bug#47486: runc: hash mismatch

bug#47486: runc: hash mismatch

[zimoun]

Hi,

Using Guix 55685e4, I get:

$ guix build -S --no-substitutes runc
The following derivations will be built:
   /gnu/store/19iqvzkdx514xm8hs5sn2clcn5pvfswm-runc-1.0.0-rc6.tar.xz.drv
   /gnu/store/ml7q5rz9xziqg1c85j9b9059mifqc8gs-runc-1.0.0-rc6.tar.xz.drv
building /gnu/store/ml7q5rz9xziqg1c85j9b9059mifqc8gs-runc-1.0.0-rc6.tar.xz.drv...

Starting download of
/gnu/store/i2aqpvr4ga4j6cw718jmnmrm209f37ls-runc-1.0.0-rc6.tar.xz
From https://github.com/opencontainers/runc/releases/download/v1.0.0-rc6/runc.tar.xz...
following redirection to
`https://github-releases.githubusercontent.com/36960321/fe863f80-d2a1-11ea-908b-c3f145ce2ec0?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210329%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210329T204903Z&X-Amz-Expires=300&X-Amz-Signature=da77301e6f45dbdb8f5e540abb05fff40c15fd6a5688ae365694b5584183956c&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=36960321&response-content-disposition=attachment%3B%20filename%3Drunc.tar.xz&response-content-type=application%2Foctet-stream'...
downloading from
https://github.com/opencontainers/runc/releases/download/v1.0.0-rc6/runc.tar.xz
...
 runc.tar.xz  528KiB                 33.4MiB/s 00:00 [##################] 100.0%
sha256 hash mismatch for
/gnu/store/i2aqpvr4ga4j6cw718jmnmrm209f37ls-runc-1.0.0-rc6.tar.xz:
  expected hash: 1c7832dq70slkjh8qp2civ1wxhhdd2hrx84pq7db1mmqc9fdr3cc
  actual hash:   05i1j4xqwnva30c24gcrdvdx6wcjqgpyz7cn3gi0bs6jlcfv43gs
hash mismatch for store item
'/gnu/store/i2aqpvr4ga4j6cw718jmnmrm209f37ls-runc-1.0.0-rc6.tar.xz'
build of /gnu/store/ml7q5rz9xziqg1c85j9b9059mifqc8gs-runc-1.0.0-rc6.tar.xz.drv
failed
View build log at
'/var/log/guix/drvs/ml/7q5rz9xziqg1c85j9b9059mifqc8gs-runc-1.0.0-rc6.tar.xz.drv.bz2'.
cannot build derivation
`/gnu/store/19iqvzkdx514xm8hs5sn2clcn5pvfswm-runc-1.0.0-rc6.tar.xz.drv':
1 dependencies couldn't be built
guix build: error: build of
`/gnu/store/19iqvzkdx514xm8hs5sn2clcn5pvfswm-runc-1.0.0-rc6.tar.xz.drv'
failed

bug#47486: runc: hash mismatch

[Maxim Cournoyer]

Hello Simon,

zimoun <zimon.toutoune@gmail.com> writes:

