PSA: Don't use moving targets as release names

[kkaefer]

I noticed there are a few packages that use branch names, or something like latest as their release version. Please don't do this; mason doesn't automatically update those releases when the source code changes, so a latest package is outdated very quickly.

If you want to create a package that is not an actual release, please use a date and/or a commit hash as the version name, e.g. rapidjson 2016-07-20-369de87. While the commit hash is enough for uniquely identifying the release, adding a date means that it's easier for humans to figure out what the newest release is.

/cc @springmeyer @jfirebaugh @mikemorris @brunoabinader @rclark @flippmoke @artemp @mourner @morganherlocker @tmpsantos @mapsam @yhahn @lbud @danpat @ansis @bleege @bhousel @TheMarex @1ec5 @daniel-j-h @friedbunny @ajashton @BergWerkGIS @camillacaros @mapbox/cpp

[springmeyer]

The currently remaining packages with latest are below:

• icu/latest
• mapnik/latest
• minjur/latest
• osmium-tool/latest
• tippecanoe/latest
• valgrind/latest

Of those mapnik/latest is the only one I know that is auto-updating so all the others should be transitioned to be packages pinned to the latest released version of a gitsha.

[lightmare]

May I ask why the "moving target" build scripts were removed in response to this?

I understand why it's a bad idea to publish and/or depend on such package. That could've been prevented by removing their .travis.yml (or renaming to no.travis.yml to preserve that config), right?

What if I just want to ./mason build mapnik master locally? I have to git log --stat scripts/mapnik/ to figure out which of the hash-named directories is the most recent (1), copy and edit that. If there was a master/latest script, that would work out of the box, and you could also use it as the base for tagged version scripts (instead of what's the most recent hash).

(1) why noone followed @kkaefer's advice to use date with hash, or some other monotonic sequence, for example git describe