libarchive-static

• Path: arch/maintained/libarchive-static
• Source layout: pkgver tracks upstream libarchive only (git tag v${pkgver} from https://github.com/libarchive/libarchive.git). Bundled deps (attr, acl, openssl, zlib, xz, bzip2, zstd) each have their own _xxxver variable and are version-checked separately via nvchecker-deps.toml (archpkg source, i.e. compared against current Arch package versions). Don’t assume a libarchive bump means the deps need bumping too — check nvchecker-old.txt vs nvchecker-new.txt diffs first.
• Update procedure that worked (2026-07-02, 3.8.7 -> 3.8.8):
  1. Bump pkgver, reset pkgrel=1 in PKGBUILD.
  2. Run updpkgsums (needs real network — run with dangerouslyDisableSandbox if sandboxed curl gives spurious 404s). It re-clones the libarchive git tag and only the sha512sums[0] entry (the libarchive source) should change if deps are unchanged.
  3. Regenerate .SRCINFO with makepkg --printsrcinfo > .SRCINFO.
  4. Clean up: updpkgsums/makepkg leave the downloaded sources (openssl tarball etc, ~80MB) and cloned libarchive/, xz/ dirs behind in the package dir — remove them after a successful build.
• Builds for arch = i486, i686, pentium4, x86_64, arm, armv6h, armv7h, aarch64. Only i486/i686/pentium4/x86_64 buildable locally via archbuild (extra-i486-build, extra-i686-build, extra-pentium4-build, extra-x86_64-build). All four built cleanly for 3.8.8.
• Known-harmless build noise, not real failures:
  • namcap emits BSD is not a valid SPDX license identifier (E) — cosmetic, package still builds and installs fine.
  • In the 32-bit/pentium4 chroots, the post-build namcap/checkpkg step crashes with ImportError: libalpm.so.14: cannot open shared object file (chroot’s namcap python env vs host libalpm mismatch) and then error: target not found: libarchive-static — this is chroot tooling breakage, not a package build failure. Verify success by checking that libarchive-static-<ver>-<arch>.pkg.tar.xz was actually produced in the package directory instead of trusting the tail of archbuild’s output.
• 2026-07-07, private-repo release pass: this package’s .xz output (confirmed above, not new) tripped a real bug in repo_release.sh, which hardcoded a .pkg.tar.zst-only glob for the sign/publish steps — the build itself succeeded, but the script reported ERROR: no *.pkg.tar.zst found ... after build. Same issue hit pacman-static (see its own memory file), which explicitly sets PKGEXT=.pkg.tar.xz. Fixed by making repo_release.sh collect every valid package extension (.gz/.bz2/.xz/.zst/.lz), matching the set repo_build.sh’s own cleanup already recognized. Signed and published successfully afterward using the already-built .xz artifacts (no rebuild needed).
• 2026-07-17: ran a full update_cycle.sh pass. nvchecker-old.txt vs nvchecker-new.txt diff was empty — all bundled deps (attr, acl, openssl, zlib, xz, bzip2, zstd) still match their 2026-07-02 bump. No PKGBUILD change made. (Compare memory/pacman-static.md, whose otherwise-identical dep tracking showed one phantom c-ares bump this same cycle — not applicable here since this package doesn’t track c-ares at all.)
• 2026-07-28: 3.8.8 -> 3.8.9. Same procedure as 2026-07-02; deps diff again empty (nvchecker-deps.toml unchanged). updpkgsums only moved sha512sums[0]. Test-built cleanly for x86_64 via extra-x86_64-build before realizing the real release should go through repo_diff_local_remote.sh + repo_release_changed.sh per TOOLING_NOTES.md, not a manual archbuild/sign/publish chain — see that file’s 2026-07-27 entry, same mistake repeated. Cleaned up the manual test artifacts (built .pkg.tar.xz + debug pkg + namcap/build logs) and the updpkgsums-downloaded dep tarballs before handing off to the sanctioned scripts.