zig-dev-bin: Automatically update to the latest nightly version #1
Conversation
Downloads directly from https://ziglang.org/download GPG verification of downloaded files is not currently possible because Zig nightly binaries aren't signed. See github issue ziglang/zig#4945 for details Using hardcoded sha256 is also impossible because this is an auto-updating package Therefore, there is no security beyonnd the basic integrity of a https:// network connection (although that is still some security, you would have to forge a signed HTTPS certificate to intercept). This commit also changes the versioning scheme to match the upstream downloads (and be compatible with the main zig package) This requires incrementing the "epoch" This also changes the package to support multiple architectures (both x86_64 and ARM64)
The location in the nightly tarball moved. This change is required by the new auto-update scheme.
|
Hi @Techcable ! Sorry for the delay. I am busy recently. I am glad someone paid attention to this. I have added you to the maintainers of the |
|
Thanks for the response @zhangkaizhao . I'd be happy to maintain the package from here (and I totally understand being busy 🙂 )
Yes! This is very exciting and hopefully this will allow some of us to move off the dev version (though I'm likely to stay until 1.0, and still plan to maintain the package either way). I guess I'll close this PR and push the commits directly to the AUR? |
I think auto-updating is a really good idea for a "dev" package.
Right now the package is over 2 months old and 580 commits have changed. I marked this as outdated on the AUR for this reason.
I've suggested two patches in the comments that I have PRed here:
There are advantages and disadvantages to the auto-updating (patch 1). The main advantage is the build is always latest (which makes sense for nightly builds).
The main downside is lack of PGP verification (this is an upstream issue). Sometimes the PKGBUILD could break and require manual intervention (like the fix required by patch 2).
I didn't realize there was a PR repo until recently. Sorry about that.