Github generated tarballs change randomly

[bket]

As the title states, github generated tarballs can change at any point. This creates issues for packaging on systems like OpenBSD ports. Would it be possible to get official tarballs created / attached to releases?

[dbaarda]

What!?!? This sounds nasty. Is there any bug/discussion about this I can read up on?

Would downloading and then uploading the built tarball be enough to "freeze" it?

[bket]

There are plenty of sources that had a discussion on this 'feature', for example:

• checksums for source tarballs downloaded from github.com/.../.../archive can change over time easybuilders/easybuild-easyconfigs#5151
• SHA256 checksum changed for v0.26.0 libgit2/libgit2#4343 (comment)
• Checksums that have changed Homebrew/homebrew-core#18044
• https://marc.info/?l=openbsd-ports&m=151973450514279&w=2

[dbaarda]

It looks like if we download the tar.gz after creating a release, then edit the release and upload it, you end up with another downloadable target that should be stable. I just did this for the v2.0.2 release.

I'm going to update the release procedure docs to include doing this, and then declare it fixed.