archlinux / asp

Arch Build Source Management Tool
MIT License
292 stars 33 forks source link

Does not use the exact same PKGBUILD used for building #16

Closed NicoHood closed 7 years ago

NicoHood commented 7 years ago

If I download packages via repository/package format I expect to get the exact same PKGBUILD that was used for the package in the repos and not the git/svn head.

However if we use fdupes as example i get:

[arch@arch asp]$ asp export community/fdupes
==> exporting fdupes:repos/community-x86_64
[arch@arch asp]$ pacman -Sii fdupes | tail -n 3
SHA-256 Sum     : 3582304aae42f6bdaa2af4ed2e11ebedf4ed830a8fa790f46108b4804f4678c5
Signatures      : 1D1F0DC78F173680

[arch@arch asp]$ sha256sum fdupes/PKGBUILD 
f5b90cc367b3574aff4d254eff08f025824d80ed996c4a6ece133fcfe65a8b79  fdupes/PKGBUILD

One hash used "SKIP" so I fixed it manually in trunk: https://git.archlinux.org/svntogit/community.git/commit/trunk/PKGBUILD?h=packages/fdupes&id=dec317ec364d8aec33b9a0637b50b02bae240ae1

However the initial PKGBUILD that was used to build fdupes was the old one. Asp should download this one and not my fixed PKGBUILD (otherwise i should have bumped the release variable).

I wrote a small bash script that can search for PKGBUILDs in older versions. I only tried this myself on the whole package/community git, but it takes way too long to search through the whole history. I never tried that with branched, as I found asp. I though asp would solve this issue.

#!/bin/bash

CHECKSUM=$1
FILE=$2
ALGO="sha256"
LIMIT="1000000000000000000"

if [[ -z "$CHECKSUM" || -z "$FILE" ]]; then
    echo "Usage: $0 ${ALGO} file"
    exit 1
fi

# Check if valid git repo
ROOT=$(git rev-parse --show-toplevel)
if [[ $? -ne 0 ]]; then
    echo "Not a valid git repo."
    exit 1
fi
cd "$ROOT"

# Check each revision for checksum, stop on first match
git log --pretty=%H -n "${LIMIT}" "${FILE}" \
    | xargs -n1 -P0 -iX bash -ec \
    "${ALGO}sum <(git show X:${FILE}) | grep -q ${CHECKSUM} && echo X && exit 255" \
    2>/dev/null

My final goal is to get the PKGBUILDs of all packages in the current repositories at the state when the packager also built it (not the trunk). Maybe if we switch to git we can later tag those branches and have a better version schema. This way we could make builds also better reproducible.

falconindy commented 7 years ago

Are you Xyne?

As far as I can tell, this is working as intended. archrelease was run after the PKGBUILD change was committed, and this updates the repos subdirs.

NicoHood commented 7 years ago

Oh. I see. I am not xyne, it seems he made the chance, not me. I must have emailed him. I need to try with another package then.

NicoHood commented 7 years ago

But why is the sha256sum different then? shouldnt it be still the same?

falconindy commented 7 years ago

I don't see any difference between the two PKGBUILDs.