digitalocean / doctl Public
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
1.61.0 release tarball changed? #1001
Comments
Hi @Jehops. Thanks for maintaining the FreeBSD package! This does seem odd. We build and upload the binary tarballs using goreleaser and we include the SHA256 checksums for them as part of the release.. The source tarballs are generated by GitHub automatically. We don't keep a record of what the checksum for those are at release. What was the original checksum you recorded? |
Hi @andrewsomething. My pleasure. That the GitHub automatically generated tarballs can change is odd and unfortunate, but described elsewhere. The original SHA256 was 5334fb1d2c169064d2a7584186bc4b3c48952e8af0a139447e890e204531356e. It's now 571ae4f408a267d9824b56b5ed43604c867be951c09d8fd9b2b0db7cb4635078. |
Looks like it should be pretty trivial for us to start including our own source archive as part of the release process: https://goreleaser.com/customization/source/ That should at least prevent this in the future. |
See digitalocean/doctl#1001 Upstream will now provide immutable source tarballs.
See digitalocean/doctl#1001 Upstream will now provide immutable source tarballs. (cherry picked from commit 2924196)
FreeBSD package maintainer here. Our package building system does a checksum on the release tarballs and we are now seeing a mismatch. It doesn't look like the release was re-rolled. Do you know anything about the change?
I'm told that these GitHub generated tarballs are not guaranteed to be static, although this is a first for me in years of maintaining dozens of GitHub hosted packages.
The text was updated successfully, but these errors were encountered: