There are two conflicting 8.2.9 release tags

[MaxKellermann]

Description

From https://github.com/php/php-src
 ! [rejected]                php-8.2.9  -> php-8.2.9  (would clobber existing tag)

One release tag is 929138590b6ad6d873f274a138cf78f067988ad2 with a valid PGP signature by @saundefined:

tag php-8.2.9
Tagger: Sergey Panteleev <sergey@php.net>
Date:   Tue Aug 1 09:17:48 2023 +0300

Tag for php-8.2.9
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE5gkT5N8gmQfY4w2WZZqXyc8qeVoFAmTIo4wACgkQZZqXyc8q
eVr0IxAArnbMrji9MVbXbsGV2FRfXq2RCe+WhIYrz3KrvLrMd9CJQ2YQj20z6nIO
mJ7aecSGqdHcI8+Jokbdu5BAjIOn+tkl6gBoetHi5GJqGO93M1HPcFdahmvOOYqR
+WVd7n1HK0RAit5BU99TAbMoU5DVJWTS+Kn6pktp6jReNIAqmYZdacd1dn5HIhT+
X+A2n+5WGIEpItKEOQmjsSlubCYjDMCMe+tgM3kp7V6go+Q39hv2jtB7yryi6quH
3NyzBB0ATyKDF4FLtzYx85DzQIqAYDQfpBD4ngX9XZHRtJ1PbpMygiwHI87oTC1Y
+61+lL6BXEsR7UDXYy7gielL7Nw7/HdYGwJjmNaYvYUM+JYKRMVBs+NUFxi5xpOa
YrEfYSGJVEPQc+mGZ8FICuj3T66GxlJQEItGiSv1kvzohOhJ06ZlGV8ipS1RVK12
zL6m9SkWmZFHePLlovIL9yo8aCAfcAwZAummXOQ1BMoZbhdZmIk+nFjUq3a85MoX
AFMqoaDVtYFCbVyRtI2+aUdegC3yqdFxS2hlNG+MX/OzJSbFMiequJ6POwfJZAAy
OuDKq4Erew88xr5CHfTJonQNrLi4fl7EcS5YkipNV/FEVv84PmwvK2cfkJ2tDyEj
RojYxYBmqCeIi6++94AGQQN1sZIK4m0hLlnFbQuI01SECbRuMRQ=
=icSP
-----END PGP SIGNATURE-----

The other one is 68d09318be18c46d531c8b620807d9cdb1bd2e71 also with a valid PGP signature by @saundefined, and appeared today:

tag php-8.2.9
Tagger: Sergey Panteleev <sergey@php.net>
Date:   Thu Aug 3 14:37:04 2023 +0300

Tag for php-8.2.9
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE5gkT5N8gmQfY4w2WZZqXyc8qeVoFAmTLkWAACgkQZZqXyc8q
eVoHNxAApW0GgxIesKpfCg9u8K4gwR0rchoggsGEpuKkj7wSX1gCB92/FJe0MusJ
CMN2zBsz2N3eQhimK/4wQ+3yNTCchUMCDL72+fOKZ9+Ayq/bxY0gf2tqrpI1FEyA
G5DDp9jmT/l2IQzMVHLy0Zy/l6lFDuAejp3zsylzb3gsGRly1dKzt1lghvWQ57/n
EULEVP/OkjGsSdT5vlVae/WNmMjGc1HfFt52ZFqJ2FKABvo9MnxLW9n6Js6PuN4p
NkbmqYPfIHMiy9pjPMC0rd8awTbRCGWnenV59yKkU8N78cYuK4PaPUYHBAfGK2/7
Te8uVjlNthsf2n4giWkfLgV1Tfmx9x9RlUWvBBl8/wum+yL49smx/6cpWwG1zQS3
p6N+AN8LGS8R240aMTIb+LtlBDC/mrJonpoaOrul3X5vxQ52Wu3dDnWqq3LlNq/b
jff6CaSknzm6j2ylwzmxaxYe8I+r3EVs61prp36TE8fUSCv1e20sZhxWYkivdqQ1
b5egmT4ReAZ1ONtkD3M/RSDr19Xq8SeP7Y5vP2AtvoIVdRFX8ia2fIDyWGkMO9sd
DumW+1MH0rdDdA45/GyiAbjEOJS93m3VZ6B+97TeWKEg6X8GH7c3jujmT0cMvOOl
CFgyitlkxnihm6+qYCBfTWkJBHqfAUwRmLd0HUId2N5l521oMW8=
=1/D/
-----END PGP SIGNATURE-----

Something is seriously broken with the 8.2.9 release, and this will cause problems for all people who pull PHP from git - they will randomly use one or the other release, depending on whether they fetched between Aug 1st and Aug 3rd.

