[MacPorts] #63692: py39-numpy checksum error (was: py39-numpy checksum error (on Monterey))

[MacPorts]

#63692: py39-numpy checksum error
-------------------------+-----------------------
  Reporter:  smeingast   |      Owner:  michaelld
      Type:  defect      |     Status:  assigned
  Priority:  Normal      |  Milestone:
 Component:  ports       |    Version:
Resolution:              |   Keywords:
      Port:  py39-numpy  |
-------------------------+-----------------------

Comment (by ryandesign):

 The numpy-1.21.3.tar.gz we mirrored on October 20 has the checksums that
 are listed in the Portfile.

 After that, numpy-1.21.3.tar.gz changed so now the checksums don't match
 anymore.

 The change between the old one and the new one is:

 {{{
 #!diff
 diff -ru 0/numpy-numpy-efe3349/numpy/_version.py 1/numpy-numpy-
 efe3349/numpy/_version.py
 --- 0/numpy-numpy-efe3349/numpy/_version.py     2021-10-19
 19:45:47.000000000 -0500
 +++ 1/numpy-numpy-efe3349/numpy/_version.py     2021-10-19
 19:45:47.000000000 -0500
 @@ -22,7 +22,7 @@
      # setup.py/versioneer.py will grep for the variable names, so they
 must
      # each be defined on a line of their own. _version.py will just call
      # get_keywords().
 -    git_refnames = " (tag: v1.21.3, maintenance/1.21.x)"
 +    git_refnames = " (tag: v1.21.3)"
      git_full = "d4d0584ccb508cad69288b504e6c8b04aa0d5caf"
      git_date = "2021-10-19 18:45:47 -0600"
      keywords = {"refnames": git_refnames, "full": git_full, "date":
 git_date}
 }}}

 We have seen this kind of problem before, for example in #60444 (which has
 a good explanation of why it happens) and in #41657. A set of git tags
 gets inserted into the generated source code, and if upstream changes
 which tags are available, as apparently happened for numpy between October
 20 and today, then the generated source code changes, and the checksums
 along with it.

 This is one of the reasons why relying on automatically-generated tarballs
 isn't always a great idea. If a project offers manually-generated
 distfiles, that can often be a better choice. numpy does offer manually-
 generated tarballs. There are more differences between those and the
 automatically-generated ones though. Michael would have to evaluate
 whether those differences matter for MacPorts or not.

 If we switch to the release tarball or update the checksums for the auto-
 generated tarball without updating the version, it would need to be
 handled as a [PortfileRecipes#stealth-updates stealth update]
 (`dist_subdir ${name}/${version}_1`). Instead I would probably handle it
 by preventing the use of the GitHub download location for now, since the
 change is of no significance to MacPorts (`master_sites
 macports_distfiles`) and when the next version of numpy is released,
 decide then whether to switch to the release tarball (`github.tarball_from
 releases`). One must bear in mind that the py-numpy port handles several
 different versions of numpy depending on python version, so these
 decisions will have to be coded carefully.

-- 
Ticket URL: <https://trac.macports.org/ticket/63692#comment:1>
MacPorts <https://www.macports.org/>
Ports system for macOS