Checksum for AUR Package

[johannesjo]

@alosarjos would this adjustment to the build-publish-to-aur-on-release.yml do the trick???

name: AUR Release on Release
on:
  release:
    types: [published]
  workflow_dispatch:
    inputs: {}

jobs:
  aur-release:
    runs-on: ubuntu-latest

    if: '!github.event.release.prerelease'

    steps:
      - uses: actions/checkout@v3

      - run: PACKAGE_VERSION=$(cat ./package.json | grep version | head -1 | awk -F '"' '{print $4}') && echo "package_version=$PACKAGE_VERSION" >> $GITHUB_ENV

      - name: Download and calculate checksum
        run: |
          wget -q "https://github.com/johannesjo/super-productivity/releases/download/v${package_version}/superProductivity-amd64.deb" -O /tmp/superProductivity-amd64.deb
          SHA256_CHECKSUM=$(sha256sum /tmp/superProductivity-amd64.deb | awk '{print $1}')
          echo "sha256_checksum=$SHA256_CHECKSUM" >> $GITHUB_ENV

      - run: sed -e "s/PACKAGE_VERSION/${package_version}/g" -e "s/SHA256_CHECKSUM/${sha256_checksum}/g" build/linux/PKGBUILD_template > build/linux/PKGBUILD

      - name: Publish AUR package
        uses: KSXGitHub/[email protected]
        with:
          pkgname: superproductivity-bin
          pkgbuild: build/linux/PKGBUILD
          commit_username: ${{ secrets.AUR_USERNAME }}
          commit_email: ${{ secrets.AUR_EMAIL }}
          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          commit_message: Update AUR package
          ssh_keyscan_types: rsa,ecdsa,ed25519

[alosarjos]

The pulled PR I think should do everything. (Key line is updpkgsums: true that will update the sums, not need to generate yourself and add it with sed)

If you want to go the extra mile. That would mean generating a checksums files on the release artifact and using those checksums on the publish-to-aur like for example

https://github.com/containers/podman/releases/tag/v5.6.0

the shasums file

[johannesjo]

Thank you!

[alosarjos]

@johannesjo

Arch has a tool, that I've used a lot called updpkgsums

If run from the directory where the PKGBUILD, it will automatically fetch all the objects referenced, generate the checksum and write them on the corresponding section, it's very handy.

On the already merged #5032 I see the:

updpkgsums: true

Which I assume will do just that. But the thing about checksums, is that the entity that generates the artifacts generates and publishes the checksums so that people can compare the one they get from their download with the one published by the source.

This is like the very best way to work on this. The PR you have already merged should take care of what you are trying to achieve on #5050, but it would be great if before closing that PR, publish a release at some point, ping me, and I will check if the checksums are in the PKGBUILD published on the AUR. If not, your PR looks like a more manual way to achieve the same goal.

PD: On that same pull request #5050 there is a Log.Verbose call that I don't thin is related to AUR.

I hope this explains well enough all. Thanks a lot for investing this much time on Arch packaging BTW. Appreciated :D

[johannesjo]

Thank you for the explanation and all your support with arch! Let's go with the simpler solution for now then. I'll try to remember pinging you! :)