> Hi,
>
> Using Guix 55685e4, I get:
>
> $ guix build -S --no-substitutes runc
> The following derivations will be built:
>    /gnu/store/19iqvzkdx514xm8hs5sn2clcn5pvfswm-runc-1.0.0-rc6.tar.xz.drv
>    /gnu/store/ml7q5rz9xziqg1c85j9b9059mifqc8gs-runc-1.0.0-rc6.tar.xz.drv
> building /gnu/store/ml7q5rz9xziqg1c85j9b9059mifqc8gs-runc-1.0.0-rc6.tar.xz.drv...
>
> Starting download of
> /gnu/store/i2aqpvr4ga4j6cw718jmnmrm209f37ls-runc-1.0.0-rc6.tar.xz
>>From https://github.com/opencontainers/runc/releases/download/v1.0.0-rc6/runc.tar.xz...
> following redirection to
> `https://github-releases.githubusercontent.com/36960321/fe863f80-d2a1-11ea-908b-c3f145ce2ec0?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210329%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210329T204903Z&X-Amz-Expires=300&X-Amz-Signature=da77301e6f45dbdb8f5e540abb05fff40c15fd6a5688ae365694b5584183956c&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=36960321&response-content-disposition=attachment%3B%20filename%3Drunc.tar.xz&response-content-type=application%2Foctet-stream'...
> downloading from
> https://github.com/opencontainers/runc/releases/download/v1.0.0-rc6/runc.tar.xz
> ...
>  runc.tar.xz  528KiB                 33.4MiB/s 00:00 [##################] 100.0%
> sha256 hash mismatch for
> /gnu/store/i2aqpvr4ga4j6cw718jmnmrm209f37ls-runc-1.0.0-rc6.tar.xz:
>   expected hash: 1c7832dq70slkjh8qp2civ1wxhhdd2hrx84pq7db1mmqc9fdr3cc
>   actual hash:   05i1j4xqwnva30c24gcrdvdx6wcjqgpyz7cn3gi0bs6jlcfv43gs
> hash mismatch for store item
> '/gnu/store/i2aqpvr4ga4j6cw718jmnmrm209f37ls-runc-1.0.0-rc6.tar.xz'
> build of /gnu/store/ml7q5rz9xziqg1c85j9b9059mifqc8gs-runc-1.0.0-rc6.tar.xz.drv
> failed
> View build log at
> '/var/log/guix/drvs/ml/7q5rz9xziqg1c85j9b9059mifqc8gs-runc-1.0.0-rc6.tar.xz.drv.bz2'.
> cannot build derivation
> `/gnu/store/19iqvzkdx514xm8hs5sn2clcn5pvfswm-runc-1.0.0-rc6.tar.xz.drv':
> 1 dependencies couldn't be built
> guix build: error: build of
> `/gnu/store/19iqvzkdx514xm8hs5sn2clcn5pvfswm-runc-1.0.0-rc6.tar.xz.drv'
> failed

Indeed it has change!  I've reported it upstream here:
https://github.com/opencontainers/runc/issues/2895.  To learn about what
changed, I ran the following commands:

--8<---------------cut here---------------start------------->8---
$ wget https://ci.guix.gnu.org/file/runc-1.0.0-rc6.tar.xz/sha256/1c7832dq70slkjh8qp2civ1wxhhdd2hrx84pq7db1mmqc9fdr3cc -O old.tar.xz

$ wget https://github.com/opencontainers/runc/releases/download/v1.0.0-rc6/runc.tar.xz -O new.tar.xz

$ diffoscope old.tar.xz new.tar.xz
--8<---------------cut here---------------end--------------->8---

And found that a slash went missing (weird):

[...]
│ │┄ Files identical despite different names
│ │   --- runc-1.0.0-rc6/vendor/golang.org/x/sys/windows/service.go
│ ├── +++ runc-1.0.0-rc6vendor/golang.org/x/sys/windows/service.go
│ │┄ Files identical despite different names
│ │   --- runc-1.0.0-rc6/vendor/golang.org/x/sys/windows/syscall.go
│ ├── +++ runc-1.0.0-rc6vendor/golang.org/x/sys/windows/syscall.go
│ │┄ Files identical despite different names
│ │   --- runc-1.0.0-rc6/vendor/golang.org/x/sys/windows/syscall_windows.go
│ ├── +++ runc-1.0.0-rc6vendor/golang.org/x/sys/windows/syscall_windows.go
│ │┄ Files identical despite different names
│ │   --- runc-1.0.0-rc6/vendor/golang.org/x/sys/windows/types_windows.go
│ ├── +++ runc-1.0.0-rc6vendor/golang.org/x/sys/windows/types_windows.go
│ │┄ Files identical despite different names
│ │   --- runc-1.0.0-rc6/vendor/golang.org/x/sys/windows/zsyscall_windows.go
│ ├── +++ runc-1.0.0-rc6vendor/golang.org/x/sys/windows/zsyscall_windows.go
│ │┄ Files identical despite different names

Note that I recently updated the package to v1.0.0-rc93.

Thanks for the report!

Closing.

Maxim