From 00463ae4b3ae4e994b9ce3314076bda3ac2790fb Mon Sep 17 00:00:00 2001
From: agw <cla@weircon.dk>
Date: Wed, 30 Sep 2026 21:45:00 +0200
Subject: [PATCH] Name tarballs by content so a cached copy can never be stale

The tarball host serves archives as immutable for a year, but a rebuild of
the same JASP version reused jasp-desktop-<ver>-x86_64.tar.zst with new bytes,
so a cache could hand out the old tarball against the new PKGBUILD's sha256.
The name now carries the first 12 hex digits of its sha256, and the PKGBUILD
keeps that name locally too, so a stale download in the build directory no
longer fails the checksum either.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
---
 build/build-jasp.sh   | 15 ++++++++++-----
 packaging/PKGBUILD.in |  5 ++++-
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/build/build-jasp.sh b/build/build-jasp.sh
index 97a3fea..6b74d4d 100755
--- a/build/build-jasp.sh
+++ b/build/build-jasp.sh
@@ -579,13 +579,18 @@ ICU_MAJOR="$(echo "$ICU_FULL" | grep -oE '^[0-9]+')"
 BOOST_FULL="$(pkgver_of boost-libs)"
 
 JASP_VER="${JASP_TAG#v}"
-TARBALL="jasp-desktop-${JASP_VER}-x86_64.tar.zst"
-
-log "creating $TARBALL"
+# The name carries a prefix of the content hash. The tarball host serves these
+# as immutable for a year, so a name must never be reused for different bytes:
+# a rebuild of the same JASP version would otherwise let a cache hand out the
+# old tarball against the new PKGBUILD's sha256.
+log "creating tarball"
 cd "$STAGE_DIR"
-tar --zstd -cf "$OUT_DIR/$TARBALL" .
-SHA256="$(sha256sum "$OUT_DIR/$TARBALL" | awk '{print $1}')"
+tar --zstd -cf "$OUT_DIR/jasp-desktop.tar.zst.tmp" .
+SHA256="$(sha256sum "$OUT_DIR/jasp-desktop.tar.zst.tmp" | awk '{print $1}')"
+TARBALL="jasp-desktop-${JASP_VER}-${SHA256:0:12}-x86_64.tar.zst"
+mv "$OUT_DIR/jasp-desktop.tar.zst.tmp" "$OUT_DIR/$TARBALL"
 SIZE="$(stat -c%s "$OUT_DIR/$TARBALL")"
+log "created $TARBALL"
 
 cat >"$OUT_DIR/build-info.json" <<EOF
 {
diff --git a/packaging/PKGBUILD.in b/packaging/PKGBUILD.in
index 5569f32..9b596c8 100644
--- a/packaging/PKGBUILD.in
+++ b/packaging/PKGBUILD.in
@@ -51,7 +51,10 @@ depends=(
 # modules, and the rpath set at build time must survive untouched.
 options=('!strip' '!debug' '!libtool' '!staticlibs' '!zipman' '!purge' '!emptydirs')
 
-source=("jasp-desktop-${pkgver}-${pkgrel}-x86_64.tar.zst::@DOWNLOAD_URL@")
+# The remote name is content-addressed, so it is kept as the local name too: a
+# stale download left in the build directory can never be mistaken for the
+# current tarball and fail the checksum.
+source=("@DOWNLOAD_URL@")
 sha256sums=('@SHA256@')
 
 package() {