Good test that the tooling actually works when the checksums are incorrect :) If your "build from source" tool/workflow DIDN'T break, I'd be worried.

> every open source project that builds external deps

and relies on checksumming ephemeral artefacts for integrity.

Source archives have never, in the entire history of open source, been considered ephemeral.

GitHub unilaterally made that decision for their own convenience, and violated a decades-long universal community norm in the process.

You could also say that some maintainers made that decision for their convenience of not having to build and upload source archives. It is possible to upload your own artifacts to a release on GitHub, and lots of projects do. Those are correctly treated as immutable by GitHub.

I imagine GitHub would be equally upset if every project every started uploading their source tarballs themselves, as presumably the point of their source tarball feature was not needing to store the source tarball for every repository ever, but generating it on demand.

Bit of a shame they've just provided every project with huge incentive to upload their own source tarballs then. Coming soon, complaints that users upload too many opaque binaries.

GitHub had no releases feature for many years. Most maintainers aren’t aware of the option, and of those who are, I doubt many are even aware that GitHub’s autogenerated tarballs are not stable or that they don’t include submodules.

I think this change only affects automatically (and dynamically) generated source archives, not those that are actually pushed to Github Releases beforehand.

All these projects relying on github, they are using a free service they don't control. It could go away someday. That will be a bigger crisis than this was..

Such tools should definitely checksum package sources lol