Jq: Why does sha256 sum of 1.6 release was changed?

[svetlyak40wt]

Homebrew fixed sha256 hash of 1.6 version as 9625784cf2e4fd9842f1d407681ce4878b5b0dcddbcd31c6135114a30c71e6a8

https://github.com/Homebrew/homebrew-core/commit/c3be568fc3c621bebae607b2352e590e86353742

But now it is 5de8c8e29aaa3fb9cc6b47bb27299f271354ebb72514e3accadc7d38b5bbaa72:

[art@osx:~]% curl -s -L 'https://github.com/stedolan/jq/releases/download/jq-1.6/jq-1.6.tar.gz' | shasum -a 256
5de8c8e29aaa3fb9cc6b47bb27299f271354ebb72514e3accadc7d38b5bbaa72  -

Why does it change? May be somebody changed the sources?

[wtlangford]

Yeah, I repackaged the sources a couple times after release because they had various issues (https://github.com/stedolan/jq/issues/1352#issuecomment-435390228, #1756) . My apologies, I didn't realize that homebrew pinned sha256 hashes for the source tarballs. The tarballs are stable now, as far as I'm aware. I can also confirm that the hash 5de8c8e29aaa3fb9cc6b47bb27299f271354ebb72514e3accadc7d38b5bbaa72 matches the hash on the file I uploaded from my computer.

[fxcoudert]

Thanks. In future, we'd appreciate if you could release a patch level version rather than edit the released tarballs (in accordance with the rules of semantic versioning).