For the past two weeks my Flathub project has been getting spammed with bot PRs

1

Hey all,

For the past two weeks my Flathub project has been getting spammed multiple times per day with automated bot PRs from flathubbot that are trying to change the sha265sum and byte values of the extra data to very ‘wrong’ values. And each and every one of these PRs fails to build due to the sha256sum and byte values being completely wrong.

https://github.com/flathub/com.nomachine.nxplayer/pulls

For each new release, I manually confirm the size (in bytes) and sha256sum for both the x86_64 and aarch64 builds, so I’m not sure why the flathubbot is all of a sudden deriving different values. Maybe it’s something I’m doing wrong with my packaging or my Flathub manifest. If anyone can spot a mistake on my part, I’d love to get that fixed.

2

It indeed shouldnt do that. in the meantime you can create a flathub.json file with

{
"disable-external-data-checker": true
}

to ensure it doesnt annoy you some more

3

Oh that’s a great idea, thanks! I didn’t even know that was an option.

While that might fix ‘my’ specific issue, part of me worries that the bot is doing this to numerous other repos and potentially wasting valuable build cycles for no reason. I’d hate to see Flathub burning money over this.

4

i have several apps published… Havent had any ping. Probably whatever it does to watch for new releases against your apps repo is tripped up by something

you can report the issue here: GitHub - flathub-infra/flatpak-external-data-checker: A tool for checking if the external data used in Flatpak manifests is still up to date · GitHub if you want to make sure the Infra Team see this. They lurk around here on the discourse too.

with the flathub.json shutting it down, you could also setup your own external checker, to automate your new releases for each arches. sha256sum can be a bit of a hassle when manual, so if you are bored here it is: Maintenance | Flathub Documentation