-
Notifications
You must be signed in to change notification settings - Fork 15
Fix mbedtls build #209
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix mbedtls build #209
Conversation
Why use commit when there's https://github.com/Mbed-TLS/mbedtls/archive/refs/tags/v2.16.12.tar.gz |
The reason I picked the commit is that tags can be changed and GitHub does not guarantee that release source archives stay the same. So the commit sha is the only safe thing to use. |
Github actually (so far) guarantees that source archives are immutable See, for example, https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.16.12 - it was released 3 years ago, yet sha sum of archives listed in release notes are still valid |
probably too late, but the Fedora project site hosts the mbedtls packages, here's the link for the v2.16.12: btw, this file is the exact same, and keeps the sha256 sum unmodified |
Thanks for the help @bucanero :D |
The download url no longer goes anywhere useful, so I changed the PSPBUILD to use git and pull the commit that corresponds with the release we were already building. I also did some minor consistency fixes in the PSPBUILD.