reproducibility issue sha256sum changed on 5.1 archive

[ConYel]

Dear @Changaco,
thank you for this useful package.

I would like to ask you if you happen to know why the
https://github.com/Changaco/python-libarchive-c/archive/5.1.tar.gz

sha256sum python-libarchive-c-5.1.tar.gz
5051c6d157d03cc0891e5f1051edf5122d6e9b82c58cd30e898dea818e7ff014  python-libarchive-c-5.1.tar.gz

has different sha256sum from the one on August 20.
Here is the commit I made with the version that I got on that day or 1-2 days before:

sha256sum: b8198dd259684f75622112eb3172800780fbedda0a83652d22d36db0d4c0433c

https://codeberg.org/stagex/stagex/src/commit/266467f61bc62e8e67ce5a72309ba0d127d015af/packages/py-libarchive/Containerfile#L3

Thank you for your time!

PS: If it doesn't burden/bother you much, it would be super helpful for everybody using this package if you were pgp signing your git commits!

[Changaco]

I don't know. You might want to ask GitHub, as these archives are automatically generated by their software.

[Changaco]

I'm unable to locally produce (with git archive --format=tar.gz --prefix=python-libarchive-c-5.1/ 5.1 >archive.tar.gz) the exact same file GitHub provides, but the uncompressed tar files (gzip -d) are identical (sha256sum a8c13c2f8a16219459acc78366a7cc0291b9812a849da4371d0b560311d9d143), so the difference is only in the compression. The gzip I'm using is version 1.13-4 from Arch Linux.

[ConYel]

Thank you for looking into that.
If we check the pypi archive:

wget https://files.pythonhosted.org/packages/a0/f9/3b6cd86e683a06bc28b9c2e1d9fe0bd7215f2750fd5c85dce0df96db8eca/libarchive-c-5.1.tar.gz
sha256sum libarchive-c-5.1.tar.gz
7bcce24ea6c0fa3bc62468476c6d2f6264156db2f04878a372027c10615a2721  libarchive-c-5.1.tar.gz

wget https://github.com/Changaco/python-libarchive-c/archive/5.1.tar.gz
sha256sum 5.1.tar.gz
5051c6d157d03cc0891e5f1051edf5122d6e9b82c58cd30e898dea818e7ff014  5.1.tar.gz

Then :

diffoscope --markdown diff_libarchive.5.1_github_pypi.md  libarchive-c-5.1.tar.gz 5.1.tar.gz

Here the differences:

Comparing libarchive-c-5.1.tar.gz & 5.1.tar.gz

filetype from file(1)

@@ -1 +1 @@
-gzip compressed data, was "libarchive-c-5.1.tar", last modified: Tue Mar  5 13:14:23 2024, max compression
+gzip compressed data, from Unix

