in-place update of GULP 6.1 source tarball results in checksum validation failure

[boegel]

The installation of GULP 6.1 (contributed in #15754) is failing for me because the checksum validation is failing on the source tarball gulp-6.1.tgz.

This already happened in July, and when trying re-downloading the sources of GULP 6.1 today, I obtained yet another source tarball (different from the one in July, and different from the one used to test #15754 based on the SHA256 checksum).

A diff on the contents of the source tarball I downloaded on 2022-07-07 and 2022-08-06 shows that there was indeed an in-place update, here's a small part of the diff output:

diff -ru gulp-6.1.2022-07-07/Src/banner.F90 gulp-6.1.2022-08-06/Src/banner.F90
--- gulp-6.1.2022-07-07/Src/banner.F90  2022-06-30 02:34:20.163000000 +0200
+++ gulp-6.1.2022-08-06/Src/banner.F90  2022-07-19 07:02:15.383000000 +0200
@@ -70,7 +70,7 @@
     write(ioout,'(''*                    School of Molecular and Life Sciences                     *'')')
     write(ioout,'(''*                    Curtin University, Western Australia                      *'')')
     write(ioout,'(''********************************************************************************'')')
-    write(ioout,'(''* Version = 6.1.0 * Last modified =  23rd June 2022                            *'')')
+    write(ioout,'(''* Version = 6.1.0 * Last modified =   8th July 2022                            *'')')
     write(ioout,'(''********************************************************************************'')')
 #endif
   endif
diff -ru gulp-6.1.2022-07-07/Src/gafit.F90 gulp-6.1.2022-08-06/Src/gafit.F90
--- gulp-6.1.2022-07-07/Src/gafit.F90   2022-06-30 02:34:20.163000000 +0200
+++ gulp-6.1.2022-08-06/Src/gafit.F90   2022-07-19 07:02:15.383000000 +0200
@@ -22,6 +22,7 @@
 !        fconf is dimensioned corrected before being addressed
 !   1/18 Print option added
 !   1/18 Trace added
+!   7/22 Writing of dumpfile added
 !
 !  Conditions of use:
 !

There are also actual code changes (which I've omitted here).

This makes me conclude that including a checksum for GULP 6.1 is pointless, since it's very likely additional in-place updates will be done, so we should update the easyconfig to use None as checksum for the source tarball?

We should probably also reach out to the developers of GULP and ask them to consider to stop doing in-place updates, and using semantic versioning instead...

@smoors @jfgrimm Thoughts on this?

[sassy-crick]

Let me see if I can get the contact details of one of the developers. No promises here!

[sassy-crick]

Update on this:
The developer seems to understand the issue in-place updates are causing and we agreed that going forward the versioning scheme should be X.Y.Z, as recommended here:
http://semver.org/
So I hope that matter is now all settled.