fix: make Arch packaging checksum release-time generated

Author: devmobasa

packaging/.SRCINFO

@@ -17,6 +17,6 @@ pkgbase = wayscriber
 	depends = grim
 	depends = slurp
 	source = wayscriber-0.9.19.tar.gz::https://github.com/devmobasa/wayscriber/archive/refs/tags/v0.9.19.tar.gz
-	sha256sums = e0f569b4b6c7d4f1d0735f32cfc71ae4a8304255a51dffb35198ce4f3d86597d
+	sha256sums = SKIP
 
 pkgname = wayscriber

packaging/PKGBUILD

@@ -21,7 +21,8 @@ makedepends=(
     'cargo'
 )
 source=("$pkgname-$pkgver.tar.gz::https://github.com/devmobasa/wayscriber/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('e0f569b4b6c7d4f1d0735f32cfc71ae4a8304255a51dffb35198ce4f3d86597d')
+# Template only: release/AUR automation replaces this after the tag exists.
+sha256sums=('SKIP')
 
 prepare() {
     cd "$pkgname-$pkgver"

tools/README.md

@@ -53,6 +53,7 @@ Helper scripts for development, installation, packaging, and release workflows.
 Packaging-only hotfix policy:
 - Normal releases use one version everywhere: Cargo, package metadata, Git tags, and artifacts all use `X.Y.Z`.
 - Hotfix releases may use `X.Y.Z.N` only when the Cargo version is still `X.Y.Z`. In that case, `packaging/PKGBUILD`, `packaging/.SRCINFO`, release artifacts, and AUR metadata use `X.Y.Z.N`; Cargo manifests and `flake.nix` stay on `X.Y.Z`.
+- Repo `packaging/PKGBUILD` and `packaging/.SRCINFO` are templates and keep `sha256sums=('SKIP')` because the final GitHub tag archive checksum can only be computed after the tag exists. AUR automation writes the real checksum into external AUR metadata.
 - Release builds set `WAYSCRIBER_RELEASE_VERSION`, so packaged binaries report the release artifact version. Nix builds follow Cargo and report `X.Y.Z` unless the Cargo version itself is bumped.
 
 - **create-release-tag.sh** - Create git tag (local only)

tools/bump-version.sh

@@ -15,9 +15,12 @@ Usage: tools/bump-version.sh [--dry-run] [new_version]
   * Cargo.lock (via cargo generate-lockfile)
   * configurator/Cargo.lock local package versions
   * flake.nix package version follows Cargo.toml automatically
-  * packaging/PKGBUILD pkgver
+  * packaging/PKGBUILD pkgver and template sha256sums=('SKIP')
   * packaging/.SRCINFO (via makepkg --printsrcinfo)
 
+The repo PKGBUILD is a template: release/AUR automation computes the real
+source archive checksum after the tag exists.
+
 Requires: cargo, jq, makepkg, sed, perl, python3 or python pointing to Python 3.
 EOF
 }
@@ -163,9 +166,10 @@ fi
 
 if [[ -f packaging/PKGBUILD ]]; then
     if $DRY_RUN; then
-        echo "dry-run: would set pkgver=${package_version} in packaging/PKGBUILD and regenerate .SRCINFO"
+        echo "dry-run: would set pkgver=${package_version}, reset sha256sums=SKIP, and regenerate .SRCINFO"
     else
         sed -i "s/^pkgver=.*/pkgver=${package_version}/" packaging/PKGBUILD
+        sed -i "s/^sha256sums=.*/sha256sums=('SKIP')/" packaging/PKGBUILD
         (cd packaging && makepkg --printsrcinfo > .SRCINFO)
     fi
 else

tools/check-version-consistency.sh

@@ -14,6 +14,10 @@ Checks that release/version metadata agrees across:
   * packaging/.SRCINFO
   * flake.nix
 
+Repo packaging metadata is a release template and must use sha256sums=('SKIP').
+Release/AUR automation writes the real source archive checksum after the tag
+exists.
+
 When --release-version is provided, it must either match Cargo.toml exactly
 or be a packaging hotfix version of the Cargo version (for example, Cargo
 0.9.19 with release 0.9.19.1). Hotfix releases require packaging/PKGBUILD
@@ -77,6 +81,7 @@ release_version = sys.argv[2] or None
 errors = []
 
 version_re = re.compile(r"^\d+\.\d+\.\d+(?:\.\d+)?$")
+checksum_re = re.compile(r"^[0-9a-fA-F]{64}$")
 
 def read_text(path):
     return (root / path).read_text(encoding="utf-8")
@@ -112,13 +117,47 @@ def srcinfo_version(path):
     match = re.search(r"^\s*pkgver = (.+)$", read_text(path), re.MULTILINE)
     return match.group(1).strip() if match else None
 
+def pkgbuild_sha256sums(path):
+    match = re.search(r"(?ms)^sha256sums=\((.*?)\)", read_text(path))
+    if not match:
+        return []
+
+    values = []
+    for value_match in re.finditer(r"'([^']*)'|\"([^\"]*)\"|(\S+)", match.group(1)):
+        value = next(group for group in value_match.groups() if group is not None)
+        values.append(value.strip())
+    return values
+
+def srcinfo_sha256sums(path):
+    return [
+        match.group(1).strip()
+        for match in re.finditer(r"^\s*sha256sums = (.+)$", read_text(path), re.MULTILINE)
+    ]
+
 def is_hotfix_of(version, base):
     return re.fullmatch(re.escape(base) + r"\.\d+", version) is not None
 
 def require_equal(label, actual, expected):
     if actual != expected:
         errors.append(f"{label}: expected {expected}, got {actual or 'missing'}")
 
+def require_template_sha256sums(label, values):
+    if values == ["SKIP"]:
+        return
+
+    if not values:
+        errors.append(f"{label}: expected SKIP template checksum, got missing")
+        return
+
+    actual = ", ".join(values)
+    if any(checksum_re.fullmatch(value) for value in values):
+        errors.append(
+            f"{label}: expected SKIP template checksum, got fixed SHA {actual}; "
+            "release/AUR automation writes the real checksum after the tag exists"
+        )
+    else:
+        errors.append(f"{label}: expected SKIP template checksum, got {actual}")
+
 root_version = cargo_version("Cargo.toml")
 config_version = cargo_version("configurator/Cargo.toml")
 require_equal("configurator/Cargo.toml", config_version, root_version)
@@ -153,6 +192,12 @@ else:
 
 require_equal("packaging/PKGBUILD pkgver", packaging_version, expected_packaging_version)
 require_equal("packaging/.SRCINFO pkgver", srcinfo_pkgver, expected_packaging_version)
+require_template_sha256sums(
+    "packaging/PKGBUILD sha256sums", pkgbuild_sha256sums("packaging/PKGBUILD")
+)
+require_template_sha256sums(
+    "packaging/.SRCINFO sha256sums", srcinfo_sha256sums("packaging/.SRCINFO")
+)
 
 flake_text = read_text("flake.nix")
 if "builtins.fromTOML (builtins.readFile ./Cargo.toml)" not in flake_text:
@@ -164,5 +209,8 @@ if errors:
         print(f"- {error}", file=sys.stderr)
     sys.exit(1)
 
-print(f"Version consistency OK: Cargo={root_version}, packaging={expected_packaging_version}")
+print(
+    f"Version consistency OK: Cargo={root_version}, "
+    f"packaging={expected_packaging_version}, checksum=SKIP"
+)
 PY