I just needed to install a project from a VCS reference (for Python 3.13 compatibility reasons), and it highlighted some of the tricky problems that arise with building directly from source trees. This particular project uses versioneer, which meant that:
- building from a
git+httpsreference produced a comprehensible version, being the last tagged release, plusgit describeinfo in a local version identifier. - building the GitHub source export of the same commit instead produced a nominal version of
0+unknown, since the VCS commit metadata doesn’t exist in the exported archive
However, using the VCS reference instead of the source export results in problems with checking input artifact hashes.
Static metadata in the tree wouldn’t really have fixed that - instead, both reference approaches would report whatever last nominal version had been recorded in the project metadata files (hopefully something somewhat meaningful like X.Y.Z.dev0, which is what I bump my static versions to immediately after a release, but there’s no guarantee the build wouldn’t claim to be an unmodified copy of the last actual release if the project’s maintainers didn’t routinely do an immediate post-release bump to a dev or alpha build version number).