The release tar changed without a version bump

[publicarray]

Why is this bad?

• It breaks the build in multiple package managers that check their hashes.
• Looks similar to a supply chain attack
• Code has changed and this suggests a new version
• or the archive was recreated at the same commit but resulting in a different hash
• More unnecessary work for package managers

Why check for hashes or use version numbers at all if they don't matter anymore?

SynoCommunity/spksrc@ea2c240

[publicarray]

what is the difference between libsodium-1.0.18-stable.tar.gz and libsodium-1.0.18.tar.gz?

[publicarray]

The minisign command is missing a -V https://doc.libsodium.org/installation#integrity-checking

[jedisct1]

Thanks! The documentation has its own repository: https://github.com/jedisct1/libsodium-doc

[publicarray]

Thanks, that was quick!

[jedisct1]

The difference is documented here:

https://download.libsodium.org/libsodium/releases/README.html

The stable branch doesn't add or remove features over point releases.

For example, Visual Studio 2022 was just released. Required scripts to build packages for it were made, so these changes went into stable. They don't justify a new point release.

WebAssembly runtimes kept changing the way their command-line arguments work, so changes were made to keep the test suite run after these changes. That went into stable. No need for a new point release.

Same for internal documentation updates, compilation fixes or minor performance improvements. That goes into stable.

This is like your Linux distribution, that occasionally gets small non-breaking updates until the next point release. Or the STABLE branch of OpenBSD.

If you want to start a new project today, using stable is a good idea. For any value of "today" :)

If you want to occasionally build packages, use point releases. You're free to ignore the stable branch.
This is just additional work I do to do long-term maintenance of a point release until the next one.

[publicarray]

Fair points & Thank you for the thoughtful explanation. I think we used the point releases but somewhere down the line this information was lost or using stable solved a particular problem.

Edit: link to our issue: SynoCommunity/spksrc#4963

[publicarray]

Hm, I think I would argue though that compilation fixes or minor performance improvements could be a new release to keep up with tool chains and performance fixes can on rare cases change bugs or other behaviour.