Arch Linux User Repository

why are you all doing a hash sum check on each file? your first file is Packages. It is already checked by a checksum and contains literally every sha512 hash sum of each packet. it is enough to embed 2 lines in the script for processing this file and all sha512 hash sums will be downloaded directly from it.

209a120
>     sha512_all=($(sed -rn 's#SHA512:[[:blank:]]*([0-9a-fA-F]+)#\1#gp' <<<"$meta"))
210a122
>     sha512=${sha512_all[$(($(echo "$depurl_all" | tr ' ' '\n' | grep -nx "$depurl" | cut -d: -f1)-1))]}
216a129
>     sha512sums+=("$sha512")

and that's all.sha512 for Packages will be failed and nothing installed if Pachages changed .

I’ve been working on an update to 26.04.4.2 and investigating the recurring checksum failures.

The current PKGBUILD dynamically selects the latest upstream packages but verifies them against a fixed checksum list. It also pins a checksum for the mutable Packages index, so repository updates can break verification even without changes to the relevant archives.

The changes tested so far:

• Pair each selected .deb with the SHA-256 and dependencies from its exact Packages entry.
• Remove the fixed checksum for the changing index, while retaining verification of every archive.
• Fix language-package matching so a language doesn’t unintentionally include regional variants.
• Update outdated install actions: remove capability commands for missing executables, use coolconfig generate-proof-key, create the cache directory, and remove redundant copying/chowning of files already hard-linked by upstream’s setup script.

All 99 sources passed checksum verification, and a full package build succeeded. The subsequent install-hook corrections passed syntax and mocked-command checks; complete runtime validation is still pending.

I’d consider this a working draft rather than a ready replacement. For an AUR-friendly long-term fix, I suggest moving repository parsing into a maintainer update script that downloads only Packages and generates pinned source URLs/checksums. That would automate updates without changing versions, dependencies, or split-package names whenever someone sources the PKGBUILD, and would keep .SRCINFO consistent.

Other follow-up work includes fixing missing descriptions in .SRCINFO, removing obsolete backup entries, reviewing /opt/cool deletion and service handling in the install script, and running clean-chroot, namcap, and installation/upgrade checks.

Would this approach be useful for a patch or maintenance handover?

GitHub Gist with PKGBUILD & .SRCINFO

Diff for new version:

9c9
< pkgver=25.04.8.1
---
> pkgver=26.04.3.3

209a120
>     sha512_all=($(sed -rn 's#SHA512:[[:blank:]]*([0-9a-fA-F]+)#\1#gp' <<<"$meta"))
210a122
>     sha512=${sha512_all[$(($(echo "$depurl_all" | tr ' ' '\n' | grep -nx "$depurl" | cut -d: -f1)-1))]}
216a129
>     sha512sums+=("$sha512")

And replace b2sums to:

> sha512sums=('512cd30c07ece2203a2aff3e08288ac8111258448ee2964ad40a156d73efe72edceae6810dbf3ee043d6a82f4274c0f7be2dae89505de662897d586e4f390397'
>             'f59a238d91f44655165f8843b5cd4d4255a43a57eaf07ea5affb7ddfceee533d5f12841dbcd4c5bd91f97ca93df303990cc681745d56ffd6c7f0b90450a17a66'
>             '1e21323b410622b1417b89f464cdf788f14945681f48dfec15852f28290dd9cbfd3aa0f35f86c54d3dcb68553a2eb347332079c5ef6bd05db7896908e3dd0122'
>             '97cb972362abc9a72c5c1a5012b2416cd79b376dc6bc263ca061e30a5681ef9eb7c7d796d754b95fd648cf15c3b9853e29d9138ababa5d6d5b3a542519e4fd46'
>             '54ea6e3a4b82cc04237e25caeed0767ef304c15df910f295458d4cdff8a9a25babe20c0c4c12a81f73daaf9c523f057e9b2145fd1748c10375a0178cbab32e33')

@taba Feel free to adopt the package that is now orphan.
The PKGBUILD is good, but the new maintainer will need a cron/systemd timer:
- to look daily for the new coolwsd version ;
- update accordingly the pkgver of the PKGBUILD ;
- run updpkgsums ;
- run makepkg --printsrcinfo > .SRCINFO ;
- push the new package.

This package is perpetually broken. I think the Debian repo description contains hashes. Why not download just that and extract hashes from it?

New release 25.04.8.2.

If someone wants to take over this package and fix the "broken hashes" issue for good,
feel free to reach out. I will submit a new manual release today.

New update, new broken hashes.