A fixed source tarball with each release, for packagers (HaikuDepot and others) issue #157 open andymccall opened this 6 days ago · 0 comments

Follow-up to issue #156 (Andy, 2026-10-29). The haikuports recipe points at the hub's archive endpoint, which builds the archive on demand and caches it: if it is ever rebuilt with different bytes, the recipe's checksum breaks. And oh cannot have a recipe at all, because it builds from the hub workspace plus pinned subrepos whose states (28 and 66 heads) the archive endpoint cannot name.

• Each release's dist job also makes NAME-VERSION-src.tar.gz, reproducible (sorted entries, fixed times and owners, gzip without a timestamp), listed in SHA256SUMS and released with the binaries: oxy's from the oxygen tree; oh's from the oxygenhub tree with its subrepos inside, so it builds alone.
• The hub serves a release's asset at a URL known before the release exists: /OWNER/NAME/releases/download/TAG/FILE (as GitHub does).
• packaging/haikuports/make-recipe.py writes recipes for oxy and oh against those tarballs; submit both to haikuports with the next releases.