Skip to content

Point the PKGBUILD at the current repo and release - #23

Open
nfvelten wants to merge 1 commit into
omacom:masterfrom
nfvelten:fix/pkgbuild-url-and-version
Open

Point the PKGBUILD at the current repo and release#23
nfvelten wants to merge 1 commit into
omacom:masterfrom
nfvelten:fix/pkgbuild-url-and-version

Conversation

@nfvelten

@nfvelten nfvelten commented Sep 1, 2026

Copy link
Copy Markdown

Fixes #21.

packaging/PKGBUILD had rotted in three ways, and they only work as a set:

  1. url="https://github.com/basecamp/ttfx" — 404s since the move to omacom. source= interpolates $url, so this is the download failure reported in Invalid url in PKGBUILD #21.
  2. pkgver=0.1.0 — six releases behind v0.3.2. Correcting the url alone still fetches a stale tarball, so this had to move too.
  3. sha256sums=('SKIP') — the downloaded release tarball was never verified. Now carries the real digest.

Nothing else changed; build(), check() and package() were already correct at 0.3.2.

Testing

makepkg -f on Arch, from a clean directory:

==> Validating source files with sha256sums...
    ttfx-0.3.2.tar.gz ... Passed
...
==> Finished making: ttfx 0.3.2-1

cargo test --release --locked passes in check(). The resulting package contains usr/bin/ttfx, the README and both completion files, and the binary reports ttfx 0.3.2.

Two negative checks, so the diff is not just cosmetic:

  • reverting only url to basecamp (keeping pkgver=0.3.2) still fails with curl: (22) ... 404 — the url fix is necessary
  • corrupting one byte of the new checksum gives ttfx-0.3.2.tar.gz ... FAILED — the digest is actually enforced

Notes

  • pkgver will drift again on every release. Release binaries #20 (release binaries) plus a release workflow would let this consume real assets instead of /archive/ tarballs, which is also the durable answer to the checksum caveat — GitHub's generated archives are not contractually byte-stable. Left out of this PR deliberately.
  • arch=('x86_64') still excludes aarch64. I have no aarch64 machine to test on, so I left it alone.

The packaged url still named basecamp/ttfx, which 404s since the move to
omacom/ttfx. Because source= is built from $url, makepkg failed at the
download step for anyone following the repo's own packaging instructions.

Fixing the url alone is not enough: pkgver was pinned to 0.1.0, six
releases behind the 0.3.2 tag, so a corrected url would still have
fetched a stale tarball. Both move together here.

Also replaces sha256sums=('SKIP') with the real digest of the 0.3.2
archive, so the downloaded tarball is actually verified.

Fixes omacom#21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Invalid url in PKGBUILD

1 participant