release checksum problem

[robertkirkman]

Hi,

I've noticed that the releases here https://github.com/scikit-build/cmake-python-distributions/releases frequently change their checksums after they've released, often within a period approximately 24 to 48 hours after each release is made, and sometimes again other times after that.

I was wondering, is there a particular way that could be prevented, or is there something causing that which is necessary and it can't be stopped?

[henryiii]

I don’t think we are doing anything to change it? The autogenerated release files in GitHub do not have a stable checksum guarantee, only manually uploaded files do and we don’t provide any of those. We do provide attestations for our PyPI uploads; using the SDist from there is recommended.

If you see a way to improve stability, happy to take suggestions. We aren’t (can’t) reuploading the autogenerated artifacts.

You can see what we do here: https://github.com/scikit-build/cmake-python-distributions/blob/main/docs/make_a_release.rst. The nox job just prints this message:

nox > Running session tag_release
nox > Run the following commands to make a release:
git tag --sign -m 'cmake-python-distributions 4.3.0' 4.3.0 main
git push origin 4.3.0
nox > Session tag_release was successful.