concat, concat-bin, concat-git: adapt to upstream's 0.2.3 layout

concat-bin/pkg.sh

@@ -1,14 +1,14 @@
 # concat-bin - Concat (https://github.com/jub0t/Concat), a free and
 # open-source CapCut replacement.
 #
-# Upstream publishes a self-contained Linux tarball per release, so there is
-# no build step here: on a new version only pkgver, the asset name and the
-# checksum are refreshed and the PKGBUILD repackages the tarball.
+# Upstream builds the Linux release itself, so there is no build step here:
+# on a new version the tag, the asset version and the checksums are refreshed
+# and the PKGBUILD repackages upstream's .deb.
 #
-# 0.2.1 is the first release of the rewrite: the Tauri shell and its .deb are
-# gone, and the app is now one Rust binary (Slint over the engine crates)
-# shipped as Concat-<version>-linux-<arch>.tar.gz. The tag is what changed
-# least - see below.
+# 0.2.3 replaced the self-contained tarball this package used to take with a
+# .deb, an .rpm and an AppImage, each for x86_64 and aarch64. Every release
+# also carries a manifest.json listing each artifact with its sha256, so a
+# new version costs two API calls and no download.
 #
 # The release list is not ordered by version: GitHub sorts it by creation
 # time, and upstream's alpha numbering has run out of step with it before
@@ -18,13 +18,12 @@
 # rolling "nightly" prerelease out.
 #
 # The asset name carries the workspace's version, not the tag - a prerelease
-# of 0.2.2 ships Concat-0.2.2-linux-x86_64.tar.gz whatever its tag says - so
-# it cannot be derived from pkgver and is resolved through the API into the
-# _asset variable.
+# of 0.2.4 ships Concat-0.2.4-linux-x86_64.deb whatever its tag says - so it
+# cannot be derived from pkgver and is read from the manifest into _relver.
 #
-# pkgver drops the hyphens from the tag (v0.2.2-alpha.1 -> 0.2.2alpha.1).
-# pacman sorts that older than a later plain 0.2.2 (`vercmp 0.2.2alpha.1
-# 0.2.2` is -1), so prereleases upgrade to the eventual release on their own
+# pkgver drops the hyphens from the tag (v0.2.4-alpha.1 -> 0.2.4alpha.1).
+# pacman sorts that older than a later plain 0.2.4 (`vercmp 0.2.4alpha.1
+# 0.2.4` is -1), so prereleases upgrade to the eventual release on their own
 # and no epoch is needed.
 
 UPSTREAM_REPO="jub0t/Concat"
@@ -47,7 +46,7 @@ latest_version() {
 # refresh_checksums <version> <pkgbuild-path>
 refresh_checksums() {
   local ver="$1" pkgbuild="$2"
-  local tag asset sha
+  local tag manifest relver sha_x86_64 sha_aarch64 arch sha file
 
   tag="$(latest_tag)"
   if [[ "$(tag_to_pkgver <<< "$tag")" != "$ver" ]]; then
@@ -55,23 +54,31 @@ refresh_checksums() {
     return 1
   fi
 
-  # e.g. Concat-0.2.1-linux-x86_64.tar.gz - the version is the workspace's,
-  # not the tag's
-  # `|| true`, so that a release that stops carrying the asset says so here
-  # instead of ending the run on grep's exit status with nothing printed.
-  asset="$(gh api "repos/$UPSTREAM_REPO/releases/tags/$tag" --jq '.assets[].name' \
-    | grep -E '^Concat-.*-linux-x86_64\.tar\.gz$' || true)"
-  if [[ -z "$asset" || "$(wc -l <<< "$asset")" -ne 1 ]]; then
-    echo "expected exactly one linux-x86_64 tarball in $tag, got: ${asset:-none}" >&2
+  manifest="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$tag/manifest.json")"
+  relver="$(jq -r '.version // empty' <<< "$manifest" 2>/dev/null)"
+  if [[ -z "$relver" ]]; then
+    echo "$tag carries no usable manifest.json" >&2
     return 1
   fi
 
-  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$tag/$asset" \
-    | sha256sum | cut -d' ' -f1)"
+  # Both the name and the checksum come from the manifest, and the name is
+  # checked against what the PKGBUILD builds from _relver: a release that
+  # renames its artifacts says so here instead of 404ing in the test build.
+  for arch in x86_64 aarch64; do
+    sha="$(jq -r --arg a "$arch" '.binaries.linux[$a].deb.sha256 // empty' <<< "$manifest")"
+    file="$(jq -r --arg a "$arch" '.binaries.linux[$a].deb.file // empty' <<< "$manifest")"
+    if [[ ! "$sha" =~ ^[0-9a-f]{64}$ || "$file" != "Concat-$relver-linux-$arch.deb" ]]; then
+      echo "$tag's manifest lists no Concat-$relver-linux-$arch.deb with a sha256" \
+           "(file: ${file:-none})" >&2
+      return 1
+    fi
+    printf -v "sha_$arch" '%s' "$sha"
+  done
 
   sed -i \
     -e "s|^_tag=.*|_tag=\"$tag\"|" \
-    -e "s|^_asset=.*|_asset=\"$asset\"|" \
-    -e "s|^sha256sums=.*|sha256sums=('$sha')|" \
+    -e "s|^_relver=.*|_relver=\"$relver\"|" \
+    -e "s|^sha256sums_x86_64=.*|sha256sums_x86_64=('$sha_x86_64')|" \
+    -e "s|^sha256sums_aarch64=.*|sha256sums_aarch64=('$sha_aarch64')|" \
     "$pkgbuild"
 }