Release Tag Changed, Breaking Checksums, and AUR Package Building

[daskol]

The latest v4.50.2 release of this project has changed its tag and re-published, leading to modified checksums. This breaks package building in ArchLinux's AUR (see dicussion) and ArchLinux AI unofficial repo. It affects users relying on a stable source archive.

• The AUR package downloads the source from the release (release tag).
• The checksum verification fails because the archive has changed.
• Users are unable to install or update the package.

Please clarify why this change occurred and take steps to prevent such issues in the future. Ensuring stable and predictable releases benefits the entire user and maintainer community. Thank you for your attention to this matter!

Expected Behavior

Release tags should remain immutable once published to ensure stability and reproducibility for package maintainers and users.

Actual Behavior

1. The release tag was changed, leading to different source files.
2. The checksum of the archive no longer matches the originally published one.
3. This disrupts automated and manual builds in Arch Linux AUR.

Suggested Resolution

Please do not modify or re-upload files under an existing release tag. This causes issues for downstream users and package maintainers.

• If changes are necessary, create a new release with a new tag.
• If a change was unintentional, consider restoring the original archive to maintain consistency.

[Rocketknight1]

cc @ArthurZucker @LysandreJik for releases

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. If you think this still needs to be addressed please comment on this thread.

Please note that issues that do not follow the contributing guidelines are likely to be ignored.

[daskol]

Just want to highlight importance of tarball stability. Changing release archives breaks builds in Arch Linux and other systems. For reproducibility, it’s important releases stay unchanged. Thank you.

[ArthurZucker]

Super sorry I think we were in a rush to push it out, leading to local changes that might not have been on the tarball

[ArthurZucker]

Thanks for reporting, we can't really do anything on pypi-side, would it help if we update the tag on github?

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. If you think this still needs to be addressed please comment on this thread.

Please note that issues that do not follow the contributing guidelines are likely to be ignored.