On 23/10/2026 21:53, Anthony Martin wrote:
Below is a list of packages that can't be built because their PKGBUILD files list checksums that do not correspond to the available source files. Can someone please clarify how these packages were built and where the checksums came from?
Clearly, when they were built, their checksums corresponded to the ones listed in the PKGBUILD. The hashes changed over time.
Hard to tell the reason without checking one by one, but I have seen this in the past with tarballs from GitHub, for example. Sometimes GitHub regenerates the tarballs from a tag or release. Patches taken from a GitHub PR (just adding .patch to the URL) can also change if that branch is modified. These are just two examples of non-malicious activity that can change the checksums of the sources with respect to the original ones in the PKGBUILD.
-- Iyán Méndez Veiga GPG Key: 204C 461F BA8C 81D1 0327 E647 422E 3694 311E 5AC1
OpenPGP_signature.asc
Description: OpenPGP digital signature