PHP Version

PHP 8.2.9

Operating System

No response

[saundefined]

@MaxKellermann PHP 8.2.9 was rebuilt today with #11854 regression fixes

[MaxKellermann]

I see, but you mustn't force-push a release tag. The 8.2.9 release was apparently borked, but by publishing a release tag, it's out and should have been fixed by doing PHP 8.2.10. Force-pushing an existing tag will cause a lot of trouble and is bad release management.

[GrahamCampbell]

depending on whether they fetched between Aug 1st and Aug 3rd.

People should never fetch from github (at least, not before php.net is updated) - php.net is the source of truth. It is common place for PHP releases to get re-tagged during regression testing or 11th hour feedback, and this is also why there is a delay of around 2 days before they show up on php.net. Pulling from github before releases show up on php.net as official is risky, as the releases are only provisional until they are final on php.net.

[MaxKellermann]

People should never fetch from github (at least, not before php.net is updated)

This is bad advice, because it's impossible to know when it is "safe" to pull from the git repository. If you happen to pull from git and you get a bad tag, you will have that bad tag forever (or until you fix it manually, because git won't). You will use a broken PHP release.
This way of using git is bad release management - and that's not just my taste and my opinion - it is bad release management because it breaks git repositories cloned by all users.

I'm appalled to see this was not an accident, but you guys believe this is the right way to do release management. If this were any other project, I'd do an RFC about this, but .... nevermind.

[saundefined]

because it's impossible to know when it is "safe" to pull from the git repository

People should be guided by the official release announcement.

If the announcement has already been made on php.net and on the relevant mailing lists, the tag will not be changed again and bugs will be fixed either in the next version or an additional patch-level version will be released (release process guide).

f this were any other project, I'd do an RFC about this

If it's really an inconvenience, you can just discuss it on the mailing list.

[GrahamCampbell]

This is bad advice, because it's impossible to know when it is "safe" to pull from the git repository.

Don't shoot the messenger. I'm just telling you what the reality is of the current release process.

[MaxKellermann]

because it's impossible to know when it is "safe" to pull from the git repository

People should be guided by the official release announcement.

I think you don't get my point. You have a limited perspective because you're the guy who creates tags, and you do know when it's safe to pull from this repository. But everybody else doesn't.

Let's say I pull today from PHP. Is that safe? I can't know. There is yesterday's announcement, but what if you meanwhile pushed another boken tag? I really can't know!

So I do "git pull", and I don't notice that a new tag gets fetched (because I'm busy with other things). Now this tag happens to be force-pushed later. But the broken tag remains in my clone forever.

Eventually, I want to use that tag - oh it's already there (and subsequent pulls didn't replace it, that's how git is designed) - and now I'm using a broken release.

Your way of doing release management means that I must always closely watch all new tags fetched by git, and then go to the PHP website and see if there's an announcement for that tag. If there's none, delete the tag. I pull again the day after, of course the same broken tag gets pulled again, and I must check the website again - still no announcement. Rinse, repeat.

If you disagree that this is what you expect users to do, describe how you believe it works.

If it's really an inconvenience, you can just discuss it on the mailing list.

Been there, done that.

Don't shoot the messenger. I'm just telling you what the reality is of the current release process.

I don't shoot anybody. And note that you didn't just tell me "what the reality is of the current release process", you gave advice what I should or shouldn't do, and I explained why that is bad advice, why it's impossible to follow.

[GrahamCampbell]

You need to look at php.net. It's a simple as that. I don't know what else to say.

[MaxKellermann]

You need to look at php.net. It's a simple as that. I don't know what else to say.

Okay, I'll bite (though I'm confident this won't lead anywhere, because you apparently don't understand the problem).
How does looking at php.net solve the problem I described in my previous post?

(Note: my description involves "look at php.net"; if you repeat just that, you don't contribute anything meaningful.)

(Edit: P.S. I was right, this didn't lead anywhere. Sigh.)

[saundefined]

How does looking at php.net solve the problem I described in my previous post?

Three versions were supposed to be released yesterday: 8.0.30, 8.1.22 and 8.2.9.

There is only one announcement (8.1.22) on php.net and on the mailing lists - you can safely pull it.
The other versions – formally not

[MaxKellermann]

How does looking at php.net solve the problem I described in my previous post?

Three versions were supposed to be released yesterday: 8.0.30, 8.1.22 and 8.2.9.

There is only one announcement (8.1.22) on php.net and on the mailing lists - you can safely pull it. The other versions – formally not

No. No again, really. That is not how git works. It seems you don't know how git works, and that may be causing this misunderstanding.

Any time I fetch/pull anything from php-src, all new tags get fetched into my local clone, including the ones that are broken and will be replaced eventually.

Even if I want to have only 8.1.22, git will fetch all the other tags.

Get it?

Now can we go back to the actual problem and you explain how you expect users to use php-src? Just saying "don't pull 8.2.9" doesn't work.

[GrahamCampbell]

I am going to unsubscribe since the discussion is not productive.