picopackage/CHANGELOG.md

[Unreleased]

Added

• Three-way merge on update, so a locally edited picopackage can still take upstream changes. Conflicts are written to <file>.picopackage-merge and the original file is never touched.
• base_checksum metadata: the upstream payload a file was last reconciled with. Doubles as the key into a content-addressed merge-base cache under $XDG_CACHE_HOME/picopackage (PICOPACKAGE_CACHE overrides).
• Unrecognised metadata keys are preserved across rewrites instead of being dropped.
• An upstream metadata block is explicitly optional. Any plain file is a valid source; a block lets a publisher assert a canonical url, filename, payload_version and licence, which are adopted as given.
• ppkg verify, ppkg package --url, ppkg scan output with urls, and ppkg help.

Changed

• Resolution is decided by checksum, never by mtime. A file whose payload matches upstream is up to date however the timestamps compare.
• Merges run on the payload only; the metadata block is regenerated afterwards rather than merged.
• A locally edited file whose upstream hasn't moved reports current instead of running a no-op merge. It also restores the merge base to the cache, so a cleared cache recovers on the next update rather than at the next conflict.
• Fetching uses net/http directly instead of URI.open, which treats a leading | as a command to run. Redirects (max 5, http/https only), If-None-Match, streamed size caps and typed errors come with it.
• update writes back to the local filename rather than upstream's preferred one, so a renamed package doesn't install a second copy.
• Timestamps are ISO 8601 from every provider.

Fixed

• Checksums are computed over the normalised payload everywhere. Written packages previously failed their own verification, so every file looked locally modified.
• Provider selection no longer aborts when a speculative provider guesses wrong, so plain URLs reach DefaultProvider. A 404 now reports as a 404 rather than "no provider could handle this".
• Scanner returns usable results and survives binary, unreadable and oversized files.
• ppkg verify reads the checksum it actually writes; ppkg package saves.
• A metadata block containing only unmodelled keys is no longer treated as a bare file and overwritten.
• Checksums are derived at write time, never adopted from an input. Installing from an upstream whose block carried a stale payload_checksum produced a file that failed its own verification and reported as locally modified before anyone had edited it.

[0.2.0] - 2025-01-21

• Rename to from Picop to Picopackage

[0.1.0] - 2025-01-19

• Initial release