Comparing libarchive-c-5.1.tar & 5.1.tar

file list

@@ -1,53 +1,47 @@
-drwxr-xr-x   0 changaco  (1142) users      (100)        0 2024-03-05 13:14:23.498132 libarchive-c-5.1/
--rw-r--r--   0 changaco  (1142) users      (100)       25 2016-11-29 18:03:26.000000 libarchive-c-5.1/.gitattributes
-drwxr-xr-x   0 changaco  (1142) users      (100)        0 2024-03-05 13:14:23.494799 libarchive-c-5.1/.github/
--rw-r--r--   0 changaco  (1142) users      (100)       20 2021-05-24 14:29:37.000000 libarchive-c-5.1/.github/FUNDING.yml
-drwxr-xr-x   0 changaco  (1142) users      (100)        0 2024-03-05 13:14:23.494799 libarchive-c-5.1/.github/workflows/
--rw-r--r--   0 changaco  (1142) users      (100)      998 2023-06-29 08:33:58.000000 libarchive-c-5.1/.github/workflows/main.yml
--rw-r--r--   0 changaco  (1142) users      (100)       65 2016-11-29 18:03:29.000000 libarchive-c-5.1/.gitignore
--rw-r--r--   0 changaco  (1142) users      (100)       51 2018-06-10 12:43:23.000000 libarchive-c-5.1/LICENSE.md
--rw-r--r--   0 changaco  (1142) users      (100)       19 2016-11-29 18:03:22.000000 libarchive-c-5.1/MANIFEST.in
--rw-r--r--   0 changaco  (1142) users      (100)     5308 2024-03-05 13:14:23.498132 libarchive-c-5.1/PKG-INFO
--rw-r--r--   0 changaco  (1142) users      (100)     4977 2023-07-04 08:05:38.000000 libarchive-c-5.1/README.rst
-drwxr-xr-x   0 changaco  (1142) users      (100)        0 2024-03-05 13:14:23.494799 libarchive-c-5.1/libarchive/
--rw-r--r--   0 changaco  (1142) users      (100)      601 2021-05-24 15:08:51.000000 libarchive-c-5.1/libarchive/__init__.py
--rw-r--r--   0 changaco  (1142) users      (100)    14436 2024-03-05 13:13:34.000000 libarchive-c-5.1/libarchive/entry.py
--rw-r--r--   0 changaco  (1142) users      (100)      370 2021-05-24 15:09:05.000000 libarchive-c-5.1/libarchive/exception.py
--rw-r--r--   0 changaco  (1142) users      (100)     2694 2022-01-22 17:28:18.000000 libarchive-c-5.1/libarchive/extract.py
--rw-r--r--   0 changaco  (1142) users      (100)    12593 2023-07-04 08:05:38.000000 libarchive-c-5.1/libarchive/ffi.py
--rw-r--r--   0 changaco  (1142) users      (100)      211 2018-06-10 13:27:14.000000 libarchive-c-5.1/libarchive/flags.py
--rw-r--r--   0 changaco  (1142) users      (100)     5923 2024-03-05 13:13:34.000000 libarchive-c-5.1/libarchive/read.py
--rw-r--r--   0 changaco  (1142) users      (100)    10444 2023-07-04 08:05:38.000000 libarchive-c-5.1/libarchive/write.py
-drwxr-xr-x   0 changaco  (1142) users      (100)        0 2024-03-05 13:14:23.498132 libarchive-c-5.1/libarchive_c.egg-info/
--rw-r--r--   0 changaco  (1142) users      (100)     5308 2024-03-05 13:14:23.000000 libarchive-c-5.1/libarchive_c.egg-info/PKG-INFO
--rw-r--r--   0 changaco  (1142) users      (100)     1010 2024-03-05 13:14:23.000000 libarchive-c-5.1/libarchive_c.egg-info/SOURCES.txt
--rw-r--r--   0 changaco  (1142) users      (100)        1 2024-03-05 13:14:23.000000 libarchive-c-5.1/libarchive_c.egg-info/dependency_links.txt
--rw-r--r--   0 changaco  (1142) users      (100)       11 2024-03-05 13:14:23.000000 libarchive-c-5.1/libarchive_c.egg-info/top_level.txt
--rw-r--r--   0 changaco  (1142) users      (100)      136 2024-03-05 13:14:23.498132 libarchive-c-5.1/setup.cfg
--rw-r--r--   0 changaco  (1142) users      (100)      669 2023-06-29 08:33:58.000000 libarchive-c-5.1/setup.py
-drwxr-xr-x   0 changaco  (1142) users      (100)        0 2024-03-05 13:14:23.498132 libarchive-c-5.1/tests/
--rw-r--r--   0 changaco  (1142) users      (100)     4297 2021-05-24 15:09:05.000000 libarchive-c-5.1/tests/__init__.py
-drwxr-xr-x   0 changaco  (1142) users      (100)        0 2024-03-05 13:14:23.498132 libarchive-c-5.1/tests/data/
--rw-r--r--   0 changaco  (1142) users      (100)    10240 2018-06-10 11:44:59.000000 libarchive-c-5.1/tests/data/flags.tar
--rw-r--r--   0 changaco  (1142) users      (100)   112640 2016-11-29 18:03:26.000000 libarchive-c-5.1/tests/data/special.tar
--rw-r--r--   0 changaco  (1142) users      (100)    10240 2016-11-29 18:03:26.000000 libarchive-c-5.1/tests/data/tar_relative.tar
--rw-r--r--   0 changaco  (1142) users      (100)      195 2016-11-29 18:03:26.000000 libarchive-c-5.1/tests/data/testtar.README
