chore(deps): update dependency ip7z/7zip to v26.03 - #149
Merged
Conversation
![renovate-hash-sync[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Recomputed from a freshly-fetched artifact:
- driver/firmware/libchdr package pins: sha256sum of the github
archive tarball at the new pinned owner/repo/ref (same "locally
computed" practice this tree's own .hash file headers already
document)
- kernel pins (stable 6.18.y and the RT/beta 7.2 line): kernel.org's
signed sha256sums.asc for each pin's own vN.x series. An -rc is
never refreshed here -- no signed manifest exists for one
- lzma-sdk pin: sha256sum of the ip7z/7zip release ASSET for the
new version (upstream publishes no checksums at all -- see
package/lzma-sdk/lzma-sdk.hash's header)
- sdcard payload pins (update_all.sh, wifi.sh): sha256 + size of
the raw file at the new pinned commit, rewritten in place in
scripts/fetch-sdcard-payload.sh
- Buildroot pin (BUILDROOT_SHA256, root Makefile): transcribed
from buildroot.org's GPG-signed release manifest
(buildroot-<ver>.tar.gz.sign) -- the same signed file `make
buildroot-showsig` prints, never a locally-computed sha256sum
of the tarball (that remains forbidden; see the Makefile's own
header comment)
- azcopy pin: REBUILT, not fetched. Buildroot's own
support/download/go-post-process re-ran `go mod vendor` over the
newly pinned tag with the Go version the pinned Buildroot tree
pins, and the resulting azcopy-<ver>-go2.tar.gz was hashed --
the only way this value can be derived, since no URL serves that
file (see package/azcopy/azcopy.hash's header). LICENSE and
NOTICE.txt were re-hashed from the same tarball
- golden config hashes (configs/fragments/golden.sha256): on a
Buildroot bump only, the target branch's own
scripts/check-config-fragments.sh --update-golden was run
against the freshly unpacked (hash-verified) Buildroot tree and
the new version's lines recorded -- never a rewrite of lines
that already existed (docs/buildroot-config.md section 11)
mcfbytes
added a commit
that referenced
this pull request
Sep 4, 2026
Unbreaks master, which has been red since PR #149 (ip7z/7zip 26.02 -> 26.03) merged: `make legal-info` rejected package/lzma-sdk's stale DOC/readme.txt hash. Merged directly rather than via a PR because the fix is verified locally and master is currently failing. The bump itself was sound -- both packages built at 26.03, libchdr resolved lzma-sdk 26.03, the image completed, and both tarball hashes the hash-sync bot wrote were correct. Only lzma-sdk's license-file line was stale, because scripts/hash-sync-ip7z-src.sh refreshed the tarball line alone by design. That design was fail-closed and correct, but it reports in legal-info at the end of an ~80-minute image build, so it surfaces as a red master instead of a red PR. Two changes follow from that: - the readme hash is re-derived for 26.03, after re-verifying the grant on line 43 is unchanged (the whole diff is a version banner and three typo fixes) and that DOC/License.txt is byte-identical; - case 3 now refreshes every file named in each package's *_LICENSE_FILES and prints a diff of any that changed, so the next occurrence is a reviewable PR rather than a broken master. Also records why a README is a license file at all -- for lzma-sdk, DOC/readme.txt IS the licence text -- and refreshes stale 26.02 references across the packages and the current-state docs. Carries a flagged, unfixed risk: 12 case-1 pins have the same gap, and rtl8188eu-aircrack-ng and ltunify pin SOURCE files as their *_LICENSE_FILES, where any upstream commit touching them reproduces this failure. See docs/ci.md#companion-hash-first-line-only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KTuSPzE9MmRka8ZKEtxXgs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
26.02→26.03Release Notes
ip7z/7zip (ip7z/7zip)
v26.03: 7-Zip 26.03Compare Source
7-Zip 26.03
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.