ALT Sisyphus: dsd-1.7.0 version abuse

[blshkv]

ALT Sisyphus: dsd-1.7.0 version abuse

[AMDmi3]

FYI, rules are now in the separate repo, so rule issues are better to be opened there

This is yet an another example why I suggested to verify upstream version number.
Do you think you could use http://release-monitoring.org with their fedmsg notification system to retrieve the latest version?

Definitely not release-monitoring, I couldn't even added it as another source because of project naming discrepancies and probably other problems I no longer remember. Also, relying on a single third party resource defies the purpose of repology. In addition, they only support less than 10% of projects known to repology and do not seem to be actively developed.

The strict verification is impossible in general, even if we monitor upstream ourselves (which is actually planned), because there are a lot of cases where there's no upstream, upstream changes location, upstream is superseded by another upstream, upstream switch releases from tags to tarballs and vice versa, there's no place to look for new releases at upstream etc. And we don't want to hide all the latest version everyone already use just because we are unable to "verify" them.

What we can do though is to use data we already have and just require a new version to appear in different sources to be "verified". And we already have rudimentary support for this. Of course there's always a tradeoff between unverified data with more false positives and verified data which is incomplete, and it should stay this way as it's up to a user to choose.

Also the problem with RPM based distros is known (#575) and their handling can still be improved.

[blshkv]

Ok, understood and agreed. Thank you for the detailed explanation