[rpms/cachelib] rawhide: Correct the License tag and version the bundled() Provides

[Michel Lind <salimma@fedoraproject.org>]

            A new commit has been pushed.

            Repo   : rpms/cachelib
            Branch : rawhide
            Commit : 97b9f13924f8d7eeca03023d6e1b8249933b5423
            Author : Michel Lind <salimma@fedoraproject.org>
            Date   : 2026-09-25T10:01:44+01:00
            Stats  : +381/-10 in 5 file(s)
            URL    : https://src.fedoraproject.org/rpms/cachelib/c/97b9f13924f8d7eeca03023d6e1b8249933b5423?branch=rawhide

            Log:
            Correct the License tag and version the bundled() Provides

- Add BSL-1.0, Zlib, MIT-CMU and LicenseRef-Fedora-Public-Domain: mvfst's
  third-party expected.hpp and optional.h, folly's Crc32cDetail.cpp and
  liboqs's brg_endian.h and AES code carry those licenses in their file
  headers and are compiled in; found by the licensecheck pass the check
  now runs (folly-rpm-macros 46-3)
- bundled() Provides are now versioned, from the version getdeps records
  per vendored project (<tag>^<distance>.<commit>, or the archive version)
- Delete fbthrift's Go bindings in %prep; exclude the build-only CMake
  helpers (GPL-2.0 find modules, NCSA CheckAtomic.cmake) from the scans
- Move the license check to the start of %build, and run its expensive
  per-file pass only when the vendor tarball is not the one recorded as
  having passed it

The mcrouter review (rhbz#2537668) asked for versioned bundled()
Provides and ran licensecheck over the unpacked sources; both findings
apply to cachelib equally. Source1 is regenerated with the getdeps change
that records versions (Patch8) and is otherwise identical: same pinned
revisions, only vendor/getdeps-vendor.txt gained its third column.

Assisted-by: Claude Code:claude-fable-5-1
Signed-off-by: Michel Lind <salimma@fedoraproject.org>

