firefly: update ldflags with new org urls

[EnriqueL8]

---

• Have you followed the guidelines for contributing?
• Have you ensured that your commits follow the commit style guide?
• Have you checked that there aren't other open pull requests for the same formula update/change?
• Have you built your formula locally with HOMEBREW_NO_INSTALL_FROM_API=1 brew install --build-from-source <formula>?
• Is your test running fine brew test <formula>?
• Does your build pass brew audit --strict <formula> (after doing HOMEBREW_NO_INSTALL_FROM_API=1 brew install --build-from-source <formula>)? If this is a new formula, does it pass brew audit --new <formula>?

---

• AI was used to generate or assist with generating this PR. Please specify below how you used AI to help you, and what steps you have taken to manually verify the changes.

---

[github-actions]

Thanks for contributing to Homebrew! 🎉 It looks like you're having trouble with a CI failure. See our contribution guide for help. You may be most interested in the section on dealing with CI failures. You can find the CI logs in the Checks tab of your pull request.

[daeho-ro]

I think we could apply this after v1.5.0 released.

[daeho-ro]

Org change is maybe the reason of this

• firefly: update homepage and checksum for 1.4.0 release #292774

[EnriqueL8]

I did see for some reason the SHA had changed in a previous PR and not sure why @daeho-ro

[SMillerDev]

The git manual says re-tagging is "the insane thing" to do. And research also shows it’s a growing problem for anyone using your software: https://arxiv.org/abs/2606.31354. Could you please check internally why the shasum changed? Otherwise we should disable the software until we're sure that it has not been compromised.

[daeho-ro]

@SMillerDev My suspection is url changed by org name change.

[SMillerDev]

Could be, could also be compromised. We can't just rule out the worst case scenario because there is a best case scenario. We wouldn't be very good protectors of our users if we did.

[EnriqueL8]

Not compromised @SMillerDev, I am maintainer of Hyperledger FireFly and lead the release process. I understand your concern, let me double check if due to the org move the release SHA changes - we did not retag

[EnriqueL8]

@SMillerDev Verified that this is not a re-tag or compromise. The v1.4.0 tag still points to the exact same commit it always has:

git ls-remote --tags https://github.com/hyperledger-firefly/cli.git v1.4.0
52ea718c11ec8965a78b2b1de4bbb4905dbdbb21  refs/tags/v1.4.0

I downloaded the archive from the new org URL and diffed its contents against git archive v1.4.0 from a local clone and it's byte-identical, zero differences. The sha256 change is purely GitHub regenerating the auto-generated tarball bytes (gzip/tar metadata) on the archive endpoint this was a change in Github on how they generate the checksum take a look at a similar pkg that had the same issue in Homebrew spack/spack#5411 . This change is likely due to the org move

We should not be relying on these auto generate resource paths (/org/repo/archive/... and instead move to actual release ones.

[EnriqueL8]

A very good explanation of the issue can be found here libgit2/libgit2#4343 (comment)

[SMillerDev]

Thanks for the investigation @EnriqueL8, you can never be too careful with supply chain security these days.

[EnriqueL8]

@SMillerDev Absolutely agree

[EnriqueL8]

What are the next steps on this one then :)

[stefanb]

Please rebase it to resolve conflicts with

• firefly: update homepage and checksum for 1.4.0 release #292774

[stefanb]

Also, please note that upstream rename of Go module

• Migrate firefly dependencies and container images to new org hyperledger-firefly/cli#353

is not yet released and included in current 1.4.0 release, thats's why test here is failing with:

  ==> /home/linuxbrew/.linuxbrew/Cellar/firefly/1.4.0/bin/firefly version --short
  Error: firefly: failed
  An exception occurred within a child process:
    Minitest::Assertion: Expected /1\.4\.0/ to match "(devel)\n".

It seems to be coming in upcoming 1.5.0: https://github.com/hyperledger-firefly/cli/releases/tag/v1.5.0-rc.1

[stefanb]

Good, now we just need to wait for the 1.5.0 release, which will actually need the new ldflags.

[stefanb]

Superseded by

• firefly 1.5.0 #297029