From 0d9e352fc89ed0dd4453c33cccba313c5d65a9fd Mon Sep 17 00:00:00 2001 From: Dmitrii Vasilev Date: Thu, 13 Aug 2026 21:05:50 +0700 Subject: [PATCH] fix: correct the golden_float hash and pin its url to a commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This manifest declares golden_float-2.1.0-h7LKhZMG… while the package that url actually serves hashes to golden_float-2.1.0-h7LKhUUN…, so every consumer of zig-hdc fails at dependency resolution before compiling anything: build.zig.zon:10:21: error: hash mismatch: manifest declares 'golden_float-2.1.0-h7LKhZMG…' but the fetched package has 'golden_float-2.1.0-h7LKhUUN…' The replacement value is not a guess: `zig fetch` produced it locally and it matches, character for character, the value GitHub Actions computed on a different Zig version and a different OS. The url is pinned to e7ce3288 in the same change, because archive/main.tar.gz is whatever that repository's main happens to be: the next commit there invalidates this hash again and the failure surfaces in somebody else's build. Pinning costs an explicit bump when the update is wanted, which is the point. Verified: the pinned tarball and main.tar.gz hash identically today, so pinning changes nothing except when it changes. Co-Authored-By: Claude Opus 5 --- build.zig.zon | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.zig.zon b/build.zig.zon index b109ac5..e7948a1 100644 --- a/build.zig.zon +++ b/build.zig.zon @@ -6,8 +6,8 @@ .paths = .{ "src", "build.zig", "build.zig.zon" }, .dependencies = .{ .zig_golden_float = .{ - .url = "https://github.com/gHashTag/zig-golden-float/archive/main.tar.gz", - .hash = "golden_float-2.1.0-h7LKhZMGCwBW0FS_zsli6CWxs9d5pElRE1pFFiy3WRSD", + .url = "https://github.com/gHashTag/zig-golden-float/archive/e7ce32885de2a8c50b7b6a3030d0592202145dd1.tar.gz", + .hash = "golden_float-2.1.0-h7LKhUUNCwAtKVHQ56wjridCZVwXY7_oxT2hXD9xCDdF", }, }, }