---
diff --git a/0009-getdeps-record-the-checked-out-commit-and-a-version.patch b/0009-getdeps-record-the-checked-out-commit-and-a-version.patch
new file mode 100644
index 0000000..3a5aeb9
--- /dev/null
+++ b/0009-getdeps-record-the-checked-out-commit-and-a-version.patch
@@ -0,0 +1,312 @@
+From: Michel Lind <salimma@fedoraproject.org>
+Date: Thu, 24 Sep 2026 11:00:00 +0100
+Subject: [PATCH] getdeps: record the checked-out commit and a version in getdeps-vendor.txt
+
+`getdeps.py vendor` wrote fetcher.hash() next to each vendored project,
+which for a git project without a pinned rev is the branch name, so a
+project that ships no build/deps/github_hashes (mcrouter) got "folly
+main" recorded, identifying nothing. Ask the checkout for HEAD instead.
+
+Also record a version as a third field where one can be determined: for
+a git checkout the nearest tag (git describe, deepening the shallow clone
+as needed), as the tag itself when HEAD is tagged or
+<tag>^<distance>.<commit> otherwise; for a downloaded archive the
+version in its file name. Distributions that bundle the vendored tree
+need "Provides: bundled(<name>) = <version>" (Fedora's bundling
+guidelines), and this is what they can derive it from.
+
+Signed-off-by: Michel Lind <salimma@fedoraproject.org>
+Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
+---
+  build/fbcode_builder/getdeps/cli.py              | 106 +++++++++++++++++++-
+  build/fbcode_builder/getdeps/test/vendor_test.py | 118 +++++++++++++++++++++++
+  2 files changed, 223 insertions(+), 1 deletion(-)
+
+diff --git a/build/fbcode_builder/getdeps/cli.py b/build/fbcode_builder/getdeps/cli.py
+index cbd4589f..01f3f919 100644
+--- a/build/fbcode_builder/getdeps/cli.py
++++ b/build/fbcode_builder/getdeps/cli.py
+@@ -6,12 +6,14 @@
+ import argparse
+ import json
+ import os
++import re
+ import shutil
+ import subprocess
+ import sys
+ import tarfile
+ import tempfile
+ from pathlib import Path
++from urllib.parse import urlparse
+ 
+ # We don't import cache.create_cache directly as the facebook
+ # specific import below may monkey patch it, and we want to
+@@ -25,7 +27,9 @@ from .cmd_base import BUILD_TYPE_ARG, ProjectCmdBase, UsageError
+ from .dyndeps import create_dyn_dep_munger
+ from .errors import TransientFailure
+ from .fetcher import (
++    ArchiveFetcher,
+     file_name_is_cmake_file,
++    GitFetcher,
+     is_public_commit,
+     list_files_under_dir_newer_than_timestamp,
+     safe_extractall,
+@@ -260,7 +264,11 @@ class VendorCmd(ProjectCmdBase):
+                 ignore=shutil.ignore_patterns(".git"),
+                 ignore_dangling_symlinks=True,
+             )
+-            vendored.append("%s %s\n" % (m.name, fetcher.hash()))
++            entry = "%s %s" % (m.name, _vendored_revision(fetcher))
++            version = _vendored_version(fetcher)
++            if version:
++                entry += " " + version
++            vendored.append(entry + "\n")
+             vendored_names.add(m.name)
+         # Drop trees recorded by a previous run that are no longer
+         # dependencies (e.g. after --allow-system-packages or --no-tests
+@@ -289,6 +297,102 @@ class VendorCmd(ProjectCmdBase):
+             f.writelines(vendored)
+ 
+ 
++_VERSION_IN_NAME = re.compile(r"\d+(?:[._]\d+)+|\d{4}-\d{2}-\d{2}")
++
++
++def _version_from_url(url: str) -> str | None:
++    """Best-effort version of a downloaded archive, from its file name:
++    liboqs/archive/refs/tags/0.12.0.tar.gz -> 0.12.0,
++    boost_1_83_0.tar.bz2 -> 1.83.0, re2/archive/2020-11-01.tar.gz ->
++    2020.11.01. None when the name has no version-like run (e.g. a commit
++    hash)."""
++    name = urlparse(url).path.rsplit("/", 1)[-1]
++    m = _VERSION_IN_NAME.search(name)
++    if not m:
++        return None
++    return m.group(0).replace("_", ".").replace("-", ".")
++
++
++def _git_describe_version(repo_dir: str) -> str | None:
++    """Version of a git checkout relative to its nearest tag, in the form
++    a distribution can use: the tag itself (without a leading v) when HEAD
++    is tagged, else <tag>^<distance>.<short commit>. getdeps clones are
++    shallow, so deepen the history a few times before giving up."""
++    git = ["git", "-C", repo_dir]
++
++    def describe() -> str | None:
++        try:
++            out = subprocess.check_output(
