From f6bbb95eeec93d1d6a01577a110e8a279786b9ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cristian=20Cezar=20Mois=C3=A9s?= Date: Mon, 31 Aug 2026 21:36:27 -0300 Subject: [PATCH] docs: use canonical release epoch --- DISTRIBUTION.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/DISTRIBUTION.md b/DISTRIBUTION.md index 0acdb76..24b0c3b 100644 --- a/DISTRIBUTION.md +++ b/DISTRIBUTION.md @@ -84,14 +84,15 @@ the result before moving it to its destination. Exporting the tree rather than the commit omits Git's commit-ID PAX header: ```sh -SOURCE_DATE_EPOCH="$(git show -s --format=%ct HEAD)" \ - make DIST_TARBALL=/tmp/zupt-5.2.8.tar.gz dist +make DIST_TARBALL=/tmp/zupt-5.2.8.tar.gz dist sha256sum /tmp/zupt-5.2.8.tar.gz ``` -With identical committed input and `SOURCE_DATE_EPOCH`, repeated exports must -have the same SHA-256 digest. Do not generate a release tarball from uncommitted -working-tree files. +The canonical release uses the tracked `.source-date-epoch`; an explicit +`SOURCE_DATE_EPOCH` override intentionally creates a different archive. With +identical committed input and epoch, repeated exports must have the same +SHA-256 digest. Do not generate a release tarball from uncommitted working-tree +files. The AUR, Homebrew, and Guix recipes pin the checksum of this tarball. They are marked `export-ignore` in `.gitattributes` so their own checksum fields do not