From d4f7aeaa21ffe396abbd639f56477f91d587e7ee Mon Sep 17 00:00:00 2001
From: bung87 <crc32@qq.com>
Date: Fri, 29 May 2026 22:51:13 +0800
Subject: [PATCH 1/2] Respect skipDirs when calculating package checksum

---
 src/nimblepkg/checksums.nim     | 15 ++++++++++++---
 src/nimblepkg/packageparser.nim |  2 +-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/nimblepkg/checksums.nim b/src/nimblepkg/checksums.nim
index 8eaf4b7bb..7b5360318 100644
--- a/src/nimblepkg/checksums.nim
+++ b/src/nimblepkg/checksums.nim
@@ -1,7 +1,7 @@
 # Copyright (C) Dominik Picheta. All rights reserved.
 # BSD License. Look at license.txt for more info.
 
-import os, strformat, algorithm
+import os, strformat, strutils, algorithm
 import common, version, sha1hashes, vcstools, paths, cli
 import pkg/checksums/sha1
 
@@ -57,10 +57,12 @@ proc updateSha1Checksum(checksum: var Sha1State, fileName, filePath: string) =
       if bytesRead == 0: break
       checksum.update(buffer.toOpenArray(0, bytesRead - 1))
 
-proc calculateDirSha1Checksum*(dir: string): Sha1Hash =
+proc calculateDirSha1Checksum*(dir: string, skipDirs: seq[string] = @[]): Sha1Hash =
   ## Recursively calculates the sha1 checksum of the contents of the directory
   ## `dir` and its subdirectories.
   ##
+  ## Files inside directories listed in `skipDirs` are excluded from the checksum.
+  ##
   ## Raises a `NimbleError` if:
   ##   - the external command for getting the package file list fails.
   ##   - the directory does not exist.
@@ -69,5 +71,12 @@ proc calculateDirSha1Checksum*(dir: string): Sha1Hash =
   packageFiles.sort
   var checksum = newSha1State()
   for file in packageFiles:
-    updateSha1Checksum(checksum, file, dir / file)
+    var shouldSkip = false
+    for skipDir in skipDirs:
+      let normalizedSkipDir = skipDir.strip(leading = false, trailing = true, chars = {'/'})
+      if file == normalizedSkipDir or file.startsWith(normalizedSkipDir & "/"):
+        shouldSkip = true
+        break
+    if not shouldSkip:
+      updateSha1Checksum(checksum, file, dir / file)
   result = initSha1Hash($SecureHash(checksum.finalize()))
diff --git a/src/nimblepkg/packageparser.nim b/src/nimblepkg/packageparser.nim
index 1eb894f46..cddae8a0b 100644
--- a/src/nimblepkg/packageparser.nim
+++ b/src/nimblepkg/packageparser.nim
@@ -325,7 +325,7 @@ proc readPackageInfo(pkgInfo: var PackageInfo, nf: NimbleFile, options: Options,
   if not fileDir.startsWith(options.getPkgsDir()):
     # If the `.nimble` file is not in the installation directory we have to get
     # some of the package meta data from its directory.
-    pkgInfo.basicInfo.checksum = calculateDirSha1Checksum(fileDir)
+    pkgInfo.basicInfo.checksum = calculateDirSha1Checksum(fileDir, pkgInfo.skipDirs)
     # By default specialVersion is the same as version.
     pkgInfo.metaData.specialVersions.incl pkgInfo.basicInfo.version
     # If the `fileDir` is a VCS repository we can get some of the package meta

From 24295489bc55ce08dec56db4f1806a2f66b86fde Mon Sep 17 00:00:00 2001
From: bung87 <crc32@qq.com>
Date: Sat, 30 May 2026 02:08:16 +0800
Subject: [PATCH 2/2] Update test lock file checksums for winim and sdl2_nim

---
 tests/lockfile-subdep/nimble.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/lockfile-subdep/nimble.lock b/tests/lockfile-subdep/nimble.lock
index 39b9437d4..758eade64 100644
--- a/tests/lockfile-subdep/nimble.lock
+++ b/tests/lockfile-subdep/nimble.lock
@@ -10,7 +10,7 @@
         "downloadMethod": "git",
         "dependencies": [],
         "checksums": {
-          "sha1": "02cf5882b51550d7faddbce7eedac35c94dea729"
+          "sha1": "a27b39aa20dec862fa22c3a33137803cacbe2bbc"
         }
       },
       "x11": {
@@ -33,7 +33,7 @@
           "x11"
         ],
         "checksums": {
-          "sha1": "dd020f93fcf762e28d3d1462a7bba0c91a5a36dd"
+          "sha1": "59e9de65fac3d8123b5f1b677b3fa18beb02d855"
         }
       }
     }