For the past two weeks my Flathub project has been getting spammed with bot PRs

1

Hey all,

For the past two weeks my Flathub project has been getting spammed multiple times per day with automated bot PRs from flathubbot that are trying to change the sha265sum and byte values of the extra data to very ‘wrong’ values. And each and every one of these PRs fails to build due to the sha256sum and byte values being completely wrong.

https://github.com/flathub/com.nomachine.nxplayer/pulls

For each new release, I manually confirm the size (in bytes) and sha256sum for both the x86_64 and aarch64 builds, so I’m not sure why the flathubbot is all of a sudden deriving different values. Maybe it’s something I’m doing wrong with my packaging or my Flathub manifest. If anyone can spot a mistake on my part, I’d love to get that fixed.

2

It indeed shouldnt do that. in the meantime you can create a flathub.json file with

{
"disable-external-data-checker": true
}

to ensure it doesnt annoy you some more

3

Oh that’s a great idea, thanks! I didn’t even know that was an option.

While that might fix ‘my’ specific issue, part of me worries that the bot is doing this to numerous other repos and potentially wasting valuable build cycles for no reason. I’d hate to see Flathub burning money over this.

4

i have several apps published… Havent had any ping. Probably whatever it does to watch for new releases against your apps repo is tripped up by something

you can report the issue here: GitHub - flathub-infra/flatpak-external-data-checker: A tool for checking if the external data used in Flatpak manifests is still up to date · GitHub if you want to make sure the Infra Team see this. They lurk around here on the discourse too.

with the flathub.json shutting it down, you could also setup your own external checker, to automate your new releases for each arches. sha256sum can be a bit of a hassle when manual, so if you are bored here it is: Maintenance | Flathub Documentation

5

It does what it’s been tasked to do: compare file size/checksum against the remote URL. If it changes every time for some reason, that explains what’s happening. Is it even still installable if the file content is no longer stable?

6

I never received any reports from users that the app wasn’t installable, so it seemed like in one context the download file was continuing to work. However, it seems like the bot was getting re-routed to a simple html page instead of the actual tar.gz downloadable file, hence why the checksum and size were always wrong. I have no idea what NoMachine’s webservers are doing on the backend with these requests, but it seems super odd, and had never been an issue until very recently.