Hi Doug, hi Christian, Thank you both for your help.
https://wiki.archlinux.org/title/VCS_package_guidelines#Git_submodules still applies
Basically I missed the last point on the general package guidelines [3].
This is described in the package guidelines[0], you resolve the tag to the git commit it points at and pin that. So the package still does have SKIP in the checksum array but you get similar stability guarantees since you pinned the exact commit you packaged.
So it is best practice to not use the tag itself, since the target commit can be changed, but use the rev-parsed version. Especially since I do not own the source project. I wanted to ask why you did not do the same way for all submodules in pawxel[1], but I can answer that myself. Since you already pinned by using rev-parsed tag for the main repo, it does include the commit hashes in the commit (tree) and you can just check out the right commits. Basically the perfect example!
- there is a duplicate source array - you miss the Maintainer: comment (also see [2] for that)
Yeah, I noticed. Already addressed these locally. Thank you both for the help, Christian [0] https://wiki.archlinux.org/title/Arch_package_guidelines#Package_sources [1] https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=pawxel [2] https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submissi... [3] https://wiki.archlinux.org/title/Arch_package_guidelines#Additional_guidelin...