mkwheels: set pipefail; clarify requirements.txt is audit-only

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2 files changed, 5 insertions, 1 deletions

diff --git a/README.md b/README.md
index 499a6cc..8823a3b 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,10 @@ mkwheels <pkg> <ver> [epoch]
 - `OUTPUT` env var overrides the output directory (default: current dir).
 
 Outputs `<pkg>-wheels-<ver>.tar.gz` and `requirements.txt` (pinned + hashed).
-Prints the md5sum and the resolved epoch.
+Prints the md5sum and the resolved epoch. The `requirements.txt` is an audit
+record of the resolved versions, not the install input: the SlackBuild installs
+straight from the wheel files (`--find-links`), it does not re-resolve the
+lockfile.
 
 ## Requirements
 
diff --git a/mkwheels b/mkwheels
index bc14696..0de2350 100755
--- a/mkwheels
+++ b/mkwheels
@@ -14,6 +14,7 @@
 # You should have received a copy of the GNU General Public License along with
 # this program; if not, see <https://www.gnu.org/licenses/>.
 set -eu
+set -o pipefail   # so a tar/find failure can't be masked by gzip succeeding
 
 usage() {
     cat <<EOF