Re: uscan downloads wrong source tarball from Github
On 20/09/2025 11:39, John Paul Adrian Glaubitz wrote:
version=4
opts="searchmode=plain,\
filenamemangle=s%v?@ANY_VERSION@%@PACKAGE@-$1.tar.xz%" \
https://api.github.com/repos/FrodeSolheim/fs-uae/releases?per_page=100 \
https://api.github.com/repos/[^/]+/[^/]+/tarball/v?@ANY_VERSION@
This matches against "/tarball" and likely downloads the tar.gz tarball
associated with the release tag. It's a GZ file even if you rename it.
glaubitz@z6:/tmp> wget --quiet https://github.com/FrodeSolheim/fs-uae/releases/download/v3.2.35/fs-uae-3.2.35.tar.xz
glaubitz@z6:/tmp> md5sum fs-uae-3.2.35.tar.xz
a4b855a296d6fc0d458582cd9d320a2e fs-uae-3.2.35.tar.xz
This is an upstream created "release asset" - it has debian/ inside and
other changes that are not in the source repo. It's the first file in
the Release page. It's not usually expected to match the source directly.
glaubitz@z6:/tmp> wget --quiet https://github.com/FrodeSolheim/fs-uae/archive/refs/tags/v3.2.35.tar.gz
glaubitz@z6:/tmp> md5sum v3.2.35.tar.gz
f1e56b7a1d38356094dfcdd41133fd51 v3.2.35.tar.gz
This is a download of the tagged version of the repo - it's the "Source
code" link at the bottom of the Release page with no hash.
You can download this using the normal mode of uscan with "/tags" page:
https://github.com/FrodeSolheim/fs-uae/tags .*/v@ANY_VERSION@@ARCHIVE_EXT@
Does anyone know what contents to use for debian/watch so it downloads either
of the two tarballs with the correct MD5 sum?
1. use "/tags" page for "Source code" as compressed by github for the
git tag.
2. use "api.github.com.../releases" for the author uploaded XZ tarball,
but you have to match the "asset" (and hope it doesn't get renamed or
duplicated in future releases).
3. use "mode=git" for uscan to do a git-clone and compress the tarball
itself.
opts="mode=git" https://github.com/FrodeSolheim/fs-uae.git
refs/tags/v@ANY_VERSION@
The contents of the #1 and #3 tarballs should match, but the tarball
hash may not.
--
Regards,
Ahmad
Reply to: