From 50cd5d3f05c55677432eff413a962e5c61b101c2 Mon Sep 17 00:00:00 2001 From: bryan Date: Wed, 22 Jul 2026 16:31:50 -0700 Subject: [PATCH 1/2] sqlite: point at the 3.53.3 archive (now mirrored) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every build of sqlite has been failing: HashMismatch want=c917d7db… got=a3db587a… `version` and `sha256` were bumped to 3.53.3 but this URL stayed on 3.50.4's archive, so the fetch pulled 3.50.4's bytes and checked them against 3.53.3's hash — a permanent failure, on the old toolchain and the new min/mip stack alike. Verified by hashing both objects: the mirrored 3500400 archive is a3db587a…, and c917d7db… is the correct hash of upstream's 3.53.3 tarball. The 3.53.3 archive was simply never mirrored. It is now — fetched from canonical upstream, sha256 verified against this pin before and after upload — so this only has to move to the object that should always have been here. Source stays on gs:// per LICENSING.md §3 rather than redirecting to upstream. Root cause worth naming: nothing here derives from `version`. The zero-padded release number in the archive name and the sha256 are independent copies, so an updater that rewrites the sha but not the URL turns a routine bump into a silent break. Comment added. The general fix belongs in pkgmgr — it should refuse to rewrite a sha next to a version-bearing literal URL it cannot also update — and is filed separately. Checked the other 20 packages whose literal URL lacks their version: all legitimate (toolchain bootstrap SEEDS like glibc 2.43 building from a glibc_2.40 prebuilt, libkrunfw's bundled kernel, tamarin-prover's stackage snapshot). sqlite was the only real instance. Co-Authored-By: Claude Opus 4.8 --- packages/sqlite/build.ncl | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/packages/sqlite/build.ncl b/packages/sqlite/build.ncl index 57264b16..665838d7 100644 --- a/packages/sqlite/build.ncl +++ b/packages/sqlite/build.ncl @@ -12,7 +12,12 @@ let version = "3.53.3" in build_deps = [ { file = "build.sh" } | Local, { - url = "gs://minimal-staging-archives/sqlite-autoconf-3500400.tar.gz", + # ⚠ Nothing below derives from `version` above: the mirrored archive name + # carries the zero-padded release number (3.53.3 -> 3530300) and the + # sha256 is its own copy. A bump must change all three together — this + # line was left on 3500400 while version+sha256 moved to 3.53.3, so every + # build failed HashMismatch until the 3.53.3 archive was mirrored. + url = "gs://minimal-staging-archives/sqlite-autoconf-3530300.tar.gz", sha256 = "c917d7db16648ec95f714974ace5e5dcf46b7dc70e26600a0a102a3141125db0" } | Source, base-bootstrap, From 6d1583213a569a1cb2279c60952ada372141d749 Mon Sep 17 00:00:00 2001 From: bryan Date: Wed, 22 Jul 2026 16:41:10 -0700 Subject: [PATCH 2/2] sqlite: extract the archive the build actually fetches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The buildbot failed on the previous commit: tar: sqlite-autoconf-3500400.tar.gz: Cannot open: No such file or directory build.sh was ALSO half-updated by the 3.53.3 bump — line 5 already said `cd sqlite-autoconf-3530300` while line 4 still extracted `sqlite-autoconf-3500400.tar.gz`. Before, that combination merely never got the chance to fail: the fetch died on HashMismatch first. Fixing the URL moved the failure one step later, to this. The version is encoded in FIVE independent places across the package — `version`, the archive name in the URL, the sha256, the `tar` argument and the `cd` target — and the bump updated three. This is the last one. `tar -xof` retained: the disallowed-patterns checker requires that exact form. Co-Authored-By: Claude Opus 4.8 --- packages/sqlite/build.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/packages/sqlite/build.sh b/packages/sqlite/build.sh index 051ff90d..4ec0f5f7 100755 --- a/packages/sqlite/build.sh +++ b/packages/sqlite/build.sh @@ -1,7 +1,10 @@ #!/bin/sh set -e -tar -xof sqlite-autoconf-3500400.tar.gz +# Both names must match the archive in build.ncl. The 3.53.3 bump updated the +# `cd` but not the `tar`, so this extracted 3.50.4 and then changed into a +# directory that did not exist. +tar -xof sqlite-autoconf-3530300.tar.gz cd sqlite-autoconf-3530300 case $(uname -m) in