LYR-PKG0008

the lock or a hash disagrees with what was read

error · spec 15-project

Reported when lyric.lock holds a commit the repository of a dependency or a source tree does not have, when the content at the locked commit is not what the lock's hash says, or when the file a source tree's URL loads is not the one its hash names.

Explanation

lyric.lock records, for each revision read from git, the commit it was and a hash of the package content. A build reads that commit and checks the hash, so the program is built from the same sources everywhere. A commit that has gone — a force-push — or content that differs means the lock no longer describes what the repository holds.

Resolve the dependency anew with lyric5 update <name>, which writes the lock from what the repository holds now, and check what changed.

A source tree from a URL carries its hash in the manifest: when the server sends another file, the message gives both hashes. A release that was replaced is a new file — check it, then write its hash.

Example

$ lyric5 build
error[LYR-PKG0008]: lyric.lock holds commit 1234567890ab of https://example.org/geo for 'geo', which the repository does not have — 'lyric update geo' resolves it anew
  --> /home/ada/app/lyric.toml:6:1
$ lyric5 build
error[LYR-PKG0008]: the content of 'geo' at commit e4ff41cbf4c5 of https://example.org/geo is not what lyric.lock holds — 'lyric update geo' resolves it anew
  --> /home/ada/app/lyric.toml:6:1