--rw-r--r--   0 changaco  (1142) users      (100)   435200 2016-11-29 18:03:26.000000 libarchive-c-5.1/tests/data/testtar.tar
--rw-r--r--   0 changaco  (1142) users      (100)    16670 2018-06-10 13:01:15.000000 libarchive-c-5.1/tests/data/testtar.tar.json
--rw-r--r--   0 changaco  (1142) users      (100)    10240 2016-11-29 18:03:26.000000 libarchive-c-5.1/tests/data/unicode.tar
--rw-r--r--   0 changaco  (1142) users      (100)     1036 2018-06-10 11:44:59.000000 libarchive-c-5.1/tests/data/unicode.tar.json
--rw-r--r--   0 changaco  (1142) users      (100)      668 2016-11-29 18:03:26.000000 libarchive-c-5.1/tests/data/unicode.zip
--rw-r--r--   0 changaco  (1142) users      (100)      660 2018-06-10 11:44:59.000000 libarchive-c-5.1/tests/data/unicode.zip.json
--rw-r--r--   0 changaco  (1142) users      (100)      636 2016-11-29 18:03:26.000000 libarchive-c-5.1/tests/data/unicode2.zip
--rw-r--r--   0 changaco  (1142) users      (100)      649 2018-06-10 11:44:59.000000 libarchive-c-5.1/tests/data/unicode2.zip.json
--rw-r--r--   0 changaco  (1142) users      (100)      183 2016-11-29 18:03:26.000000 libarchive-c-5.1/tests/data/프로그램.README
--rw-r--r--   0 changaco  (1142) users      (100)      355 2016-11-29 18:03:26.000000 libarchive-c-5.1/tests/data/프로그램.zip
--rw-r--r--   0 changaco  (1142) users      (100)      676 2018-06-10 11:44:59.000000 libarchive-c-5.1/tests/data/프로그램.zip.json
--rw-r--r--   0 changaco  (1142) users      (100)     4713 2021-05-24 15:09:05.000000 libarchive-c-5.1/tests/test_atime_mtime_ctime.py
--rw-r--r--   0 changaco  (1142) users      (100)      717 2021-05-24 15:09:05.000000 libarchive-c-5.1/tests/test_convert.py
--rw-r--r--   0 changaco  (1142) users      (100)     5018 2024-03-03 14:29:07.000000 libarchive-c-5.1/tests/test_entry.py
--rw-r--r--   0 changaco  (1142) users      (100)     1206 2021-05-24 15:09:05.000000 libarchive-c-5.1/tests/test_errors.py
--rw-r--r--   0 changaco  (1142) users      (100)     6206 2024-03-05 13:13:34.000000 libarchive-c-5.1/tests/test_rwx.py
--rw-r--r--   0 changaco  (1142) users      (100)      917 2022-01-22 17:28:18.000000 libarchive-c-5.1/tests/test_security_flags.py
--rw-r--r--   0 changaco  (1142) users      (100)      286 2024-03-05 13:13:14.000000 libarchive-c-5.1/tox.ini
--rw-r--r--   0 changaco  (1142) users      (100)     1354 2023-06-29 08:33:58.000000 libarchive-c-5.1/version.py
+drwxrwxr-x   0 root         (0) root         (0)        0 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/
+-rw-rw-r--   0 root         (0) root         (0)       25 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/.gitattributes
+drwxrwxr-x   0 root         (0) root         (0)        0 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/.github/
+-rw-rw-r--   0 root         (0) root         (0)       20 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/.github/FUNDING.yml
+drwxrwxr-x   0 root         (0) root         (0)        0 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/.github/workflows/
+-rw-rw-r--   0 root         (0) root         (0)      998 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/.github/workflows/main.yml
+-rw-rw-r--   0 root         (0) root         (0)       65 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/.gitignore
+-rw-rw-r--   0 root         (0) root         (0)       51 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/LICENSE.md
+-rw-rw-r--   0 root         (0) root         (0)       19 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/MANIFEST.in
+-rw-rw-r--   0 root         (0) root         (0)     4977 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/README.rst
+drwxrwxr-x   0 root         (0) root         (0)        0 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/libarchive/
+-rw-rw-r--   0 root         (0) root         (0)      601 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/libarchive/__init__.py
+-rw-rw-r--   0 root         (0) root         (0)    14436 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/libarchive/entry.py
+-rw-rw-r--   0 root         (0) root         (0)      370 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/libarchive/exception.py
