archlinux-file-from-pkgbuild cannot verify the package file

[qurczak]

Hello.

https://github.com/kpcyrd/backseat-signed?tab=readme-ov-file#how-to-use-the-plumbing-commands

I’m trying to verify the integrity of an freshly build Arch Linux package with the backseat-signed plumbing command archlinux-file-from-pkgbuild, but it fails. So I’m not sure whether I’m using the tool incorrectly or whether there’s a problem in my PKGBUILD.

Question:
🤔 Is the tool being used incorrectly by me, or is there an issue in the PKGBUILD that prevents archlinux-file-from-pkgbuild from verifying the package?

• archlinux-pkg-from-sig

$ backseat-signed plumbing archlinux-pkg-from-sig \
    --keyring ~/.gnupg/pubring.gpg \
    --sig backseat-signed-0.1.0-3-x86_64.pkg.tar.xz.sig \
    backseat-signed-0.1.0-3-x86_64.pkg.tar.xz

[2025-10-27T14:48:17Z INFO  backseat_signed::plumbing] Loading keyring from "/home/xxx/.gnupg/pubring.gpg"
[2025-10-27T14:48:17Z INFO  backseat_signed::plumbing] Loaded 17 public keys
[2025-10-27T14:48:17Z INFO  backseat_signed::plumbing] Loading signature from "backseat-signed-0.1.0-3-x86_64.pkg.tar.xz.sig"
[2025-10-27T14:48:17Z INFO  backseat_signed::plumbing] Loading package from "backseat-signed-0.1.0-3-x86_64.pkg.tar.xz"
[2025-10-27T14:48:17Z INFO  backseat_signed::plumbing] Package verified successfully

• archlinux-file-from-pkgbuild

$ backseat-signed plumbing archlinux-file-from-pkgbuild \
    --pkgbuild ~/.cache/yay/backseat-signed/PKGBUILD \
    backseat-signed-0.1.0-3-x86_64.pkg.tar.xz

[2025-10-27T14:49:25Z INFO  backseat_signed::plumbing] Loading PKGBUILD from "/home/xxx/.cache/yay/backseat-signed/PKGBUILD"
[2025-10-27T14:49:25Z INFO  backseat_signed::plumbing] Loading file from "backseat-signed-0.1.0-3-x86_64.pkg.tar.xz"
[2025-10-27T14:49:25Z INFO  backseat_signed::plumbing] Checking hashes
Error: PKGBUILD does not seem to have any matching sources, sha256=None, sha512=None, blake2b=Some("f68c8c9b1351fdf96098e7bb5214836a08e6ba149c96c458896813c6f5d4e35029325c2f8a1d706f1754ad700dd68f38279b979045c9162b8c981d08f6529cb0")

PKGBUILD snippet

# ~/.cache/yay/backseat-signed/PKGBUILD
source=("$pkgname-$pkgver.tar.gz::https://static.crates.io/crates/$pkgname/$pkgname-$pkgver.crate")
b2sums=('2b0ed792ea4e360a4c7bd94c9795d7731e995c41e8434673e52b39264d5f15cbb4ab10c450bf65793087483f0ba1f4bf678e9705ab64c9ec4575cf4fad3b5606')