github vs. www.imagemagick.org source download

[sassy-crick]

Dear all,

I am using Easybuild to install software and I have noticed that some of the source files are not here:
https://www.imagemagick.org/download/releases/
but I can download them from github:
https://github.com/ImageMagick/ImageMagick/archive/

However, this is only part of the problem as for example version 7.0.7-30 has different sha256 checksums depending on where you download it.
Downloaded from here:
https://www.imagemagick.org/download/releases/
gave
8d3aca87b13dc1c17d28f83326201529e5a2936e9b8ee289377a247c615f272c'
But downloaded from here:
https://github.com/ImageMagick/ImageMagick/archive/
gave
dd98d9e1bab678b7e86b292b7903b2f357d01a5ee4932883d816cebea5d43c94

Any suggestions?

I do apologise if the Developers' branch might be the wrong one but I thought it is closer to development than to the usual questions users have.

Thanks for your help!

Jörg

[magick]

There is no ImageMagick version 7.0.7-30 @ https://www.imagemagick.org/download/releases/. Instead there is a 7.0.7-39. There is no such link as https://github.com/ImageMagick/ImageMagick/archive/.

[boegel]

ImageMagick 7.0.7-30 was tagged on GitHub on May 2nd 2018 (see https://github.com/ImageMagick/ImageMag ... r=7.0.7-38).

https://github.com/ImageMagick/ImageMagick/archive/ doesn't list all possible downloads, but does serve tarballs for specific versions, like https://github.com/ImageMagick/ImageMag ... -30.tar.gz .

The problem here is that i) 7.0.7-30 was available via https://www.imagemagick.org/download/releases/ at some point, but then disappeared, and ii) the source tarball from GitHub that corresponds with the 7.0.7-30 tag is not the same as the one that could be downloaded at some point via https://www.imagemagick.org/download/releases/.

Can this be clarified? Is it OK for us to download directly from GitHub? And if so, what are the differences between the tarballs served by GitHub, and then ones served by https://www.imagemagick.org/download/releases/ ?

[magick]

The authoritative signed releases of ImageMagick are found @ https://www.imagemagick.org/download/releases/. Be sure to verify by checking the ggp signature in their respective *.asc file. You can also check the SHA256 hash in the digest.rdf file. We can only vouch for any other archive of ImageMagick releases if their gpg signature (*.asc) and hash match (digest.rdf).

[sassy-crick]

Dear all,

apologies for the wrong link. That was my wrong when I posted the URL for the tarball (minus the actual tarball) when I should have posted the link for the web-page, which is:
https://github.com/ImageMagick/ImageMag ... r=7.0.7-37
I hope that clarifies this.

However, and here I agree with boegle, the issue is that the tarball was available at
https://www.imagemagick.org/download/releases/

but it is no longer. Regardless of Easybuild or not, I find that odd that first you can download something and then it disappears from one site but a file with the same name appears on github (with a different checksum).
It makes it difficult to build and maintain software stacks across a large institution.

I am simply trying to get to the bottom of this and how to avoid this problem in the future.

Thanks!

[dlemstra]

The assets of the github releases are automatically created. They are created when we tag a commit. The ones that we have available as a download on our own site could differ.

[boegel]

OK, so it's clear that the source tarballs available via https://www.imagemagick.org/download/releases/ are strongly preferred over the ones on GitHub.

Can you please avoid removing releases from that location then?
Since you're basically forcing people to resort to other download sources if they need an older release...

And maybe also upload the signed source tarballs on GitHub, for each tag, but I consider that optional.

[fmw42]

See https://imagemagick.org/download/releases/ for older source code.

[boegel]

@fmw42: The source tarball for 7.0.7-30 is no longer available there, there's only 7.0.-39...

[fmw42]

IM only stores every 10th version. At least that was in the past before the numbering started going past .10

[fmw42]

See https://launchpad.net/imagemagick/main for more source code versions.

[boegel]

@fmw42 That's helpful, via that way the original source tarball for 7.0.7-30 can indeed be obtained (see https://launchpad.net/imagemagick/main/7.0.7-30/, same SHA256 checksum).

However, newer versions are not available via that way anymore?
For example 7.0.8-10 (which is not available via https://www.imagemagick.org/download/releases/ either btw...).

[fmw42]

Sorry. I do not know how launchpad.net obtains the ImageMagick releases. Perhaps the IM developer can comment. Or you might contact launchpad.net and ask them.