|
|
|
|
|
|
by embedding-shape
2 hours ago
|
|
|
Usually you concat them to form the GitHub tarball URL or similar, so on updates you only review the version/hash bumps, as on install you've validated the right GitHub organization/domain already. Babashka has this for example (https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=babas...): pkgname=babashka-bin
pkgver=1.13.219
url='https://github.com/borkdude/babashka'
source_x86_64=("${pkgname}-${pkgver}-linux-amd64-static.tar.gz::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-linux-amd64-static.tar.gz")
So on install, you review ideally everything, but at least the URL/organization/domain. Then on updates, you've already validated them, so the pkgver bump is the only thing of interest. |
|
|