Skip to content

Conversation

@zewenn
Copy link
Contributor

@zewenn zewenn commented Mar 7, 2025

The new zig version changed the build.zig.zon file. Not updating to the new standard causes the projects to automatically re-fetch the package on every build (resulting in 10-15 second build times).

I have updated the build.zig.zon to use zig v0.14.0 and the appropriate fingerprint.

@raysan5 raysan5 merged commit 590f793 into raysan5:master Mar 7, 2025
@raysan5
Copy link
Owner

raysan5 commented Mar 7, 2025

@zewenn thanks for the review!

@10aded
Copy link
Contributor

10aded commented Mar 8, 2025

Great, this closes #4814.

However, per the documentation when creating a package via zig init, it is highly recommended that for security reasons a comment accompany the fingerprint line.

From build.zig.zon when generated via zig init:

// Together with name, this represents a globally unique package
// identifier. This field is generated by the Zig toolchain when the
// package is first created, and then *never changes*. This allows
// unambiguous detection of one package being an updated version of
// another.
//
// When forking a Zig project, this id should be regenerated (delete the
// field and run `zig build`) if the upstream project is still maintained.
// Otherwise, the fork is *hostile*, attempting to take control over the
// original project's identity. Thus it is recommended to leave the comment
// on the following line intact, so that it shows up in code reviews that
// modify the field.
.fingerprint = 0x6f178c1f29db3887, // Changing this has security and trust implications.

The fingerprint line should have the comment

// Changing this has security and trust implications.

I'll submit a pull request with this change soon.

@10aded
Copy link
Contributor

10aded commented Mar 8, 2025

PR made: #4827

mjhanninen pushed a commit to mjhanninen/raylib that referenced this pull request Jul 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants