Arch Linux User Repository

Yes, you do still need to update the checksum, that's true in any case. The advantage of the approach I'm mentioning below is that if a user has already downloaded the tarball for say 4.18, then when you bump both pkgrel and srcrel, they won't have to manually delete the tarball to convince makepkg to download it again (instead of failing the checksum).

@Corax, thank you for your suggestion. I don't think upstream actually doing a new release, instead it seems that the source files are "repacked" and with new dates etc of files inside the checksum changes. Also I don't see the benefit of the suggestion because the checksum still needs to be updated in PKGBUILD. Actually it is good that it fails, even if it is annoying. Then when this happens it can be checked that nothing malicious is going on. The advice is to not use the AUR as a "normal" trusted repository with an AUR helper. So, sorry I will not implement this.

Hi! I'm the maintainer of the xnviewmp AUR packages and I've recently noticed that xnviewmp and svtplay-dl have something in common: in both cases the maintainers think it's a good idea to make a new release (changing the hash) without actually announcing it or bumping the version... In xnviewmp I tried to make it less painful to users a while back by introducing $srcrel, which I bump along with $pkgrel every time the hash changes but the version does not. This way, there is no need for a clean build when the hash changes, as $srcrel is included in the local file name: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=xnviewmp

I think the same approach could be used for this package, just my $0.02 of course :)

Validity fail encore (doing a cleanbuild):

$ grep sum PKGBUILD && sha256sum *.gz sha256sums=('11777807952251f140b32bca41339cf5772db472bde8eed8404f54a79c5f653c') d16c53d1168b62760fb1dfbedd632ac5742a0ca5f7ac52834cd9f30d8772baa6 svtplay-dl-4.17.tar.gz

The package fails file validity check again

Once again: ==> Making package: svtplay-dl 3.8-1 (Sat May 15 07:21:44 2021) ==> Retrieving sources... -> Found svtplay-dl-3.8.tar.gz ==> Validating source files with sha256sums... svtplay-dl-3.8.tar.gz ... FAILED ==> ERROR: One or more files did not pass the validity check! error downloading sources: svtplay-dl

Validating source files with sha256sums... svtplay-dl-3.6.tar.gz ... FAILED ==> ERROR: One or more files did not pass the validity check! error downloading sources: svtplay-dl

I did a cleanbuild

@sQVe Thank you for the suggestion, it is now implemented. (Also updated to version 3.5).

Firstly, thanks for maintaining this package. It seems like the upstream isn't making it very easy for you...

I'd greatly appreciate it if you could make the source unique. It currently saved it as 3.4.tar.gz which is problematic as it may already exist (other packages creating it etc). Could you possibly change the source to:

source=("${pkgname}-${pkgver}.tar.gz::https://github.com/spaam/svtplay-dl/archive/$pkgver.tar.gz)

This would make it unique for this package. See https://wiki.archlinux.org/index.php/PKGBUILD#Sources for more details.

Thanks!

Yeah, that's no good!! But on the other hand for me personally at least mostly it's svtplay-dl that fails checksums.