+-rw-rw-r--   0 root         (0) root         (0)     2694 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/libarchive/extract.py
+-rw-rw-r--   0 root         (0) root         (0)    12593 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/libarchive/ffi.py
+-rw-rw-r--   0 root         (0) root         (0)      211 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/libarchive/flags.py
+-rw-rw-r--   0 root         (0) root         (0)     5923 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/libarchive/read.py
+-rw-rw-r--   0 root         (0) root         (0)    10444 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/libarchive/write.py
+-rw-rw-r--   0 root         (0) root         (0)       95 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/setup.cfg
+-rw-rw-r--   0 root         (0) root         (0)      669 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/setup.py
+drwxrwxr-x   0 root         (0) root         (0)        0 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/
+-rw-rw-r--   0 root         (0) root         (0)     4297 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/__init__.py
+drwxrwxr-x   0 root         (0) root         (0)        0 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/
+-rw-rw-r--   0 root         (0) root         (0)    10240 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/flags.tar
+-rw-rw-r--   0 root         (0) root         (0)   112640 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/special.tar
+-rw-rw-r--   0 root         (0) root         (0)    10240 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/tar_relative.tar
+-rw-rw-r--   0 root         (0) root         (0)      195 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/testtar.README
+-rw-rw-r--   0 root         (0) root         (0)   435200 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/testtar.tar
+-rw-rw-r--   0 root         (0) root         (0)    16670 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/testtar.tar.json
+-rw-rw-r--   0 root         (0) root         (0)    10240 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/unicode.tar
+-rw-rw-r--   0 root         (0) root         (0)     1036 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/unicode.tar.json
+-rw-rw-r--   0 root         (0) root         (0)      668 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/unicode.zip
+-rw-rw-r--   0 root         (0) root         (0)      660 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/unicode.zip.json
+-rw-rw-r--   0 root         (0) root         (0)      636 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/unicode2.zip
+-rw-rw-r--   0 root         (0) root         (0)      649 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/unicode2.zip.json
+-rw-rw-r--   0 root         (0) root         (0)      183 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/프로그램.README
+-rw-rw-r--   0 root         (0) root         (0)      355 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/프로그램.zip
+-rw-rw-r--   0 root         (0) root         (0)      676 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/data/프로그램.zip.json
+-rw-rw-r--   0 root         (0) root         (0)     4713 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/test_atime_mtime_ctime.py
+-rw-rw-r--   0 root         (0) root         (0)      717 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/test_convert.py
+-rw-rw-r--   0 root         (0) root         (0)     5018 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/test_entry.py
+-rw-rw-r--   0 root         (0) root         (0)     1206 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/test_errors.py
+-rw-rw-r--   0 root         (0) root         (0)     6206 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/test_rwx.py
+-rw-rw-r--   0 root         (0) root         (0)      917 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tests/test_security_flags.py
+-rw-rw-r--   0 root         (0) root         (0)      286 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/tox.ini
+-rw-rw-r--   0 root         (0) root         (0)     1351 2024-03-05 13:06:48.000000 python-libarchive-c-5.1/version.py

