Arch Linux User Repository

@Lamanator I can't help but notice that I never bumped this package for a Python 3.13 rebuild. Could it be that you've had Bottles installed but not used it for the past couple of months or so, and your issue is simply that the icoextract installed on your system hasn't been rebuilt against Python 3.13? Can you verify if it works for you after the update I just pushed?

I guess this is exactly why the Bottles devs don't care to officially support anything other than their Flatpak version.

This package no longer works if you're using the bottles package since the icoextract package cannot be imported in Python.

When running icoextract on the terminal, it will spit out this error: ModuleNotFoundError: No module named 'icoextract'

Can I have co-maintainer, please?

I'll help maintain this package and also add an .nvchecker.toml.

~~Please can you rename the package to python-icoextract like chapter 1 in https://wiki.archlinux.org/title/Python_package_guidelines?~~

Ignore my comment. It looks that this tool is a standalone app, isn't it?

@yochananmarqos Until a couple of years ago I used to prefer using git tags rather than source tarballs in all my packages, until some user(s) complained about the extra storage space and bandwidth required when using tags, so I switched over to tarballs.

I too would like to utilize that extra robustness of PGP keys, and this is in my opinion a good counterargument to said user(s) (because security >>> a few kB or mB of temp storage), so I'll see to it in the near(-ish) future that I switch back to tags again and add PGP verification in the process. Thanks for the suggestion.

@Nocifer: By adding developer PGP keys, it increases the security and validity of the package. I do that in my AUR packages whether it's a signed commit, tag or tarball. It's up to you if you want to make the change, of course.

In this case, the tarball does not have a matching signature file; i.e, .tar.gz.asc.

Hey @yochananmarqos, I'd be happy to do that if there is a good reason for it, otherwise for the time being I'd prefer if I avoided switching to a git-based process. AFAIK Github's source archives are generated on the fly from the actual source code, so there's no chance of any xz-like shenanigans in our case. Is there a way to use Github's GPG verification with source archives of commits instead of the commits themselves?

@Nocifer: Please use the signed git tag as the source:

source=("git+https://github.com/jlu5/icoextract.git#tag=$pkgver?signed")
sha256sums=('bc0c9aa074771ff176253d9ebf631ec882776ddd71892a136e1e00a711d44253')
validpgpkeys=('D5D568B2D34AB32A337944D22EC3F60DE71C0B9D') # James Lu <james@overdrivenetworks.com>

@jdigi78 Done, and thanks for reporting it!