Skip to content

Conversation

@SorYoshino
Copy link
Contributor

@SorYoshino SorYoshino commented Oct 25, 2025

Summary

Updates meshroom to version 2025.1.0 and switches the download source from FossHub to Zenodo, which now hosts the official release archives. Also improves license metadata and adjusts extraction paths accordingly.

Related issues or pull requests

Changes

  • Updated version to 2025.1.0
  • Changed download source from www.fosshub.com to zenodo.org
  • Updated hash to MD5 checksum (as provided by Zenodo)
  • Added explicit extract_dir for the new archive structure
  • Improved license field with SPDX identifier and URL
  • Updated autoupdate to reference the new Zenodo record page and regex-based hash detection

Notes

  • www.fosshub.com links are no longer valid for direct downloads and now return HTML pages instead of the actual archives.
  • Zenodo is now the official host for Meshroom releases and provides stable, checksum-verified downloads.
  • Since the installer is approximately 9.3 GB in size, the MD5 checksum is still used even though it is not cryptographically secure, because it is directly obtainable from the download URL.
  • Additionally, the download, hash verification, and installation stages require a significant amount of time to complete.

Testing

┏[ D:\Software\Scoop\Local\apps\scoop\current\bin][ master ≡]
└─> .\checkver.ps1 -App meshroom -Dir "D:\Temporary\Software\Microsoft\Windows Sandbox\Repositories\Scoop\Buckets\Extras\bucket" -f
meshroom: 2025.1.0 (scoop version is 2025.1.0)
Forcing autoupdate!
Autoupdating meshroom
DEBUG[1761384494] [$updatedProperties] = [url hash extract_dir] -> D:\Software\Scoop\Local\apps\scoop\current\lib\autoupdate.ps1:491:5
DEBUG[1761384494] $substitutions (hashtable) -> D:\Software\Scoop\Local\apps\scoop\current\lib\autoupdate.ps1:221:5
DEBUG[1761384494] $substitutions.$patchVersion                  0
DEBUG[1761384494] $substitutions.$matchHead                     2025.1.0
DEBUG[1761384494] $substitutions.$majorVersion                  2025
DEBUG[1761384494] $substitutions.$match1                        2025.1.0
DEBUG[1761384494] $substitutions.$basenameNoExt                 Meshroom-2025.1.0-Windows
DEBUG[1761384494] $substitutions.$cleanVersion                  202510
DEBUG[1761384494] $substitutions.$underscoreVersion             2025_1_0
DEBUG[1761384494] $substitutions.$url                           https://zenodo.org/records/16887472/files/Meshroom-2025.1.0-Windows.zip
DEBUG[1761384494] $substitutions.$buildVersion
DEBUG[1761384494] $substitutions.$preReleaseVersion             2025.1.0
DEBUG[1761384494] $substitutions.$urlNoExt                      https://zenodo.org/records/16887472/files/Meshroom-2025.1.0-Windows
DEBUG[1761384494] $substitutions.$dashVersion                   2025-1-0
DEBUG[1761384494] $substitutions.$dotVersion                    2025.1.0
DEBUG[1761384494] $substitutions.$minorVersion                  1
DEBUG[1761384494] $substitutions.$basename                      Meshroom-2025.1.0-Windows.zip
DEBUG[1761384494] $substitutions.$baseurl                       https://zenodo.org/records/16887472/files
DEBUG[1761384494] $substitutions.$matchTail
DEBUG[1761384494] $substitutions.$matchDoi                      16887472
DEBUG[1761384494] $substitutions.$version                       2025.1.0
DEBUG[1761384494] $substitutions.$matchName                     Meshroom-2025.1.0-Windows.zip
DEBUG[1761384494] $hashfile_url = https://zenodo.org/api/records/16887472 -> D:\Software\Scoop\Local\apps\scoop\current\lib\autoupdate.ps1:224:5
Searching hash for Meshroom-2025.1.0-Windows.zip in https://zenodo.org/api/records/16887472
DEBUG[1761384495] $regex = (?msi)"Meshroom-2025\.1\.0-Windows\.zip".+?"md5:([a-fA-F0-9]{32})" -> D:\Software\Scoop\Local\apps\scoop\current\lib\autoupdate.ps1:78:9
Found: md5:6af3282e0b6e739a36a2607d8e86fa82 using Extract Mode
Writing updated meshroom manifest

