Arch Linux User Repository

Hi richedge39, meli author here,

the shasums for this tarball is different on each of the different "code mirrors."

Forgejo/gitea/github generate source tarballs automatically, which must be the source of SHA mismatches. Note: I think forgejo lets you replace the source tarball for a "release".

What different mirrors did you try other than upstream?

I don't personally use Arch (btw) so I am not familiar with how AUR works but I see the PKGBUILD file only mentions the indeed old git.meli.delivery domain (which, by the way, reluctantly moved away from because DNS e-mail spam filters don't like the .delivery TLD). So by mirrors you must refer to the git repos I mention in the meli README.md right?

PS: As for the HTTP headers, they are just harmless easter eggs inserted by the reverse-proxy: parodies of X- vendor headers and Content- standard headers. I put them so long ago I had forgotten about it!

Adding on to bda's comment: the shasums for this tarball is different on each of the different "code mirrors."

$ sha256sum *.tar.gz
598479fb05196dd79f65c996b649f2fa5668ec79963d53d776c79fb84f43d172  meli-0.8.10.tar.gz
83573e8f2e8770831e35879c84297e9b353ba251d9a55960615eb1e32b9a1901  meli-v0.8.10.tar.gz

The main mirror has also moved (from git.meli.delivery to git.meli-email.org):

$ wget --server-response -O - https://git.meli.delivery/meli/meli/archive/v0.8.10.tar.gz
wget --server-response -O /dev/null https://git.meli.delivery/meli/meli/archive/v0.8.10.tar.gz
--2025-04-17 19:29:30--  https://git.meli.delivery/meli/meli/archive/v0.8.10.tar.gz
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving git.meli.delivery (git.meli.delivery)... 159.100.247.223
Connecting to git.meli.delivery (git.meli.delivery)|159.100.247.223|:443... connected.
HTTP request sent, awaiting response...
  HTTP/1.1 301 Moved Permanently
  Date: Fri, 18 Apr 2025 00:29:31 GMT
  Server: Apache/2.4.62
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Location: https://git.meli-email.org/meli/meli/archive/v0.8.10.tar.gz
  Content-Length: 267
  Keep-Alive: timeout=5, max=100
  Connection: Keep-Alive
  Content-Type: text/html; charset=iso-8859-1
Location: https://git.meli-email.org/meli/meli/archive/v0.8.10.tar.gz [following]
--2025-04-17 19:29:31--  https://git.meli-email.org/meli/meli/archive/v0.8.10.tar.gz
Resolving git.meli-email.org (git.meli-email.org)... 159.100.247.223, 2a04:c44:e00:e332:40f:ff:fe00:930
Connecting to git.meli-email.org (git.meli-email.org)|159.100.247.223|:443... connected.
HTTP request sent, awaiting response...
  HTTP/1.1 200 OK
  Date: Fri, 18 Apr 2025 00:29:32 GMT
  Server: Apache/2.4.62
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Accept-Ranges: bytes
  Access-Control-Expose-Headers: Content-Disposition
  Cache-Control: private, max-age=300
  Content-Disposition: attachment; filename="meli-v0.8.10.tar.gz"; filename*=UTF-8''meli-v0.8.10.tar.gz
  Content-Length: 1520125
  Content-Type: application/octet-stream
  Last-Modified: Thu, 17 Apr 2025 23:40:55 GMT
  Link: <https://git.meli-email.org/api/v1/repos/meli/meli/archive/733b02ce9aa1a47351e3d043b41d78a2a6b3f1ba.tar.gz?rev=733b02ce9aa1a47351e3d043b41d78a2a6b3f1ba>; rel="immutable"
  No-Gzip-Compression: 1
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  X-Men: I haven't watched/read any X-Men stuff, sorry.
  Content-Author: tired
  Vintage-Mousepads: http://vintage-mousepads.website/all.htm
  Set-Cookie: i_like_gitea=ee8e42c4fdcdd3ef; Path=/; HttpOnly; Secure; SameSite=Lax; Secure
  Set-Cookie: _csrf=B5sCRPfpoLzKbWemvZxPBxB77RQ6MTc0NDkzNjE3MjM1OTk3MDI4Mg; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=Lax; Secure
  Keep-Alive: timeout=5, max=100
  Connection: Keep-Alive
Length: 1520125 (1.4M) [application/octet-stream]
Saving to: ‘/dev/null’

/dev/null              100%[===========================>]   1.45M  1.26MB/s    in 1.2s

2025-04-17 19:29:33 (1.26 MB/s) - ‘/dev/null’ saved [1520125/1520125]

There are some weird HTTP headers there...WTF is Vintage-Mousepads: and X-Men?

Looks like the original site was meli.delivery. They've rotated through a few domains including meliemail.org (for a very short period) and finally the current. meli-email.org

update:

Seems that they just separately build the tarballs in the different repos. The files are all the same. Instead of moving the tarballs from one repo to the next, they might've re-built the tarball in the "mirror" repo again. The directory structure is different but the files are the same when I checked via their hashes.

Still not sure why no one in January was complaining about this though. The issue around the shasum for the PKGBUILD seems to have been around for a while.

Hi, sha256sum is wrong in PKGBUILD.

Thanks for making this, meli is great :)

@alerque

I second afontenots command about using man-db. Please consider changing the PKGBUILD.

meli fails to start when missing "m4" macro processor. Please add it to the runtime dependencies.

@alerque man-db's man can also generate man pages, and actually the project's building documentation mentions this:

cli-docs includes the manpage documentation compiled by either mandoc or man binary to plain text in meli's command line.

I've tested the resulting build after removing the dependency and everything appears to work fine. I can man meli and view the pages with meli man as well.

I think given that this PKGBUILD would otherwise require a package conflicting with one installed on 99% of Arch systems, it'd be better to change it. Ultimately that's up to you, I can change the dependencies on my local build if necessary.

@Derson5 We use mandoc in this package because that's what the upstream project uses. But I'd guess it has something to do with man-db being tools to read man pages while mandoc has tooling for generating them from other formats.

Out of curiosity: @alerque why we use mandoc and not man-db? Is mandoc better at something then man-db?

Update to version 0.8.0:

https://privatebin.net/?1c3a40094d59e449#HahNkeUVwXfRaEWAEBWZaf99CPyJXKx2B4Lx4rn4hUdu

And please remove dendrite.service!

Ah ha! It actually needs an old version of openssl. Older than Arch has in repos any more...