[taxin-404]

Problem: a release-shared source filename defeats AUR helpers' source cache

cordial-bin's source entry pins the URL correctly, but the left side — the filename makepkg and AUR helpers key on in $SRCDEST — was identical across releases:

cordial.pkg.tar.zst::https://github.com/luohoa97/cordial/releases/download/v0.34.0/cordial-0.34.0.r0.gfe20025-1-x86_64.pkg.tar.zst

AUR helpers keep $SRCDEST between releases. Whoever has built cordial-bin once has the previous release's file sitting there under that same name; on the next release makepkg reports Found cordial.pkg.tar.zst, skips re-downloading, and fails the new release's pinned checksum with a bare:

==> Validating source files with sha256sums...
    cordial.pkg.tar.zst ... FAILED
==> ERROR: One or more files did not pass the validity check!

…which reads like an upstream problem but is just the old release being found under the new release's name. Observed 2026-10-19 during the 0.34.0 AUR update: the cached file was the v0.17.0 artifact, sha256 0835b7ed… — matching that era's pin verbatim.

Fix

Make the local filename release-unique by embedding $pkgver:

cordial-${pkgver}.pkg.tar.zst::…

• Every release downloads under its own name, so a cached previous release can never be presented for a new one — regardless of which helper or SRCDEST policy the user has.
• The per-release bump checklist grows from three spots to four on the same line: pkgver, the alias, the pinned URL and the checksum (noted in PUBLISHING.md too).
• The generated .SRCINFO's only change is the same source = line — nothing else can drift. Useful roundtrip: the hand-maintained .SRCINFO in this directory matched makepkg --printsrcinfo output exactly, except that one line.

Testing

Full makepkg --nodeps -f against this exact file at v0.34.0 on Arch:

==> Validating source files with sha256sums...
    cordial-0.34.0.pkg.tar.zst ... Passed
…
==> Finished making: cordial-bin 0.34.0-1

namcap clean on the PKGBUILD (exit 0); on the package only the usual notes for CI-pre-stripped binaries. The repack is a straight copy of the CI artifact by design — no compilation involved.

Second commit: PUBLISHING.md

1. cordial-bin's bump paragraph now lists four things (adds the release-unique alias).
2. The dated AUR-status paragraph moves from "on 2026-09-30 all three were at 0.17.0" to the current state — re-synced to 0.34.0 on 2026-10-19 by taxin-404 after a file-by-file diff against main; the remaining differences are the maintainer line, cordial-git's pinned snapshot version, this alias change, and the root-level 0BSD packaging-license file.

The same alias fix is already live in the AUR package's own repository (aur.archlinux.org/cordial-bin, commit 76516c5, where the download → validate → repack cycle has run since this morning), so this PR restores agreement between upstream and what the AUR ships.