┏[ D:\Temporary\Software\Microsoft\Windows Sandbox\Repositories\Scoop\Buckets\Extras\bucket][ meshroom ≢  ~1]
└─> scoop install .\meshroom.json
Installing 'meshroom' (2025.1.0) [64bit] from 'D:\Temporary\Software\Microsoft\Windows Sandbox\Repositories\Scoop\Buckets\Extras\bucket\meshroom.json'
Loading Meshroom-2025.1.0-Windows.zip from cache.
Checking hash of Meshroom-2025.1.0-Windows.zip ... ok.
Extracting Meshroom-2025.1.0-Windows.zip ... done.
Linking D:\Software\Scoop\Local\apps\meshroom\current => D:\Software\Scoop\Local\apps\meshroom\2025.1.0
Creating shim for 'meshroom'.
Creating shortcut for Meshroom (meshroom.exe)
'meshroom' (2025.1.0) was installed successfully!

  • Use conventional PR title: <manifest-name[@version]|chore>: <general summary of the pull request>
  • I have read the Contributing Guide

Summary by CodeRabbit

  • Chores

    • Version updated to 2025.1.0
    • License information converted to structured format (identifier + URL)
    • Homepage URL normalized (trailing slash removed)
    • Download source refreshed (moved to archived distribution host) and integrity hashes updated
    • Release-check and auto-update fetching/parsing refreshed to use direct release API and new response parsing
  • New Features

    • Added a desktop shortcut entry for Meshroom executable

@coderabbitai
Copy link

coderabbitai bot commented Oct 25, 2025

Walkthrough

Manifest updated: version bumped to 2025.1.0; release source switched from Fosshub to Zenodo; download URL, extract_dir, and hash format changed to md5; homepage and license fields normalized; checkver and autoupdate now use URL/jsonpath/regex to parse GitHub/Zenodo responses.

Changes

Cohort / File(s) Change Summary
Scoop Manifest
bucket/meshroom.json
Version bumped to 2025.1.0; homepage trailing slash removed; license converted to object with identifier and URL (MPL-2.0); 64-bit download URL moved from Fosshub to Zenodo and extract_dir updated; hash changed to md5 and autoupdate hash extraction implemented via regex; checkver/autoupdate rewritten to use explicit URL/jsonpath/regex parsing for GitHub Releases and Zenodo.

Sequence Diagram(s)

sequenceDiagram
    participant CI as CI / Updater
    participant Manifest as manifest (checkver/autoupdate)
    participant GitHub as GitHub Releases API
    participant Zenodo as Zenodo record

    CI->>Manifest: trigger update check
    Manifest->>GitHub: fetch releases JSON (Releases API)
    GitHub-->>Manifest: releases JSON
    Manifest->>Zenodo: derive $matchDoi/$matchName, request Zenodo record
    Zenodo-->>Manifest: Zenodo JSON (file list + md5)
    Manifest->>CI: provide version, templated Zenodo download URL, extracted md5
    CI->>CI: download & install Meshroom-<version>-Windows.zip (extract_dir)
Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

  • Review focus:
    • validate jsonpath and regex for GitHub Releases and Zenodo responses
    • confirm md5 extraction regex and templated URL variables ($matchDoi, $matchName)
    • verify license object and homepage normalization

Possibly related PRs

Suggested reviewers

  • z-Fng

Poem

🐰 I hopped through lines of JSON bright,
Swapped Fosshub for Zenodo's light,
Version climbed, the hashes found,
Regex danced and APIs hummed sound,
Meshroom ready — carrots all right. 🥕✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check name Status Explanation
Title Check ✅ Passed The PR title "meshroom: Update to version 2025.1.0, fix checkver & autoupdate" directly reflects the primary changes in the pull request: updating the Meshroom manifest to version 2025.1.0 and fixing the checkver and autoupdate configuration. The title is specific, concise, and clearly communicates the main objective without vague terminology or unnecessary details. It accurately summarizes the changeset by referencing both the version update and the update mechanism fixes resulting from the download source migration.
Description Check ✅ Passed The PR description is comprehensive and well-structured, containing all required elements from the template. It includes a clear summary explaining the update to version 2025.1.0 and the switch from FossHub to Zenodo, with related issue references (#16379 and #16460) using the "Relates to" format. Both mandatory checkboxes are marked as completed: the conventional PR title format (manifest-name[@version]: summary) and the Contributing Guide acknowledgment. Additionally, the author has provided extensive supporting information including detailed change documentation, explanatory notes about why FossHub links no longer work and why MD5 is appropriate for this large installer, and comprehensive testing results with PowerShell output demonstrating successful autoupdate and installation.
✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between cfb3859 and 6264866.

