Arch Linux User Repository

Something else of note is that the xz package uses a git source along with a checksum. Is it not possible to do that here as well, using e.g. makepkg --geninteg?

@phonemic That's because xz uploaded their own tarballs instead of relying on GitHub's automatic tarballs that are guaranteed to be the actual, unmodified repo code and cannot be modified. Notice that the xz package relied on "releases/download", while this package relied on "archive". I'd also support having the xz package use GitHub's automatic tarballs instead.

@aliu I'm not sure what you mean. A malicious maintainer can put files in tarballs that are not in the git repo. The fix for xz was moving from using the tarballs to the repo directly.

https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/commit/881385757abdc39d3cfea1c3e34ec09f637424ad

@phonemic One cannot modify tarballs on GitHub.

@aliu based on the recent xz shenanigans, I think more packages should move away from tarballs and build off git directly.

maybe, but then you are still copying a bunch of files unnecessarily. And I personally feel like it is cleaner to specify the things that should be installed than the things that shouldn't.

77 Wouldn't it be simpler to just

cd $pkgdir/usr/share/$pkgname/gitstatus

rm -rf..

cd ..

rm..

and then cd $srcdir

Here is a diff with my changes to depend on gitstatus, along with excluding some more unnecessary files:

diff --git i/powerlevel10k/PKGBUILD w/powerlevel10k/PKGBUILD
index 7f24db9..8fd78d2 100644
--- i/powerlevel10k/PKGBUILD
+++ w/powerlevel10k/PKGBUILD
@@ -6,14 +6,13 @@
 pkgname=zsh-theme-powerlevel10k
 # Whenever pkgver is updated, _libgit2ver below must also be updated.
 pkgver=1.20.0
-_libgit2ver="tag-2ecf33948a4df9ef45a66c68b8ef24a5e60eaac6"
-pkgrel=2
+pkgrel=3
 pkgdesc="Powerlevel10k is a theme for Zsh. It emphasizes speed, flexibility and out-of-the-box experience."
 arch=('x86_64')
 url='https://github.com/romkatv/powerlevel10k'
 license=('MIT')
 makedepends=('git' 'cmake')
-depends=('glibc' 'zsh')
+depends=('glibc' 'zsh' 'gitstatus')
 optdepends=(
   'ttf-meslo-nerd-font-powerlevel10k: recommended font'
   'powerline-fonts: patched fonts for powerline'
@@ -24,73 +23,30 @@ optdepends=(
 replaces=('zsh-theme-powerlevel9k')
 _commit=35833ea15f14b71dbcebc7e54c104d8d56ca5268  # tags/1.20.0^0

-# _libgit2ver depends on pkgver. They must be updated together. See libgit2_version in:
-# https://raw.githubusercontent.com/romkatv/powerlevel10k/v${pkgver}/gitstatus/build.info
 source=(
-  "git+https://github.com/romkatv/powerlevel10k.git#commit=$_commit"
-#  "powerlevel10k-${pkgver}.tar.gz::https://github.com/romkatv/powerlevel10k/archive/v${pkgver}.tar.gz"
+  "powerlevel10k-${pkgver}.tar.gz::https://github.com/romkatv/powerlevel10k/archive/v${pkgver}.tar.gz"
 #  "https://github.com/romkatv/powerlevel10k/releases/download/v$pkgver/powerlevel10k-$pkgver.tar.gz.asc"
-  "libgit2-${_libgit2ver}.tar.gz::https://github.com/romkatv/libgit2/archive/${_libgit2ver}.tar.gz")
-sha256sums=('SKIP'
-            '4ce11d71ee576dbbc410b9fa33a9642809cc1fa687b315f7c23eeb825b251e93')
+)
+sha256sums=('d8187d44b697b3a37a8c4896678b4380e717cbf2850179529358348780a2d3d7')
 validpgpkeys=('8B060F8B9EB395614A669F2A90ACE942EB90C3DD') # Roman Perepelitsa <roman.perepelitsa@gmail.com>

