updpkgsums: incorrect result if PKGBUILD contains *sums+=

Steps to Reproduce

$ updpkgsums --version
updpkgsums 1.5.3
Copyright (C) 2012-2013 Dave Reisner <dreisner@archlinux.org>

$ cd $(mktemp -d)
$ touch {a..c}.txt
$ vim PKGBUILD

PKGBUILD content:

pkgname=test
pkgver=1
pkgrel=1
arch=(any)
source=("a.txt"
        "b.txt")
sha256sums=('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
            'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')

source+=("c.txt")
sha256sums+=('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')

package() {
  install -Dm644 $srcdir/a.txt $pkgdir/usr/lib/$pkgname/a.txt
  install -Dm644 $srcdir/b.txt $pkgdir/usr/lib/$pkgname/b.txt
  install -Dm644 $srcdir/c.txt $pkgdir/usr/lib/$pkgname/c.txt
}

Then run updpkgsums.

In the new PKGBUILD, the sha256sums+= line is not removed and makepkg will report ERROR: Integrity checks (sha256) differ in size from the source array.

pkgname=test
pkgver=1
pkgrel=1
arch=(any)
source=("a.txt"
        "b.txt")
sha256sums=('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
            'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
            'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')

source+=("c.txt")
sha256sums+=('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')

package() {
  install -Dm644 $srcdir/a.txt $pkgdir/usr/lib/$pkgname/a.txt
  install -Dm644 $srcdir/b.txt $pkgdir/usr/lib/$pkgname/b.txt
  install -Dm644 $srcdir/c.txt $pkgdir/usr/lib/$pkgname/c.txt
}

Why use *sums+= in PKGBUILD?

In Arch Linux's port for RISC-V, we patch Arch Linux's PKGBUILD with riscv64.patch, which often introduces patches for RISC-V by appending them to the source array in PKGBUILD, and apply the patches in prepare().

Take package lucky-commit for example. (PKGBUILD, riscv64.patch) The checksum for $pkgname-$pkgver.tar.gz changes every time Arch Linux upgrades lucky-commit. Because riscv64.patch modifies the original checksum line, patch will always fail. As a result, riscv64.patch must be updated frequently only to change the tarball's checksum inside the patch content, which is both unnecessary and time-consuming.

--- PKGBUILD
+++ PKGBUILD
@@ -10,8 +10,10 @@
 license=('MIT')
 depends=('gcc-libs' 'ocl-icd')
 makedepends=('cargo')
-source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
-sha512sums=('10cccc4ee09f7c23086568e909d1c99b068ec2b9df485af8664afcabc0a8fba6b9de435a24e99a189879767c0fbde2c196c634eb8a3a33970e5d72d8c1b4677d')
+source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz"
+        "disable-asm-feature.patch")
+sha512sums=('10cccc4ee09f7c23086568e909d1c99b068ec2b9df485af8664afcabc0a8fba6b9de435a24e99a189879767c0fbde2c196c634eb8a3a33970e5d72d8c1b4677d'
+            '4f0e9724566d3b9e89f52d2ba37cbf289c88092bd625fde331a22f58e3b645ac6c2a77915c5617436bce83aaa55c79fb752cd2b0cc2fe0ad34a09affff94c564')
 
 prepare() {
   cd "$pkgname-$pkgver"

It would be better to modify the source and *sums array by using += operator, because it does not require a change to the original checksum line, so that patch can apply riscv64.patch with a proper fuzz factor without having to change riscv64.patch manually.

--- PKGBUILD
+++ PKGBUILD
@@ -13,6 +13,9 @@ makedepends=('cargo')
 source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
 sha512sums=('10cccc4ee09f7c23086568e909d1c99b068ec2b9df485af8664afcabc0a8fba6b9de435a24e99a189879767c0fbde2c196c634eb8a3a33970e5d72d8c1b4677d')
 
+source+=("disable-asm-feature.patch")
+sha512sums+=('4f0e9724566d3b9e89f52d2ba37cbf289c88092bd625fde331a22f58e3b645ac6c2a77915c5617436bce83aaa55c79fb752cd2b0cc2fe0ad34a09affff94c564')
+
 prepare() {
   cd "$pkgname-$pkgver"
   cargo fetch --locked --target "$CARCH-unknown-linux-gnu"

Proposed Change

--- a/src/updpkgsums.sh.in
+++ b/src/updpkgsums.sh.in
@@ -101,15 +101,15 @@ sumtypes=$(IFS='|'; echo "${known_hash_algos[*]}")
 newsums=$(makepkg -g -p "$buildfile" "${MAKEPKG_OPTS[@]}") || die 'Failed to generate new checksums'
 
 if [[ -z $newsums ]]; then
        die "$buildfile does not contain sources to update"
 fi
 
 awk -v sumtypes="$sumtypes" -v newsums="$newsums" '
-       $0 ~"^[[:blank:]]*(" sumtypes ")sums(_[^=]+)?=", $0 ~ "\\)[[:blank:]]*(#.*)?$" {
+       $0 ~"^[[:blank:]]*(" sumtypes ")sums(_[^=]+)?\\+?=", $0 ~ "\\)[[:blank:]]*(#.*)?$" {
                if (!w) {
                        print newsums
                        w++
                }
                next
        }
 

The awk program places the new checksums at the first *sums= line and removes all old *sums= lines. This change to the awk program allows matching both *sums+= and *sums=, so the *sums+= lines will be removed as well to ensure the correctness of PKGBUILD. With this change, updpkgsums will generate the following content for the PKGBUILD in Steps to Reproduce, and makepkg can create a package.

pkgname=test
pkgver=1
pkgrel=1
arch=(any)
source=("a.txt"
        "b.txt")
sha256sums=('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
            'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
            'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')

source+=("c.txt")

package() {
  install -Dm644 $srcdir/a.txt $pkgdir/usr/lib/$pkgname/a.txt
  install -Dm644 $srcdir/b.txt $pkgdir/usr/lib/$pkgname/b.txt
  install -Dm644 $srcdir/c.txt $pkgdir/usr/lib/$pkgname/c.txt
}