Source files have different names on different machines when extracted
I am the maintainer for AUR package Kwim and I have encountered an odd issue in my PKGBUILD, here is the Termbin link:https://termbin.com/uo1m (ignore the "ls" this isn't same PKGBUILD as the one on the AUR) The issue is that when zig-wl.tar.gz and xkb.tar.gz are extracted instead of being "zig-wl-ver" they use their upstream name without the version I.E "zig-wayland". This only seems to happen on my machine as another user has commented that they had to update the sums and filenames on their machine. Comment:https://aur.archlinux.org/packages/kwim#comment-1072854 This is not the first time this has happened to me but, the last time it happened was because I had a typo in my source array, which is not the case here. Does anyone have any idea why this is happening? Here is a list of things I tried: Deleting kwim's tmp directory and rebuilding the package. Building in a clean chroot. Using Curl -sL to see what the original extracted directory name is.(It was zig-wayland-0.6.0, different from the one in my PKGBUILD) Here's the PKGBUILD currently on the AUR: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=kwim&id=9048bbc038230...
I compared the contents of one of your archives vs what others are getting, and aside from the different dir name, there's no difference. The thing is, GitHub does not guarantee their source tarballs not to change, so I'd probably chalk it up to GH weirdness: https://github.blog/open-source/git/update-on-the-future-stability-of-source... You could make the PKGBUILD deterministic by using git instead of relying on the .tar.gz generated by GitHub: source=("zigwl-${_zigwlver}::git+https://github.com/ifreund/zig-wayland.git#tag=v${_zigwlver}") sha256sums=('9ff3bf408bee528889a9dd3059235cb5611c8e38e80e2af880187c00f387ac78') That also has the benefit of guaranteeing that the file name will be the same. Martin On Wed, May 27, 2026 at 3:09 PM Keon Cachia <keonfarrugia@gmail.com> wrote:
I am the maintainer for AUR package Kwim and I have encountered an odd issue in my PKGBUILD, here is the Termbin link:https://termbin.com/uo1m (ignore the "ls" this isn't same PKGBUILD as the one on the AUR)
The issue is that when zig-wl.tar.gz and xkb.tar.gz are extracted instead of being "zig-wl-ver" they use their upstream name without the version I.E "zig-wayland". This only seems to happen on my machine as another user has commented that they had to update the sums and filenames on their machine.
Comment:https://aur.archlinux.org/packages/kwim#comment-1072854
This is not the first time this has happened to me but, the last time it happened was because I had a typo in my source array, which is not the case here. Does anyone have any idea why this is happening? Here is a list of things I tried:
Deleting kwim's tmp directory and rebuilding the package. Building in a clean chroot. Using Curl -sL to see what the original extracted directory name is.(It was zig-wayland-0.6.0, different from the one in my PKGBUILD)
Here's the PKGBUILD currently on the AUR: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=kwim&id=9048bbc038230...
On 5/27/26 10:45 AM, Martin Rys wrote:
I compared the contents of one of your archives vs what others are getting, and aside from the different dir name, there's no difference.
The thing is, GitHub does not guarantee their source tarballs not to change, so I'd probably chalk it up to GH weirdness: https://github.blog/open-source/git/update-on-the-future-stability-of-source...
You could make the PKGBUILD deterministic by using git instead of relying on the .tar.gz generated by GitHub:
source=("zigwl-${_zigwlver}::git+https://github.com/ifreund/zig-wayland.git#tag=v${_zigwlver}") sha256sums=('9ff3bf408bee528889a9dd3059235cb5611c8e38e80e2af880187c00f387ac78')
That also has the benefit of guaranteeing that the file name will be the same.
Martin
Be extra careful verifying GitHub and npm packages and dependencies. Both have been the victims of multiple hacks during the past couple of weeks: https://www.theregister.com/security/2026/05/22/megalodon-chums-the-waters-i... (see earlier TeamPCP attacks [Shi-Hulud and progeny]) npm is the king frequent-flyer for supply chain compromise. This is the link from last week's fun: https://www.theregister.com/cyber-crime/2026/05/19/shai-hulud-keeps-burrowin... see also: Claudia's response on the AUR plex-media-player compromise earlier today. Unfortunately, it appears these are just the opening salvos in the AI race to the bottom as ever less sophisticated user are able to create ever more sophisticated exploits. -- David C. Rankin, J.D.,P.E.
participants (3)
-
David C Rankin
-
Keon Cachia
-
Martin Rys