-pkgver() {
-  cd powerlevel10k
-  git describe --tags | sed 's/^v//;s/-/+/g'
-}
-
-build() {
-  cd "${srcdir}/libgit2-${_libgit2ver}"
-  cmake \
-   -DCMAKE_BUILD_TYPE=None \
-   -DZERO_NSEC=ON \
-   -DTHREADSAFE=ON \
-   -DUSE_BUNDLED_ZLIB=ON \
-   -DREGEX_BACKEND=builtin \
-   -DUSE_HTTP_PARSER=builtin \
-   -DUSE_SSH=OFF \
-   -DUSE_HTTPS=OFF \
-   -DBUILD_CLAR=OFF \
-   -DUSE_GSSAPI=OFF \
-   -DUSE_NTLMCLIENT=OFF \
-   -DBUILD_SHARED_LIBS=OFF \
-   -DENABLE_REPRODUCIBLE_BUILDS=ON \
-   -Wno-dev \
-   .
-  make
-
-  # build gitstatus
-  cd "$srcdir/powerlevel10k/gitstatus"
-  export CXXFLAGS+=" -I${srcdir}/libgit2-${_libgit2ver}/include -DGITSTATUS_ZERO_NSEC -D_GNU_SOURCE"
-  export LDFLAGS+=" -L${srcdir}/libgit2-${_libgit2ver}"
-  make
-}
-
 package() {
-  cd powerlevel10k
-  find . -type f -exec install -D '{}' "$pkgdir/usr/share/${pkgname}/{}" ';'
+  cd "powerlevel10k-${pkgver}"

-  install -d "${pkgdir}/usr/share/licenses/${pkgname}"
-  ln -s "/usr/share/${pkgname}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}"
+  # only copy over the files we need
+  install -D LICENSE "${pkgdir}/usr/share/license/${pkgname}"

-  # delete unnecessary files. See also: https://bugs.archlinux.org/task/66737
-  rm -rf "${pkgdir}/usr/share/${pkgname}/gitstatus/obj"
-  rm -rf "${pkgdir}/usr/share/${pkgname}/gitstatus/.gitignore"
-  rm -rf "${pkgdir}/usr/share/${pkgname}/gitstatus/.gitattributes"
-  rm -rf "${pkgdir}/usr/share/${pkgname}/gitstatus/src"
-  rm -rf "${pkgdir}/usr/share/${pkgname}/gitstatus/build"
-  rm -rf "${pkgdir}/usr/share/${pkgname}/gitstatus/deps"
-  rm -rf "${pkgdir}/usr/share/${pkgname}/gitstatus/Makefile"
-  rm -rf "${pkgdir}/usr/share/${pkgname}/gitstatus/mbuild"
-  rm "${pkgdir}/usr/share/${pkgname}/.gitattributes"
-  rm "${pkgdir}/usr/share/${pkgname}/.gitignore"
-  rm -rf "${pkgdir}/usr/share/${pkgname}/gitstatus/usrbin/.gitkeep"
-  rm "${pkgdir}/usr/share/${pkgname}/gitstatus/.clang-format"
-  rm -rf "${pkgdir}/usr/share/${pkgname}/gitstatus/.vscode/"
+  install -d "${pkgdir}/usr/share/${pkgname}"
+  install powerlevel10k.zsh-theme powerlevel9k.zsh-theme \
+    prompt_powerlevel10k_setup prompt_powerlevel9k_setup \
+    "${pkgdir}/usr/share/${pkgname}"
+
+  find config internal -type f -exec install -D '{}' "${pkgdir}/usr/share/${pkgname}/{}" ';'
+  # p10k expects gistatus to be under the p10k directory, so create a symlink
+  ln -s /usr/share/gitstatus "${pkgdir}/usr/share/${pkgname}/gitstatus"

   cd "${pkgdir}/usr/share/${pkgname}"
-  for file in *.zsh-theme internal/*.zsh gitstatus/*.zsh gitstatus/install; do
+  for file in *.zsh-theme internal/*.zsh; do
     zsh -fc "emulate zsh -o no_aliases && zcompile -R -- $file.zwc $file"
   done
 }

could this depend on the gistatus package?

Because upstream does?