[MacPorts] #70495: pass @1.7.4: checksum mismatch (was: pass: checksum mismatch)

[MacPorts]

#70495: pass @1.7.4: checksum mismatch
---------------------------+----------------------
  Reporter:  barracuda156  |      Owner:  judaew
      Type:  defect        |     Status:  assigned
  Priority:  Normal        |  Milestone:
 Component:  ports         |    Version:  2.9.3
Resolution:                |   Keywords:
      Port:  pass          |
---------------------------+----------------------

Comment (by ryandesign):

 Yes, a [PortfileRecipes#stealth-updates stealth update] has occurred.
 Unfortunately the project's official download link is a tarball
 automatically generated from their repository, and the way that that
 tarball gets generated appears to have changed since we mirrored the file
 in 2021. The files in the tarball are identical, as is the tarball itself,
 but the surrounding gzip compression has changed. This could be the same
 problem that [https://github.blog/open-source/git/update-on-the-future-
 stability-of-source-code-archives-and-hashes/ bit GitHub], CodeBerg, and
 everybody else when they upgraded to git 2.38 without understanding the
 impact of the fact that it changed the default compression method from an
 external gzip command to an internal implementation.

 Since there is no benefit to us to switching to the new distfile, the port
 should avoid the stealth update until the next version is released by
 setting `master_sites macports_distfiles`.

 The developers of pass should be notified that this has happened, and
 encouraged to switch to separately-archived distfiles that are guaranteed
 never to change. If they like, they can simply download a snapshot from
 their repository server or one created locally using `git archive` and
 then upload that to some permanent storage.

-- 
Ticket URL: <https://trac.macports.org/ticket/70495#comment:1>
MacPorts <https://www.macports.org/>
Ports system for macOS