Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ccemux: mark broken (download fails hash validation) #272193

Closed
wants to merge 1 commit into from
Closed

ccemux: mark broken (download fails hash validation) #272193

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions pkgs/applications/emulators/ccemux/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,5 +64,6 @@ stdenv.mkDerivation rec {
sourceProvenance = with sourceTypes; [ binaryBytecode ];
license = licenses.mit;
maintainers = with maintainers; [ CrazedProgrammer viluon ];
broken = true; # download of CCEmuX-cct.jar fails hash validation
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we update hash ?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since I don't use this software I am not qualified to decide if that's safe.

Usually the best course here is to mark the package as broken and if nobody steps up, let the package get garbage-collected. If somebody does step up to audit the mysteriously-changed binary jarfile, and wants to take the reputational risk upon themselves, more power to them!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe @viluon can have a look ( last committer ), otherwise I agree with your assessment

Copy link
Contributor

@superherointj superherointj Jan 20, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with @amjoseph-nixpkgs . My nitpick is to open a tracking issue and reference it. So discussions of fixing that package happens in that issue. And add the day the breakage is being reported.

Copy link

@MCJack123 MCJack123 Jan 21, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Upstream doesn't do version control on binaries AFAIK. The maintainer will have to be on top of version bumps to avoid this issue from happening. I don't use Nix, so I don't know if this is an option (probably isn't), but it may also be necessary to skip checking hashes to avoid breakages between updates.

Disregard this, I've been corrected.

Copy link
Contributor

@viluon viluon Jan 21, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nah, see CCEmuX/CCEmuX#167. Thanks @kirillrdy for the mention.

};
}