fix: use release archive for libxcrypt

.github/workflows/update-dependencies.yml

@@ -32,8 +32,8 @@ jobs:
       id: generate-token
       if: github.ref == 'refs/heads/main' && github.repository == 'pypa/manylinux'
       with:
-        app_id: ${{ secrets.MANYLINUX_BOT_APP_ID }}
-        private_key: ${{ secrets.MANYLINUX_BOT_APP_PRIVATE_KEY }}
+        app-id: ${{ secrets.MANYLINUX_BOT_APP_ID }}
+        private-key: ${{ secrets.MANYLINUX_BOT_APP_PRIVATE_KEY }}
     - name: "Run update native dependencies"
       run: nox -s update_native_dependencies
       env:

docker/Dockerfile

@@ -62,8 +62,8 @@ RUN export LIBTOOL_ROOT=libtool-2.5.3 && \
 
 COPY build_scripts/install-libxcrypt.sh /build_scripts/
 RUN export LIBXCRYPT_VERSION=4.4.38 && \
-    export LIBXCRYPT_HASH=9fb45586b2e83727934fbe046a4fef4804017577f1d048f91d56d0d830a5a98e && \
-    export LIBXCRYPT_DOWNLOAD_URL=https://github.com/besser82/libxcrypt/archive && \
+    export LIBXCRYPT_HASH=80304b9c306ea799327f01d9a7549bdb28317789182631f1b54f4511b4206dd6 && \
+    export LIBXCRYPT_DOWNLOAD_URL=https://github.com/besser82/libxcrypt/releases/download && \
     manylinux-entrypoint /build_scripts/install-libxcrypt.sh
 
 FROM runtime_base AS build_base

docker/build_scripts/install-libxcrypt.sh

@@ -20,11 +20,12 @@ fi
 check_var "${LIBXCRYPT_VERSION}"
 check_var "${LIBXCRYPT_HASH}"
 check_var "${LIBXCRYPT_DOWNLOAD_URL}"
-fetch_source "v${LIBXCRYPT_VERSION}.tar.gz" "${LIBXCRYPT_DOWNLOAD_URL}"
-check_sha256sum "v${LIBXCRYPT_VERSION}.tar.gz" "${LIBXCRYPT_HASH}"
-tar xfz "v${LIBXCRYPT_VERSION}.tar.gz"
-pushd "libxcrypt-${LIBXCRYPT_VERSION}"
-./autogen.sh > /dev/null
+LIBXCRYPT_ROOT="libxcrypt-${LIBXCRYPT_VERSION}"
+
+fetch_source "${LIBXCRYPT_ROOT}.tar.xz" "${LIBXCRYPT_DOWNLOAD_URL}/v${LIBXCRYPT_VERSION}"
+check_sha256sum "${LIBXCRYPT_ROOT}.tar.xz" "${LIBXCRYPT_HASH}"
+tar xfJ "${LIBXCRYPT_ROOT}.tar.xz"
+pushd "${LIBXCRYPT_ROOT}"
 DESTDIR=/manylinux-rootfs do_standard_install \
 	--disable-obsolete-api \
 	--enable-hashes=all \
@@ -41,7 +42,7 @@ DESTDIR=/manylinux-rootfs/so.1 do_standard_install \
 cp -P /manylinux-rootfs/so.1/usr/local/lib/libcrypt.so.1* /manylinux-rootfs/usr/local/lib/
 rm -rf /manylinux-rootfs/so.1
 popd
-rm -rf "v${LIBXCRYPT_VERSION}.tar.gz" "libxcrypt-${LIBXCRYPT_VERSION}"
+rm -rf "${LIBXCRYPT_ROOT}.tar.xz" "${LIBXCRYPT_ROOT}"
 
 # Strip what we can
 strip_ /manylinux-rootfs

tools/update_native_dependencies.py

@@ -158,7 +158,7 @@ def _update_with_gh(tool, dry_run):
             url = re.match(
                 f"^    export {tool.upper()}_DOWNLOAD_URL=(?P<url>\\S+) && \\\\$", lines[i + 2]
             )["url"]
-            sha256 = _sha256(f"{url}/{latest_tag}.tar.gz")
+            sha256 = _sha256(f"{url}/{latest_tag}/libxcrypt-{latest_version}.tar.xz")
             lines[i + 0] = f"RUN export {tool.upper()}_VERSION={latest_version} && \\"
             lines[i + 1] = f"    export {tool.upper()}_HASH={sha256} && \\"
             message = f"Bump {tool} {current_version} → {latest_version}"