++                git + ["describe", "--tags", "--long", "--abbrev=7"],
++                stderr=subprocess.DEVNULL,
++            )
++        except (subprocess.CalledProcessError, OSError):
++            return None
++        return out.decode("utf-8").strip()
++
++    desc = describe()
++    for _ in range(4):
++        if desc:
++            break
++        try:
++            subprocess.check_call(
++                git + ["fetch", "-q", "--tags", "--deepen=250", "origin"],
++                stdout=subprocess.DEVNULL,
++                stderr=subprocess.DEVNULL,
++            )
++        except (subprocess.CalledProcessError, OSError):
++            return None
++        desc = describe()
++    if not desc:
++        return None
++    m = re.match(r"^(.*)-(\d+)-g([0-9a-f]+)$", desc)
++    if not m:
++        return None
++    tag, distance, commit = m.groups()
++    tag = re.sub(r"^v(?=\d)", "", tag)
++    if distance == "0":
++        return tag
++    return "%s^%s.%s" % (tag, distance, commit)
++
++
++def _vendored_version(fetcher) -> str | None:
++    """The version to record next to a vendored tree, or None when it cannot
++    be determined; see _version_from_url and _git_describe_version."""
++    if isinstance(fetcher, GitFetcher):
++        repo_dir = fetcher.get_src_dir()
++        if os.path.isdir(os.path.join(repo_dir, ".git")):
++            return _git_describe_version(repo_dir)
++        return None
++    if isinstance(fetcher, ArchiveFetcher):
++        return _version_from_url(fetcher.url)
++    return None
++
++
++def _vendored_revision(fetcher) -> str:
++    """The revision to record for a vendored tree.
++
++    fetcher.hash() is the manifest's idea of the version, which for a git
++    project without a pinned rev is a branch name ("main"); record the
++    commit that was actually checked out so the vendor manifest identifies
++    the sources. Falls back to hash() when there is no checkout to ask."""
++    if isinstance(fetcher, GitFetcher):
++        repo_dir = fetcher.get_src_dir()
++        if os.path.isdir(os.path.join(repo_dir, ".git")):
++            try:
++                return (
++                    subprocess.check_output(
++                        ["git", "rev-parse", "HEAD"],
++                        cwd=repo_dir,
++                        stderr=subprocess.DEVNULL,
++                    )
++                    .decode("utf-8")
++                    .strip()
++                )
++            except (subprocess.CalledProcessError, OSError):
++                pass
++    return fetcher.hash()
++
++
+ @cmd("install-system-deps", "Install system packages to satisfy the deps for a project")
+ class InstallSysDepsCmd(ProjectCmdBase):
+     def setup_project_cmd_parser(self, parser):
+diff --git a/build/fbcode_builder/getdeps/test/vendor_test.py b/build/fbcode_builder/getdeps/test/vendor_test.py
+index 1d96fea6..898b4f40 100644
+--- a/build/fbcode_builder/getdeps/test/vendor_test.py
++++ b/build/fbcode_builder/getdeps/test/vendor_test.py
+@@ -9,6 +9,7 @@ import contextlib
+ import io
+ import os
+ import shutil
++import subprocess
+ import tempfile
+ import unittest
+ from unittest.mock import MagicMock, patch
+@@ -16,6 +17,7 @@ from unittest.mock import MagicMock, patch
+ from ..buildopts import BuildOptions
+ from ..cli import VendorCmd
+ from ..fetcher import (
++    GitFetcher,
+     ChangeStatus,
+     LocalDirFetcher,
+     PreinstalledNopFetcher,
+@@ -119,6 +121,122 @@ class VendorCmdTest(unittest.TestCase):
+         with open(os.path.join(self.output_dir, "getdeps-vendor.txt")) as f:
+             self.assertEqual(f.read(), "depa %s\n" % ("a" * 40))
+ 
++    def test_records_checked_out_commit_for_git_projects(self) -> None:
++        # An unpinned git project has rev "main"; the manifest must name the
++        # commit that was actually vendored, not the branch.
++        build_opts = MagicMock()
++        build_opts.scratch_dir = self.tmp
++        fetcher = GitFetcher(
++            build_opts,
++            MagicMock(),
++            "https://example.invalid/depa.git",
++            rev=None,
++            depth=None,
++            branch="main",
++        )
++        repo = fetcher.get_src_dir()
++        os.makedirs(repo)
++        # independent of the developer's git config (identity, signing, hooks)
++        git = [