📒 Files selected for processing (1)
  • bucket/meshroom.json (2 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-10-16T15:59:21.258Z
Learnt from: o-l-a-v
PR: ScoopInstaller/Extras#16349
File: bucket/fvim.json:45-49
Timestamp: 2025-10-16T15:59:21.258Z
Learning: In Scoop manifests, the `autoupdate.url` and `autoupdate.architecture.<arch>.url` fields must be valid URIs according to the JSON schema (defined with `"format": "uri"`). Variables like `$matchUrlx64` that contain only path segments must be combined with a base URL (e.g., `https://github.com/.../releases/download/`) to form a complete valid URI.

Applied to files:

  • bucket/meshroom.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
  • GitHub Check: WindowsPowerShell
  • GitHub Check: PullRequestHandler
🔇 Additional comments (3)
bucket/meshroom.json (3)

30-33: Verify regex pattern matches Zenodo HTML structure.

The hash extraction regex ((?msi)>$basename</a>.+?>md5:$md5) assumes the Zenodo record page displays filenames as clickable links followed by checksums in the format md5:<hash>. While the PR objectives note successful testing, please ensure this pattern will remain stable across Zenodo UI updates.

Recommended: Add a comment in the manifest documenting the expected HTML structure so future maintainers understand the dependency.


5-8: License metadata improved.

The upgrade from a plain license string to an object with SPDX identifier and license file URL is a best practice and improves clarity for tooling and end-users.


11-13: URL migration to Zenodo and extract_dir update look correct.

The new Zenodo URL is properly structured, and extract_dir: "Meshroom-2025.1.0" aligns with the archive contents. The URI format complies with JSON schema requirements.

@github-actions
Copy link
Contributor

All changes look good.

Wait for review from human collaborators.

meshroom

  • Lint
  • Description
  • License
  • Hashes
  • Checkver
  • Autoupdate
  • Autoupdate Hash Extraction

Check the full log for details.

@SorYoshino SorYoshino changed the title meshroom: Update to version 2025.1.0, update autoupdate meshroom: Update to version 2025.1.0, fix checkver & autoupdate Oct 25, 2025
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (2)
bucket/meshroom.json (2)

1-40: Dynamic record ID extraction addresses the past critical issue—well done.

The hardcoded Zenodo record ID concern from the previous review is now resolved. By extracting $matchDoi from GitHub release notes, the manifest no longer couples to a specific version's record ID. This enables autoupdate to handle future versions automatically, provided release notes follow the expected format.

To ensure long-term maintainability and prevent silent autoupdate failures:

  1. Document the GitHub release note format in a comment or CONTRIBUTING guide so future maintainers know they must include [Meshroom-VERSION-Windows](https://zenodo.org/records/RECORD_ID/files/FILENAME.zip) in release body.
  2. Monitor Zenodo API changes (see recommendation above for hash extraction) to ensure HTML scraping remains reliable.
  3. Add defensive logging or error reporting if regex extraction fails, so users get meaningful feedback rather than silent autoupdate breakage.

The implementation is pragmatic given Scoop's constraints. The PR testing confirms the current approach works.


28-39: Consider replacing HTML regex scraping with Zenodo REST API for robust hash extraction.

The current hash extraction (lines 32-35) relies on HTML regex scraping, which is fragile. Zenodo's Records REST API (GET /api/records/{id}) returns file metadata including checksums in format "md5:", providing a more reliable alternative.

Suggested improvement: Replace the regex-based extraction with an API call to https://zenodo.org/api/records/$matchDoi, parse the JSON response, and extract the checksum from the matching file object. This eliminates dependence on HTML structure changes and is more maintainable.

