Upstream rarely provides releases or tags for their lib. They rely on a single git commit message where they bump the version most of the time. This is not great.
Most users want a package that is not 2 years old, which means we need a compromise. We use the Git commit hash that announces a release upstream. That means we can no longer provide a hash (sha-256, sha-512) to verify that what we got from git clone
matches the libtd that was released on GitHub.
Pinned Comments
tleican commented on 2025-04-15 21:28 (UTC)
Upstream rarely provides releases or tags for their lib. They rely on a single git commit message where they bump the version most of the time. This is not great.
Most users want a package that is not 2 years old, which means we need a compromise. We use the Git commit hash that announces a release upstream. That means we can no longer provide a hash (sha-256, sha-512) to verify that what we got from
git clone
matches the libtd that was released on GitHub.