You are not logged in.
Hi, I just noticed a behaviour that seems strange/inconsistent to me. With "source=(git+$url.git)", e.g., this PKGBUILD (zapzap-git from AUR):
pkgname=zapzap-git
_pkgname=com.rtosta.zapzap
pkgver=5.2.1.r7.g5abbce3
pkgrel=1
pkgdesc="WhatsApp desktop application written in Pyqt6 + PyQt6-WebEngine"
arch=('x86_64')
url="https://github.com/zapzap-linux/${pkgname%-git}"
license=('GPL3')
depends=('python-pyqt6' 'python-pyqt6-webengine' 'dbus-python' 'qt6-wayland' 'python-jaraco.text' 'python-inflect' 'python-pydantic>=1.9.1' 'python-typing_extensions>=4.6.1')
makedepends=('git' 'python-build' 'python-installer' 'python-setuptools>=40.8.0' 'python-wheel' 'desktop-file-utils')
optdepends=(
'hunspell: spell check'
)
provides=("${pkgname%-git}")
conflicts=("${pkgname%-git}")
source=(git+$url.git)
b2sums=('SKIP')
pkgver() {
cd "${pkgname%-git}"
git describe --long --tags | sed 's/^foo-//;s/\([^-]*-g\)/r\1/;s/-/./g;s/^v//'
}
build() {
cd ${pkgname%-git}
python -m build --wheel --no-isolation
}
package() {
cd ${pkgname%-git}
python -m installer --destdir="$pkgdir" dist/*.whl
install -Dm644 share/icons/$_pkgname.svg "$pkgdir"/usr/share/icons/hicolor/scalable/apps/$_pkgname.svg
install -Dm664 share/applications/$_pkgname.desktop "$pkgdir"/usr/share/applications/$_pkgname.desktop
install -Dm664 share/metainfo/$_pkgname.appdata.xml "$pkgdir"/share/metainfo/$_pkgname.appdata.xml
}
It generates a SKIP checksum:
$ makepkg -g
==> Retrieving sources...
-> Updating zapzap git repo...
==> Generating checksums for source files...
b2sums=('SKIP')
However, if we add a tag to the git source, "source=(git+$url.git#tag=5.2.1)", like this:
pkgname=zapzap-git
_pkgname=com.rtosta.zapzap
pkgver=5.2.1.r7.g5abbce3
pkgrel=1
pkgdesc="WhatsApp desktop application written in Pyqt6 + PyQt6-WebEngine"
arch=('x86_64')
url="https://github.com/zapzap-linux/${pkgname%-git}"
license=('GPL3')
depends=('python-pyqt6' 'python-pyqt6-webengine' 'dbus-python' 'qt6-wayland' 'python-jaraco.text' 'python-inflect' 'python-pydantic>=1.9.1' 'python-typing_extensions>=4.6.1')
makedepends=('git' 'python-build' 'python-installer' 'python-setuptools>=40.8.0' 'python-wheel' 'desktop-file-utils')
optdepends=(
'hunspell: spell check'
)
provides=("${pkgname%-git}")
conflicts=("${pkgname%-git}")
source=(git+$url.git#tag=5.2.1)
b2sums=('SKIP')
pkgver() {
cd "${pkgname%-git}"
git describe --long --tags | sed 's/^foo-//;s/\([^-]*-g\)/r\1/;s/-/./g;s/^v//'
}
build() {
cd ${pkgname%-git}
python -m build --wheel --no-isolation
}
package() {
cd ${pkgname%-git}
python -m installer --destdir="$pkgdir" dist/*.whl
install -Dm644 share/icons/$_pkgname.svg "$pkgdir"/usr/share/icons/hicolor/scalable/apps/$_pkgname.svg
install -Dm664 share/applications/$_pkgname.desktop "$pkgdir"/usr/share/applications/$_pkgname.desktop
install -Dm664 share/metainfo/$_pkgname.appdata.xml "$pkgdir"/share/metainfo/$_pkgname.appdata.xml
}
It generates a real checksum instead:
$ makepkg -g
==> Retrieving sources...
-> Updating zapzap git repo...
==> Generating checksums for source files...
b2sums=('36c3e6c20979a6fb35132c4e6c25436ad86e65fc52e9be71ff1042102e50f09c1c4e09c22647397ce94c40f35fa55b3f5dab9a1a9a4941e2902ba4cf6f541c76')
Is it a bug, or is there a reasoning behind such behaviour?
Thanks!
Last edited by alllexx88 (2024-04-01 09:02:04)
Offline
I will try to answer my own question
Providing a tag/commit points/should point to a fixed version, thus generating/checking the checksum make sense, while pointing to a HEAD of a branch can checkout files of a different (newer) state than the files at the moment of committing/pushing the PKGBUILD, thus we would either need to skip the checksum check (as it is now), or do something smarter, like updating the checksum automatically when pkgver() generates a new version.
Offline
This is the correct answer!
Offline
Thank you Allan!
Offline
Some more info for anyone who may be as baffled with this new and quite confusing to a long-time AUR maintainer, but otherwise very nice and useful, behavior as I was before I found my way to this very helpful thread:
As I understand it, this is a recent(ish) change introduced with pacman 6.1.0: "Add checksum support for git/mercurial/bzr sources".
The relevant commit (for git; and there could also be more commits that supplement the functionality) is 2fc2ab6cf0fbb93e1b3182a1997d3c9ffc9fc0fd: "makepkg: immutable git sources by hashing the checkout content".
The checksum is produced via git-archive, so if you so desire you can manually reproduce it with the following snippet (taken from the above commit):
git -c core.abbrev=no -C "<source_dir>" archive --format tar "<commit_hash|tag_name>" | "<hash_type>sum" 2>&1
Offline
Thank you for the additional info Nocifer! Also worth noting that some Archlinux derivatives (Manjaro for once) haven't yet upgraded pacman to 6.1.0, and people coming from such distros have errors when trying to verify checksums for relevant immutable git sources, as it was reported on zapzap AUR package comments. Until all distros upgrade to 6.1.0+, it's helpful to add a note about using "--skipchecksums" flag in such cases.
Offline
Maybe the ARCH User Repository should focus on supporting ARCH Linux and not worry about other distributions!
Offline
Sure, you're right Allan, that is the reason why I didn't remove the checksum in zapzap package. However, receiving error reports due to those other distributions is distracting, so a note is a good thing, just IMHO
Offline