Comparing libarchive-c-5.1/.github/workflows/main.yml & python-libarchive-c-5.1/.github/workflows/main.yml

• Files identical despite different names

Comparing libarchive-c-5.1/PKG-INFO & python-libarchive-c-5.1/README.rst

• Files 3% similar despite different names

@@ -1,19 +1,7 @@
-Metadata-Version: 2.1
-Name: libarchive-c
-Version: 5.1
-Summary: Python interface to libarchive
-Home-page: https://github.com/Changaco/python-libarchive-c
-Author: Changaco
-Author-email: changaco@changaco.oy.lc
-License: CC0
-Keywords: archive libarchive 7z tar bz2 zip gz
-Description-Content-Type: text/x-rst
-License-File: LICENSE.md
-
 A Python interface to libarchive. It uses the standard ctypes_ module to
 dynamically load and access the C library.
 
 .. _ctypes: https://docs.python.org/3/library/ctypes.html
 
 Installation
 ============

Comparing libarchive-c-5.1/libarchive/__init__.py & python-libarchive-c-5.1/libarchive/__init__.py

• Files identical despite different names

Comparing libarchive-c-5.1/libarchive/entry.py & python-libarchive-c-5.1/libarchive/entry.py

• Files identical despite different names

Comparing libarchive-c-5.1/libarchive/extract.py & python-libarchive-c-5.1/libarchive/extract.py

• Files identical despite different names

Comparing libarchive-c-5.1/libarchive/ffi.py & python-libarchive-c-5.1/libarchive/ffi.py

• Files identical despite different names

Comparing libarchive-c-5.1/libarchive/read.py & python-libarchive-c-5.1/libarchive/read.py

• Files identical despite different names

Comparing libarchive-c-5.1/libarchive/write.py & python-libarchive-c-5.1/libarchive/write.py

• Files identical despite different names

Comparing libarchive-c-5.1/setup.py & python-libarchive-c-5.1/setup.py

• Files identical despite different names

Comparing libarchive-c-5.1/tests/__init__.py & python-libarchive-c-5.1/tests/__init__.py

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/flags.tar & python-libarchive-c-5.1/tests/data/flags.tar

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/special.tar & python-libarchive-c-5.1/tests/data/special.tar

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/tar_relative.tar & python-libarchive-c-5.1/tests/data/tar_relative.tar

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/testtar.tar & python-libarchive-c-5.1/tests/data/testtar.tar

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/testtar.tar.json & python-libarchive-c-5.1/tests/data/testtar.tar.json

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/unicode.tar & python-libarchive-c-5.1/tests/data/unicode.tar

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/unicode.tar.json & python-libarchive-c-5.1/tests/data/unicode.tar.json

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/unicode.zip & python-libarchive-c-5.1/tests/data/unicode.zip

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/unicode.zip.json & python-libarchive-c-5.1/tests/data/unicode.zip.json

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/unicode2.zip & python-libarchive-c-5.1/tests/data/unicode2.zip

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/unicode2.zip.json & python-libarchive-c-5.1/tests/data/unicode2.zip.json

• Files identical despite different names

Comparing libarchive-c-5.1/tests/data/프로그램.zip.json & python-libarchive-c-5.1/tests/data/프로그램.zip.json

• Files identical despite different names

Comparing libarchive-c-5.1/tests/test_atime_mtime_ctime.py & python-libarchive-c-5.1/tests/test_atime_mtime_ctime.py

• Files identical despite different names

Comparing libarchive-c-5.1/tests/test_convert.py & python-libarchive-c-5.1/tests/test_convert.py

• Files identical despite different names

Comparing libarchive-c-5.1/tests/test_entry.py & python-libarchive-c-5.1/tests/test_entry.py

• Files identical despite different names

Comparing libarchive-c-5.1/tests/test_errors.py & python-libarchive-c-5.1/tests/test_errors.py

• Files identical despite different names

Comparing libarchive-c-5.1/tests/test_rwx.py & python-libarchive-c-5.1/tests/test_rwx.py

• Files identical despite different names

Comparing libarchive-c-5.1/tests/test_security_flags.py & python-libarchive-c-5.1/tests/test_security_flags.py

• Files identical despite different names

Comparing libarchive-c-5.1/version.py & python-libarchive-c-5.1/version.py

• Files 10% similar despite different names

@@ -9,15 +9,15 @@
 
 tag_re = re.compile(r'\btag: %s([0-9][^,]*)\b' % PREFIX)
 version_re = re.compile('^Version: (.+)$', re.M)
 
 
 def get_version():
     # Return the version if it has been injected into the file by git-archive
-    version = tag_re.search('$Format:%D$')
+    version = tag_re.search('tag: 5.1')
     if version:
         return version.group(1)
 
     d = dirname(__file__)
 
     if isdir(join(d, '.git')):
         # Get the version using "git describe".

[Changaco]

The archives in PyPI aren't generated by git archive. Also, they're static files, so you might want to use them instead of the ones generated by GitHub, as this would solve your problem of unstable hashes.