++            "git",
++            "-c",
++            "user.name=t",
++            "-c",
++            "user.email=t@t",
++            "-c",
++            "commit.gpgsign=false",
++            "-c",
++            "core.hooksPath=/dev/null",
++        ]
++        subprocess.check_call(git + ["init", "-q", "-b", "main"], cwd=repo)
++        subprocess.check_call(
++            git + ["commit", "-q", "--allow-empty", "-m", "x"], cwd=repo
++        )
++        head = (
++            subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=repo)
++            .decode()
++            .strip()
++        )
++        fetcher.update = lambda: ChangeStatus()  # no network
++        self.assertEqual(fetcher.hash(), "main")
++
++        self.run_vendor(
++            [make_manifest("depa"), make_manifest("top")],
++            {
++                "depa": fetcher,
++                "top": FakeSourceFetcher(self.make_src_tree("top"), "t" * 40),
++            },
++        )
++
++        with open(os.path.join(self.output_dir, "getdeps-vendor.txt")) as f:
++            self.assertEqual(f.read(), "depa %s\n" % head)
++        self.assertEqual(len(head), 40)
++
++    def test_records_version_from_nearest_tag(self) -> None:
++        build_opts = MagicMock()
++        build_opts.scratch_dir = self.tmp
++        fetcher = GitFetcher(
++            build_opts,
++            MagicMock(),
++            "https://example.invalid/depa.git",
++            rev=None,
++            depth=None,
++            branch="main",
++        )
++        repo = fetcher.get_src_dir()
++        os.makedirs(repo)
++        git = [
++            "git",
++            "-c",
++            "user.name=t",
++            "-c",
++            "user.email=t@t",
++            "-c",
++            "commit.gpgsign=false",
++            "-c",
++            "core.hooksPath=/dev/null",
++        ]
++        run = lambda *a: subprocess.check_call(git + list(a), cwd=repo)
++        run("init", "-q", "-b", "main")
++        run("commit", "-q", "--allow-empty", "-m", "one")
++        run("tag", "v2026.09.21.00")
++        fetcher.update = lambda: ChangeStatus()
++        top = FakeSourceFetcher(self.make_src_tree("top"), "t" * 40)
++        manifests = [make_manifest("depa"), make_manifest("top")]
++
++        # exactly on the tag: the tag, without its v
++        self.run_vendor(manifests, {"depa": fetcher, "top": top})
++        with open(os.path.join(self.output_dir, "getdeps-vendor.txt")) as f:
++            self.assertTrue(f.read().endswith(" 2026.09.21.00\n"))
++
++        # two commits past it: <tag>^<distance>.<commit>
++        run("commit", "-q", "--allow-empty", "-m", "two")
++        run("commit", "-q", "--allow-empty", "-m", "three")
++        head = (
++            subprocess.check_output(["git", "rev-parse", "--short=7", "HEAD"], cwd=repo)
++            .decode()
++            .strip()
++        )
++        self.run_vendor(manifests, {"depa": fetcher, "top": top})
++        with open(os.path.join(self.output_dir, "getdeps-vendor.txt")) as f:
++            self.assertTrue(f.read().endswith(" 2026.09.21.00^2.%s\n" % head))
++
++    def test_version_from_download_url(self) -> None:
++        from ..cli import _version_from_url
++
++        cases = {
++            "https://github.com/open-quantum-safe/liboqs/archive/refs/tags/0.12.0.tar.gz": "0.12.0",
++            "https://github.com/fmtlib/fmt/archive/refs/tags/12.1.0.tar.gz": "12.1.0",
++            "https://example.invalid/boost_1_83_0.tar.bz2": "1.83.0",
++            "https://github.com/google/re2/archive/2020-11-01.tar.gz": "2020.11.01",
++            "https://github.com/LMDB/lmdb/archive/refs/tags/LMDB_0.9.31.tar.gz": "0.9.31",
++            "https://sourceware.org/elfutils/ftp/0.193/elfutils-0.193.tar.bz2": "0.193",
++            "https://files.pythonhosted.org/packages/ab/PyYAML-6.0.3-cp38-cp38-manylinux2014_x86_64.whl": "6.0.3",
++            "https://github.com/libunwind/libunwind/archive/f081cf42917bdd5c428b77850b473f31f81767cf.tar.gz": None,
++        }
++        for url, expected in cases.items():
++            self.assertEqual(_version_from_url(url), expected, url)
++
+     def test_replaces_stale_vendored_tree(self) -> None:
+         stale = os.path.join(self.output_dir, "depa", "stale.txt")
+         os.makedirs(os.path.dirname(stale))

