Community Packages

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#46772 - [calibre] Use github link for download (for https)

Attached to Project: Community Packages
Opened by Florez Brownlee (frownlee) - Saturday, 17 October 2015, 19:23 GMT
Last edited by Jelle van der Waa (jelly) - Sunday, 10 January 2016, 12:47 GMT
Task Type Feature Request
Category Packages
Status Closed
Assigned To Jelle van der Waa (jelly)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:

Releases are also uploaded to github, which has the advantage that downloads are done over https. In particular,
source=("https://github.com/kovidgoyal/calibre/releases/download/v${pkgver}/calibre-${pkgver}.tar.xz")
downloads the same package but securely.
This task depends upon

Closed by  Jelle van der Waa (jelly)
Sunday, 10 January 2016, 12:47 GMT
Reason for closing:  Fixed
Additional comments about closing:  Moved url's to https thanks to upstream switching to https (thanks LE)
Comment by Eli Schwartz (eschwartz) - Friday, 23 October 2015, 01:20 GMT
The GitHub releases mirror only stores the latest version of calibre. It is a bad idea to depend on disappearing urls, especially when there is a perfectly good permanent url that is already being used.

I don't see why security is an issue. Source downloads are already checksummed -- though if you want to enhance security, maybe move from md5sum to sha256sum.


But if you want to rely on GitHub downloads for the HTTPS benefits, you can use the git tag archives instead:
https://github.com/kovidgoyal/${pkgname}/archive/v${pkgver}.tar.gz

As the (built or otherwise) localizations are not contained in the source tree, you would also need a snapshot of https://github.com/kovidgoyal/calibre-translations and you'd need to add several build steps (which are already done in the *-git package I maintain in the AUR: https://aur.archlinux.org/packages/calibre-git/ )
Comment by Jelle van der Waa (jelly) - Sunday, 25 October 2015, 14:28 GMT
Calibre website does not publish a sha* or md5 hash (same for Github btw). I don't think our current package has localizations included if I am not mistaken so I would have to package that anyway.
Comment by Eli Schwartz (eschwartz) - Sunday, 25 October 2015, 15:22 GMT
The localizations are in the package already --they're in /usr/share/calibre/localization/locales.zip
It's pre-built in the tarball at calibre-${pkgver}/resources/localization/locales.zip

That's why I suggested here: https://bugs.archlinux.org/task/46148#comment138545 that the commented-out lines in the PKGBUILD could be removed.


And the sha/md5 checksums I am referring to are the ones generated by the package maintainer... I guess that doesn't work for the initial packaging... (thinking more of people building from ABS...)
Comment by Eli Schwartz (eschwartz) - Sunday, 10 January 2016, 00:54 GMT
sed -i 's/http/https/g' PKGBUILD

calibre's main website can now be accessed over HTTPS, so no need to download from GitHub at all.

Loading...