fix: a source moved upstream says how to pin it; the canary takes AMF 1.5.3's re-cut

examples/canary/ffmpeg.lock

@@ -3,7 +3,7 @@ engine: 0.0.1
 ffmpeg:
   "9": { version: 9.0.2, sha256: 8c3850283eb25fa026482078a04051e0be17347b09ef81a0849bec15a96e002e }
 libraries:
-  amf: { version: 1.5.3, commit: 8c648005e07d4309033282bfd9947df2c7e76104 }
+  amf: { version: 1.5.3, commit: 57ee0cfb0e1a08d9041f77435653794c1b012be0 }
   aom: { version: 3.15.1, commit: 44d0a57786f432d933ff64b653347c66f4d0fa1d }
   brotli: { version: 1.2.0, commit: 028fb5a23661f123017c060daa546b55cf4bde29 }
   chromaprint: { version: 1.6.1, commit: aed8eba2202dd9d7b3b0a56c77904cc805490d72 }

src/build/fetch.ts

@@ -207,7 +207,8 @@ export async function fetchSource(
     rmSync(dest, { recursive: true, force: true });
     if (mismatches.length) {
       throw new SourceIntegrityError(
-        `${name}: ${mismatches.join('; ')}, but ffmpeg.lock pins ${String(pin)}; if upstream really replaced it, run ffmpeg-build update (or delete its entry in ffmpeg.lock and run ffmpeg-build lock) to pin the new content`,
+        // update keeps the pin of a version the lock already has, so only a new lock entry takes the new content
+        `${name}: ${mismatches.join('; ')}, but ffmpeg.lock pins ${String(pin)}; if upstream really replaced it, delete ${name}'s entry in ffmpeg.lock and run ffmpeg-build lock to pin the new content`,
       );
     }
     throw new Error(`could not download from any of: ${source.archives.join(' ')}`);
@@ -230,7 +231,8 @@ export async function fetchSource(
     rmSync(dest, { recursive: true, force: true });
     throw new SourceIntegrityError(
       'ref' in source
-        ? `${name}: ref ${source.ref} of ${origin} is commit ${head}, but ffmpeg.lock pins ${source.commit}; if upstream moved it on purpose, run ffmpeg-build update (or delete its entry in ffmpeg.lock and run ffmpeg-build lock) to pin the new commit`
+        ? // update keeps the pin of a version the lock already has, so only a new lock entry takes the new commit
+          `${name}: ref ${source.ref} of ${origin} is commit ${head}, but ffmpeg.lock pins ${source.commit}; if upstream moved it on purpose, delete ${name}'s entry in ffmpeg.lock and run ffmpeg-build lock to pin the new commit`
         : `${name}: ${origin} gave commit ${head}, not ${source.commit}`,
     );
   }

tests/source-verify.test.ts

@@ -77,6 +77,28 @@ describe('a pinned git source', () => {
     );
   });
 
+  it('says how to accept a tag moved upstream: update keeps the pin of a version it already has', async () => {
+    const f = folders();
+    const repo = makeGitRepo([]);
+    execFileSync(
+      'git',
+      ['-c', 'user.name=t', '-c', 'user.email=t@t', 'commit', '-q', '--allow-empty', '-m', 'moved'],
+      { cwd: repo.dir },
+    );
+    addTag(repo.dir, '1.5.4');
+    const error = await fetchSource(
+      { git: repo.url, ref: '1.5.4', commit: repo.head },
+      f.dest,
+      'dav1d',
+      f.sources,
+      f.work,
+    ).catch((e: unknown) => e as Error);
+    expect((error as Error).message).toContain(
+      "if upstream moved it on purpose, delete dav1d's entry in ffmpeg.lock and run ffmpeg-build lock to pin the new commit",
+    );
+    expect((error as Error).message).not.toContain('ffmpeg-build update');
+  });
+
   it('checks a branch library’s commit too', async () => {
     const f = folders();
     const repo = makeGitRepo([]);
@@ -113,6 +135,12 @@ describe('a pinned tarball', () => {
     await expect(
       fetchSource({ archives: [t.url], sha256: pin }, f.dest, 'lame', f.sources, f.work),
     ).rejects.toThrow(`lame: ${t.url} has sha256 ${sha(t.bytes)}, but ffmpeg.lock pins ${pin}`);
+    // update keeps the pin of a version the lock already has: only a new entry takes the new content
+    await expect(
+      fetchSource({ archives: [t.url], sha256: pin }, f.dest, 'lame', f.sources, f.work),
+    ).rejects.toThrow(
+      "if upstream really replaced it, delete lame's entry in ffmpeg.lock and run ffmpeg-build lock to pin the new content",
+    );
     expect(existsSync(join(f.dest, 'README'))).toBe(false);
     expect(existsSync(join(f.sources, 'lame', 'lame-4.0.tar.gz'))).toBe(false);
   });