diff --git a/README.md b/README.md
index e2b95d8..3629685 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,12 @@ tag, run the same scan the build runs, from the unpacked source root with the
 vendor tarball extracted:
 
     awk '{ print "# " $1 " v" $2 }' vendor/getdeps-vendor.txt > vendor/modules.txt
-    go_vendor_license --config getdeps-vendor-licenses.toml report all -L
+    /usr/lib/rpm/getdeps_vendor_license_check --config getdeps-vendor-licenses.toml --report \
+        --expression "$(go_vendor_license --config getdeps-vendor-licenses.toml report expression -L)"
+
+The report is the expression `%check` accepts: the license files' licenses
+plus what `licensecheck` finds in file headers, with the files behind each
+of the latter.
 
 After a liboqs bump, check its `OQS_MINIMAL_BUILD` line in the manifest and
 the `exclude_directories` list still agree.

diff --git a/cachelib.spec b/cachelib.spec
index a43aef5..559386a 100644
--- a/cachelib.spec
+++ b/cachelib.spec
@@ -67,13 +67,25 @@ SourceLicense:  Apache-2.0
 # MIT AND BSD-2-Clause AND BSD-3-Clause             mvfst (third-party code)
 # MIT AND CC0-1.0 AND (Apache-2.0 OR CC0-1.0)       liboqs (Kyber/ML-KEM only)
 # CC0-1.0 is liboqs' aarch64 Kyber code, as in Fedora's own liboqs License tag.
+# Per-file licenses that the license files do not show, found by licensecheck
+# (the full check below): folly/hash/detail/Crc32cDetail.cpp is Zlib, mvfst's
+# quic/common/third-party/{expected.hpp,optional.h} are BSL-1.0, liboqs's
+# common/sha3 brg_endian.h is MIT-CMU and its common/aes implementations are
+# public domain, all compiled in. GPL-2.0 CMake find modules for LMDB and re2
+# and an NCSA CheckAtomic.cmake under build/fbcode_builder and the projects'
+# cmake/ directories are build-system helpers, nothing from them is compiled
+# or shipped; the license config excludes them.
 License:        %{shrink:
     Apache-2.0 AND
     BSD-2-Clause AND
     BSD-3-Clause AND
     CC0-1.0 AND
     MIT AND
-    (Apache-2.0 OR CC0-1.0)
+    (Apache-2.0 OR CC0-1.0) AND
+    BSL-1.0 AND
+    Zlib AND
+    MIT-CMU AND
+    LicenseRef-Fedora-Public-Domain
 }
 URL:            https://github.com/facebook/CacheLib
 # GitHub ignores the last path component of an archive URL, so the file is
@@ -85,6 +97,16 @@ Source0:        %{url}/archive/%{archive_ref}/%{name}-%{version}.tar.gz
 # getdeps-vendor.txt listing each project's pinned revision.
 Source1:        %{name}-%{version}-vendor.tar.xz
 Source2:        getdeps-vendor-licenses.toml
+# The per-file licensecheck pass of the license check is expensive; run it
+# only when Source1 is not the tarball it last passed on. After a full pass
+# on a new tarball, copy its sha512 here from the sources file. (Plain rpm:
+# this also runs when the SRPM is built, without folly-rpm-macros.)
+%global vendor_checked_sha512 7ee9bfeb2d52ebe6ae885d0cbaecdccc7f778f7601a9c6e24359938f3e0c39de61b23e10caee867675e1faf5d43e91923a98f89a6d3833a8ef45ce41fd36c095
+%if "%(sha512sum %{SOURCE1} 2>/dev/null | cut -c1-128)" == "%{vendor_checked_sha512}"
+%bcond_with license_full_check
+%else
+%bcond_without license_full_check
+%endif
 # Patches below apply to the vendored trees under vendor/. Each is an
 # upstream fix that the dependency revision this snapshot pins does not yet
 # include; drop them as the pins move past the landed commits.
@@ -116,6 +138,9 @@ Patch6:         0007-getdeps-keep-LDFLAGS-on-the-shared-library-links.patch
 # libstdc++ 16's own heterogeneous lookup; fix on Michel's fork, submitted
 # internally
 Patch7:         0008-folly-F14-fallback-forward-exact-key-lookups.patch
+# getdeps-vendor.txt gains the version of each vendored project, from which
+# the bundled() Provides are versioned (applied by vendor.sh before vendoring)
+Patch8:         0009-getdeps-record-the-checked-out-commit-and-a-version.patch
 
 ExclusiveArch:  x86_64 aarch64 ppc64le
 # -devel (last shipped as 17^20250203 in Fedora, 16^20230424 in EPEL 9) is gone:
@@ -123,7 +148,7 @@ ExclusiveArch:  x86_64 aarch64 ppc64le
 # packages, so there is nothing usable to ship. No Provides on purpose.
 Obsoletes:      %{name}-devel < 19.2026.09.14.00
 
-BuildRequires:  folly-rpm-macros >= 46
+BuildRequires:  folly-rpm-macros >= 46-3
 %if %{with toolchain_clang}
 BuildRequires:  clang
 %else
@@ -147,9 +172,20 @@ caching transparently.}
 
 %prep
 %autosetup -n %{archive_dir} -a1 -p1
+# delete vendored code that is neither compiled nor referenced by the build
+# (the config's prune_directories: fbthrift's Go bindings)
+%getdeps_vendor_prune -c %{SOURCE2}
 
 
 %build
+# Verify the License tag first: it only needs the unpacked trees, and a
+# wrong tag then fails here in minutes rather than after the build. Not in
+# %%prep, which the dynamic BuildRequires passes run more than once, before
+# the detector is installed. -f adds the per-file licensecheck pass, see
+# vendor_checked_sha512 above.
+# -L: liboqs's LICENSE.txt sits in a versioned subdirectory of its tree (as
+# did sparse-map's while it was vendored)
+%getdeps_vendor_license_check -c %{SOURCE2} -L %{?with_license_full_check:-f}
 %getdeps_build %{?with_check:-t}
 
