bug#27556: libpng has wrong hash. [Fwd: Re: why has the hash for libpng-apng 1.6.28 changed?]

[ng0 <ng0@infotropique.org>]

[-- Attachment #1: Type: text/plain, Size: 3828 bytes --]

Efraim Flashner transcribed 4.1K bytes:
> On Wed, Jul 26, 2017 at 06:56:51AM +0000, ng0 wrote:
> > Leo Famulari transcribed 2.3K bytes:
> > > On Sun, Jul 23, 2017 at 10:15:47AM +0000, ng0 wrote:
> > > > ----- Forwarded message -----
> > > > 
> > > > > Date: Sun, 23 Jul 2017 18:21:19 +0900 (JST)
> > > > > To: ng0
> > > > > Cc: daisuken@users.sourceforge.net
> > > > > Subject: Re: why has the hash for libpng-apng 1.6.28 changed?
> > > > > 
> > > > > Hi,
> > > > > 
> > > > > I calculated the hash for libpng-apng files on my local orignals.
> > > > > 
> > > > > md5sum
> > > > > 9f2b36bccf89c5f4097111f0f73c1798  libpng-1.6.28-apng.patch.README.txt
> > > > > fca7c6d87c8352e645facefc2e1dd153  libpng-1.6.28-apng.patch.gz
> > > > > 
> > > > > sha1sum
> > > > > cb620589ecf9c28a4ecc00e6225dd41ca660a959  libpng-1.6.28-apng.patch.README.txt
> > > > > 4fa952f5ad374fce8d478b7e54ee4298a0b8d159  libpng-1.6.28-apng.patch.gz
> > > > > 
> > > > > Local file time stamps are
> > > > > 2017-01-06 21:02:10.938833896 +0900  libpng-1.6.28-apng.patch.README.txt
> > > > > 2017-01-06 21:02:10.938833896 +0900  libpng-1.6.28-apng.patch.gz
> > > > > 
> > > > > That values equals on sourceforge.net.
> > > > > https://sourceforge.net/projects/libpng-apng/files/libpng16/1.6.28/
> > > > > 
> > > > > I don't really understand what happend, but it look just fine.
> > > > > 
> > > > > Cheers,
> > > > > ---
> > > > > daisuken@users.sourceforge.net
> > > 
> > > Okay, this doesn't help us, so we need to inspect the different tarballs
> > > ourselves. Do you have an old copy of the patch you can share?
> > 
> > Yes. I mean no. I am not sure. I have libpng-apng git checkout
> > and also the 1.6.25 extracted tarball directory (but not sure
> > when I got it), and the tarballs for 1.6.5 and 1.6.28.
> > 
> > But I think I found our problem:
> > 
> > user@shadownet ~/re-src$ guix hash tarballs/libpng-1.6.28-apng.patch.gz
> > 0m5nv70n9903x3xzxw9qqc6sgf2rp106ha0x6gix0xf8wcrljaab
> > user@shadownet ~/re-src$ guix hash tarballs/libpng-1.6.25-apng.patch.gz
> > 026r0gbkf6d6v54wca02cdxln8sj4m2c1yk62sj2aasv2ki2ffh5
> > 
> > (inputs
> >  `(("apng" ,(origin
> >     (method url-fetch)
> >      (uri
> >      (string-append "mirror://sourceforge/libpng-apng/libpng16/"
> >      version "/libpng-" version "-apng.patch.gz"))
> >      (sha256
> >      (base32
> >      "026r0gbkf6d6v54wca02cdxln8sj4m2c1yk62sj2aasv2ki2ffh5"))))))
> > 
> > My really strong guess is that we never updated the hash for
> > libpng-apng when the libpng was updated fron which libpng-apng
> > inherits its version.
> > 
> > I don't have the time to look at our git history right now,
> > but you could do that, look at wether libpng-apng was touched
> > since 1.6.25->1.6.28 update of libpng.
> > 
> 
> git blame shows that back in February I updated libpng to 1.6.28 from
> 1.6.25, but that the last time libpng-apng was touched was by ng0 back
> in January.
> 
> commit: 864738baaa7bb75c08647ccfc684736479e67f7f

Okay, so I will send the update for libpng-apng (which due to its
inheritance of libpng is just the hash) and I will also add a second
commit which adds a comment above libpng that we must update libpng-apng
when we update libpng, if that's already possible (libpng-apng might not
immediately be up to date, but we don't update libpng immediately aswell
due to it being a core-updates candidate).

> 
> -- 
> Efraim Flashner   <efraim@flashner.co.il>   אפרים פלשנר
> GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
> Confidentiality cannot be guaranteed on emails sent or received unencrypted



-- 
ng0
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://n0is.noblogs.org/my-keys
https://www.infotropique.org https://krosos.org

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]