The template previously carried the real hash of the current tag's tarball.
That tarball contains this very file, so the hash is stale the moment the next
tag is cut -- and a stale 64-hex string looks complete enough that someone
copying the template to the AUR checkout could skip updpkgsums and then debug a
checksum mismatch instead of the actual step they missed. 'SKIP' is
unmistakably a placeholder. The AUR checkouts under ~/aur keep the real hashes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Aoa1nKWRrAbowz7Hfd3tgL
app/install_arch.sh generates a PKGBUILD into a mktemp dir with no source=() and
a package() that copies from hardcoded absolute paths under /home/kuhy. That
only ever works on one machine, so it cannot be published. This PKGBUILD builds
from the GitHub release tarball (v1.0.1) instead, and fixes what AUR review
would reject: license=('MIT') with the text actually installed to
/usr/share/licenses, real depends (glibc/bash/hicolor-icon-theme, found by
namcap), and the desktop entry plus icons installed into the package rather than
into ~/.local/share after the fact.
The app lives in app/ while LICENSE is at the repo root, so build()/package()
cd into the subdir and install the license from an absolute $srcdir path.
v1.0.0 was already taken by an older commit predating the LICENSE, hence v1.0.1.
The README documents the tagging hazard: this clone carries grafted upstream
Flutter SDK tags that must never be pushed with `git push --tags`.
install_arch.sh keeps its working-tree dev loop and is deliberately not wired to
this file. Verified: makepkg -Cf from a clean dir with only packaged Flutter on
PATH, namcap clean, pacman -U, and `diet-guard-app` serving on port 8732.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Aoa1nKWRrAbowz7Hfd3tgL
