v1.3.0 source tarball checksum has been changed #31

daeho-ro commented 2026年07月13日 05:16:31 +02:00

Hello, this is a homebrew maintainer and I have noticed that the checksum of v1.3.0 source tarball has been changed.

-b65cf7f5285affe3ab9a1887d12e6c313f437b18a5cf2b52add6cfd7e76dd2c7
+63c961194aaab935faf325cd4bf3d25638f87ede1f2498367b5cd92ebe42e0ec

Weird thing is the redirected rev isn't match with current one.

curl -I https://codeberg.org/gpanders/ijq/archive/v1.3.0.tar.gz
HTTP/2 200 
accept-ranges: bytes
access-control-expose-headers: Content-Disposition
cache-control: private, max-age=300
content-disposition: attachment; filename="ijq-v1.3.0.tar.gz"; filename*=UTF-8''ijq-v1.3.0.tar.gz
content-type: application/octet-stream
last-modified: 2026年7月12日 11:56:43 GMT
link: <https://codeberg.org/api/v1/repos/gpanders/ijq/archive/430fa3c17baabb1c227106a7d893c18930ded43f.tar.gz?rev=430fa3c17baabb1c227106a7d893c18930ded43f>; rel="immutable"
no-gzip-compression: 1

image

Do you have any idea what is wrong here?
And also can you check that the current tarball is fine to use from downstream?

Thanks,

Hello, this is a homebrew maintainer and I have noticed that the checksum of v1.3.0 source tarball has been changed. ```diff -b65cf7f5285affe3ab9a1887d12e6c313f437b18a5cf2b52add6cfd7e76dd2c7 +63c961194aaab935faf325cd4bf3d25638f87ede1f2498367b5cd92ebe42e0ec ``` Weird thing is the redirected rev isn't match with current one. ``` curl -I https://codeberg.org/gpanders/ijq/archive/v1.3.0.tar.gz HTTP/2 200 accept-ranges: bytes access-control-expose-headers: Content-Disposition cache-control: private, max-age=300 content-disposition: attachment; filename="ijq-v1.3.0.tar.gz"; filename*=UTF-8''ijq-v1.3.0.tar.gz content-type: application/octet-stream last-modified: 2026年7月12日 11:56:43 GMT link: <https://codeberg.org/api/v1/repos/gpanders/ijq/archive/430fa3c17baabb1c227106a7d893c18930ded43f.tar.gz?rev=430fa3c17baabb1c227106a7d893c18930ded43f>; rel="immutable" no-gzip-compression: 1 ```  Do you have any idea what is wrong here? And also can you check that the current tarball is fine to use from downstream? Thanks,

gpanders commented 2026年07月13日 23:49:09 +02:00

Thanks for bringing this up. I have not changed the v1.3.0 tag or pushed any changes recently. I suspect this may be an issue with Codeberg itself.

Thanks for bringing this up. I have not changed the v1.3.0 tag or pushed any changes recently. I suspect this may be an issue with Codeberg itself.

gpanders commented 2026年07月13日 23:53:45 +02:00

last-modified: 2026年7月12日 11:56:43 GMT

This is suspicious, I did not modify anything on this date.

>last-modified: 2026年7月12日 11:56:43 GMT This is suspicious, I did not modify anything on this date.

gpanders commented 2026年07月13日 23:56:51 +02:00

As far as I can tell though, the content of the source tarball is unmodified. It matches the content of 38e04ac3 exactly. I don't know why the link header in curl points to 430fa3c17b.

I've sent an email to Codeberg and have asked them to investigate. Hopefully we can get some answers here to explain what happened.

As far as I can tell though, the content of the source tarball is unmodified. It matches the content of 38e04ac3 exactly. I don't know why the link header in curl points to 430fa3c17baabb1c227106a7d893c18930ded43f. I've sent an email to Codeberg and have asked them to investigate. Hopefully we can get some answers here to explain what happened.