 
@@ -170,8 +206,6 @@ rm -rf %{buildroot}%{_prefix}/tests
 
 
 %check
-# -L: sparse-map's LICENSE sits in a versioned subdirectory of its tree
-%getdeps_vendor_license_check -c %{SOURCE2} -L
 %if %{with check}
 %getdeps_test
 %endif

diff --git a/getdeps-vendor-licenses.toml b/getdeps-vendor-licenses.toml
index 68cb1a0..308a65b 100644
--- a/getdeps-vendor-licenses.toml
+++ b/getdeps-vendor-licenses.toml
@@ -2,17 +2,27 @@
 # Paths are relative to the unpacked source tree.
 [licensing]
 detector = "askalono"
-# Not compiled into cachelib: each Meta project's copy of the fbcode_builder
-# build scripts (MIT), fbthrift's Go bindings, and magic_enum's test suite and
-# CMake helper (Catch2 BSL-1.0, Unlicense). Excluding them keeps the License
+# Present at build time but not part of the shipped binaries: each Meta
+# project's copy of the fbcode_builder build scripts (needed by its CMake
+# configure), magic_enum's test suite and CMake helper (Catch2 BSL-1.0,
+# Unlicense), liboqs's tests and the liboqs algorithms OQS_MINIMAL_BUILD
+# leaves out. Excluding them keeps the License
 # tag to what the binaries actually contain.
 exclude_directories = [
+  # the project's own fbcode_builder copy (GPL-2.0 CMake find modules for
+  # LMDB and re2 among the helpers) and the vendored projects' cmake helper
+  # directories (NCSA CheckAtomic.cmake): needed to configure, not shipped
+  "build/fbcode_builder",
+  "vendor/fizz/fizz/cmake",
+  "vendor/wangle/wangle/cmake",
+  "vendor/mvfst/cmake",
   "vendor/folly/build/fbcode_builder",
   "vendor/fizz/build/fbcode_builder",
   "vendor/wangle/build/fbcode_builder",
   "vendor/mvfst/build/fbcode_builder",
   "vendor/fbthrift/build/fbcode_builder",
-  "vendor/fbthrift/thrift/lib/go",
+  # liboqs test suite (Unlicense), not built: OQS tests are off
+  "vendor/liboqs/liboqs-0.12.0/tests",
   "vendor/magic_enum/test",
   "vendor/magic_enum/cmake",
   # liboqs is built with OQS_MINIMAL_BUILD limited to Kyber and ML-KEM (see
@@ -94,3 +104,13 @@ expression = "CC0-1.0 OR Apache-2.0"
 path = "vendor/liboqs/liboqs-0.12.0/src/kem/ml_kem/pqcrystals-kyber-standard_ml-kem-768_ref/LICENSE"
 sha256sum = "53681bce13fd98721b4cabcd0b6184c6a92d9de813a02536161cc706e4ea9f2e"
 expression = "CC0-1.0 OR Apache-2.0"
+
+# Vendored code the build does not need at all: %getdeps_vendor_prune deletes
+# it in %prep, so it is neither scanned nor declared. Anything a CMakeLists.txt
+# still refers to (each project's build/fbcode_builder/CMake modules, liboqs's
+# tests directory) cannot go here and is excluded from the scans above instead.
+[getdeps]
+prune_directories = [
+  "vendor/fbthrift/thrift/lib/go",
+]
+

diff --git a/sources b/sources
index 6192156..7caa2e1 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (cachelib-19.2026.09.14.00^38.ee4c153.tar.gz) = 81937b719d32c01e5b9ca1e191020395551f0bfc30aafef6f1ec254ae7d469bac40b16f6fea13c4460985502e28e8fae9d913c7f5da87c24dabbfbd90825df96
-SHA512 (cachelib-19.2026.09.14.00^38.ee4c153-vendor.tar.xz) = f26920c0d9069ef78fddc2775a2a0ea82bd45f4104570d32d8ceb0b79d50ea8e5facff8d1f3847e58eeb5a1397ceee453b818bd2ac288e369b8023307f062115
+SHA512 (cachelib-19.2026.09.14.00^38.ee4c153-vendor.tar.xz) = 7ee9bfeb2d52ebe6ae885d0cbaecdccc7f778f7601a9c6e24359938f3e0c39de61b23e10caee867675e1faf5d43e91923a98f89a6d3833a8ef45ce41fd36c095