If staying with regex scraping, add a code comment documenting the expected HTML format for future maintainers.

Note: Current implementation works (confirmed by PR testing), so this is a forward-looking maintainability improvement rather than a critical issue.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 6264866 and 45ed2cf.

📒 Files selected for processing (1)
  • bucket/meshroom.json (2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: WindowsPowerShell
🔇 Additional comments (2)
bucket/meshroom.json (2)

2-15: Version, homepage, license, and architecture updates look good.

Version and extract_dir correctly reflect the new Zenodo archive structure; license now uses structured SPDX format with source link; MD5 hash is appropriate for the ~9.3 GB installer size.


23-27: Verify that $version variable correctly captures the unnamed regex group.

The checkver regex captures version in an unnamed group ([\\d.]+). According to Scoop's autoupdate documentation, unnamed groups map to $match1, $match2, etc., while $version is a special variable. Verify that the autoupdate line 36 correctly references $version and that this variable receives the captured version from the regex. If $version doesn't automatically populate from the first unnamed group, the extract_dir substitution will fail.

You can verify this by checking the Scoop documentation or testing a future release:

  • Confirm that GitHub release notes will consistently follow the format [...-VERSION-Windows](...records/ID/files/FILENAME)
  • If the format might vary, consider adding a secondary pattern or documentation for release maintainers

Given that the PR testing logs show successful autoupdate detection, this may already be working correctly—please confirm.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (1)
bucket/meshroom.json (1)

23-26: Add an explanatory comment for the checkver regex pattern—the format must be maintained upstream.

The checkver regex expects GitHub release notes to include a Zenodo link in markdown format: [VERSION-... Windows](zenodo.org/records/XXXXX/files/FILENAME). This is not documented in the manifest.

Add a brief comment above the regex explaining the expected format, so future maintainers understand the dependency:

"checkver": {
    "url": "https://api.github.com/repositories/34405381/releases/latest",
    "jsonpath": "$.body",
    "regex": "(?i)\\[[^[]+-([\\d.]+)[^[]+Windows\\]\\(.+records/(?<doi>[\\d]+)/files/(?<name>[^]]+)\\)"
}

Becomes:

"checkver": {
    "url": "https://api.github.com/repositories/34405381/releases/latest",
    "jsonpath": "$.body",
    "regex": "Expects release body: [VERSION Windows](zenodo.org/records/ID/files/FILENAME)",
    "regex": "(?i)\\[[^[]+-([\\d.]+)[^[]+Windows\\]\\(.+records/(?<doi>[\\d]+)/files/(?<name>[^]]+)\\)"
}

Verify with Meshroom maintainers that all future releases will include the Zenodo link in this format. If they cannot commit to this, the autoupdate will silently fail for new versions.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 45ed2cf and aaec54d.

📒 Files selected for processing (1)
  • bucket/meshroom.json (2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: WindowsPowerShell
🔇 Additional comments (2)
bucket/meshroom.json (2)

4-8: Metadata normalization looks good.

Homepage now correctly omits the trailing slash, and the license is properly formatted with SPDX identifier and URL. This improves manifest consistency.


31-35: Verification complete—regex pattern correctly matches Zenodo API response format.

The regex pattern (?msi)\"$basename\".+?\"md5:$md5\" successfully extracts the MD5 checksum from the actual Zenodo API response. Testing against record 16887472 confirms the pattern matches the expected format where the filename (stored in the key field) is followed by the checksum value in the format "md5:...". The pattern handles multiple files correctly, and no edge cases were identified in the API response structure.

@SorYoshino
Copy link
Contributor Author

/verify

@github-actions
Copy link
Contributor

All changes look good.

Wait for review from human collaborators.

meshroom

  • Lint
  • Description
  • License
  • Hashes
  • Checkver
  • Autoupdate
  • Autoupdate Hash Extraction

Check the full log for details.

Copy link
Member

@z-Fng z-Fng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@z-Fng z-Fng merged commit 3d88ad8 into ScoopInstaller:master Oct 25, 2025
3 checks passed
@SorYoshino SorYoshino deleted the meshroom branch October 26, 2025 05:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants