was tied to, has been deleted. I see that 4 days ago new tags 1.0.17-FINAL and 1.0.17-RELEASE were created, but those are not the same as the original 1.0.17 tag that build systems would have been expecting.

(I happened to encounter this issue myself just now, because 5 years ago when the update checker script was written for zcash/zcash, the latest release of libsodium was 1.0.17, and that's the tag our update checker script happened to use for verifying that it was seeing the expected tag format. We don't ourselves currently depend on 1.0.17 other than in this update checker, but older versions of the software obviously do.)

I also note that the GitHub releases used the 1.0.16 tag for that release, and likewise for all prior; these tags and GitHub releases still exist. Meanwhile, the 1.0.18 GitHub release uses tag 1.0.18-RELEASE, and likewise for all subsequent. So it's possible that the problem here was caused by a change in how release tagging was done in the time between the 1.0.17 and 1.0.18 releases. Maybe the release management scripts @jedisct1 is using (or whatever equivalent) were updated to also use the newer *-RELEASE convention, and didn't correctly handle the last non-*-RELEASE convention release?

In any case, for preserving the ability to build older versions of downstream dependencies, it would be useful to restore the 1.0.17 tag to its original state.

[jedisct1]

Tags without -RELEASE were not documented and were never intended to be used.

The GitHub releases were made on the -RELEASE tags, and what was documented is to use the tarballs or the stable branch.
Other tags or branches were just for development and I never expected people to use them.

Things should be a little bit more clear now. -RELEASE is when a new version is tagged, and -FINAL is that version with all the patches from stable before the next version was tagged.

[str4d]

Tags without -RELEASE were not documented and were never intended to be used.

Then I'm confused as to why the GitHub releases used tags without -RELEASE for every release prior to 1.0.18.

The GitHub releases were made on the -RELEASE tags, and what was documented is to use the tarballs or the stable branch.

That's... observably false? Here's the GitHub release page (with release notes) for 1.0.16, which uses the 1.0.16 tag: https://github.com/jedisct1/libsodium/releases/tag/1.0.16

The equivalent GitHub release page for 1.0.18 uses the 1.0.18-RELEASE tag: https://github.com/jedisct1/libsodium/releases/tag/1.0.18-RELEASE

And we can observe in the Wayback Machine that the GitHub release page for 1.0.17 did indeed use the 1.0.17 tag:

• https://web.archive.org/web/20190702182057/https://github.com/jedisct1/libsodium/releases
• https://web.archive.org/web/20200918034542/https://github.com/jedisct1/libsodium/releases/tag/1.0.17

[jedisct1]

Stable branch was introduced in 1.0.17.

Use tarballs or stable.

[travier]

The 1.0.20 tag is now missing as well. I used to exist according to https://release-monitoring.org/project/1728/, which is used by distributions and other projects (Flatpak) to track new releases of software.

What should we point our source to? To the -RELEASE tags only?

[jedisct1]

Use tarballs.

[travier]

OK. How do we automatically figure out the latest release if we can not use tags in this repo?

[jedisct1]

The LATEST.tar.gz link always points to the source code of the last stable version (same as the stable branch).

If you want to stick to version tags that are added from time to time to the stable branch, they are regular GitHub releases, so you can see they on the GitHub release link.
And to get the latest tag:

curl https://api.github.com/repos/jedisct1/libsodium/releases/latest | \
grep -E '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/'

I would personally never use them, and stick to stable instead. Or wait for the final version.