Source layout: pkgver tracks upstream libarchive only (git tag v${pkgver}
from https://github.com/libarchive/libarchive.git). Bundled deps (attr, acl,
openssl, zlib, xz, bzip2, zstd) each have their own _xxxver variable and are
version-checked separately via nvchecker-deps.toml (archpkg source, i.e.
compared against current Arch package versions). Don’t assume a libarchive
bump means the deps need bumping too — check nvchecker-old.txt vs
nvchecker-new.txt diffs first.
Update procedure that worked (2026-07-02, 3.8.7 -> 3.8.8):
Bump pkgver, reset pkgrel=1 in PKGBUILD.
Run updpkgsums (needs real network — run with dangerouslyDisableSandbox
if sandboxed curl gives spurious 404s). It re-clones the libarchive git
tag and only the sha512sums[0] entry (the libarchive source) should
change if deps are unchanged.
Regenerate .SRCINFO with makepkg --printsrcinfo > .SRCINFO.
Clean up: updpkgsums/makepkg leave the downloaded sources (openssl
tarball etc, ~80MB) and cloned libarchive/, xz/ dirs behind in the
package dir — remove them after a successful build.
Builds for arch = i486, i686, pentium4, x86_64, arm, armv6h, armv7h, aarch64.
Only i486/i686/pentium4/x86_64 buildable locally via archbuild
(extra-i486-build, extra-i686-build, extra-pentium4-build,
extra-x86_64-build). All four built cleanly for 3.8.8.
Known-harmless build noise, not real failures:
namcap emits BSD is not a valid SPDX license identifier (E) — cosmetic,
package still builds and installs fine.
In the 32-bit/pentium4 chroots, the post-build namcap/checkpkg step
crashes with ImportError: libalpm.so.14: cannot open shared object
file (chroot’s namcap python env vs host libalpm mismatch) and then
error: target not found: libarchive-static — this is chroot tooling
breakage, not a package build failure. Verify success by checking that
libarchive-static-<ver>-<arch>.pkg.tar.xz was actually produced in the
package directory instead of trusting the tail of archbuild’s output.
2026-07-07, private-repo release pass: this package’s .xz output
(confirmed above, not new) tripped a real bug in repo_release.sh,
which hardcoded a .pkg.tar.zst-only glob for the sign/publish steps —
the build itself succeeded, but the script reported ERROR: no
*.pkg.tar.zst found ... after build. Same issue hit pacman-static
(see its own memory file), which explicitly sets
PKGEXT=.pkg.tar.xz. Fixed by making repo_release.sh collect every
valid package extension (.gz/.bz2/.xz/.zst/.lz), matching the
set repo_build.sh’s own cleanup already recognized. Signed and
published successfully afterward using the already-built .xz
artifacts (no rebuild needed).