From: Leo Famulari <leo@famulari.name>
To: Marco van Hulten <marco@hulten.org>
Cc: guix-devel@gnu.org
Subject: Re: mismatch of source tar ball hash
Date: Mon, 29 Oct 2018 21:00:14 -0400 [thread overview]
Message-ID: <20181030010014.GA17436@jasmine.lan> (raw)
In-Reply-To: <20181028122333.063da88d@jasniac.instanton>
[-- Attachment #1: Type: text/plain, Size: 4411 bytes --]
On Sun, Oct 28, 2018 at 12:23:33PM +0100, Marco van Hulten wrote:
> substitution of /gnu/store/a77ap0vw0fnsz138paby8w55rlcd58zi-calcurse-4.3.0 failed
> building /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv...
> downloading from http://calcurse.org/files/calcurse-4.3.0.tar.gz...
> sha256 hash mismatch for /gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz:
> expected hash: 16jzg0nasnxdlz23i121x41pq5kbxmjzk52c5d863rg117fc7v1i
> actual hash: 11q0r4dbi8vca22x3q1ad07nr1gs4y17cgnplbjzmmz9r9x0h8m2
> build of /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv failed
> View build log at '/var/log/guix/drvs/ya/1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv.bz2'.
> \guix package: error: build failed: build of `/gnu/store/r44sbjgn7gxwl3nxvlnq6946zc05xq0f-profile.drv' failed
Fixed by commit a2717e698619fed3204db978f954a1195e1d2b4b, which makes
Guix download the source code over HTTPS, since <calcurse.org> is no
longer available over HTTP.
Here is how I debugged it:
First, I tried downloading the source code, avoiding substitutes because
I still have the source code on my mirror:
------
$ guix build --source calcurse --no-substitutes
The following derivation will be built:
/gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv
building /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv...
Starting download of /gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz
From http://calcurse.org/files/calcurse-4.3.0.tar.gz...
following redirection to `https://calcurse.org'...
downloading from http://calcurse.org/files/calcurse-4.3.0.tar.gz...
calcurse-4.3.0.tar.gz 6KiB 7.9MiB/s 00:00 [##################] 100.0%
sha256 hash mismatch for /gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz:
expected hash: 16jzg0nasnxdlz23i121x41pq5kbxmjzk52c5d863rg117fc7v1i
actual hash: 11q0r4dbi8vca22x3q1ad07nr1gs4y17cgnplbjzmmz9r9x0h8m2
hash mismatch for store item '/gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz'
build of /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv failed
View build log at '/var/log/guix/drvs/ya/1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv.bz2'.
guix build: error: build failed: build of `/gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv' failed
------
Then, I downloaded the file in question and examined it:
------
$ guix download http://calcurse.org/files/calcurse-4.3.0.tar.gz
Starting download of /tmp/guix-file.nEHs4A
From http://calcurse.org/files/calcurse-4.3.0.tar.gz...
following redirection to `https://calcurse.org'...
….3.0.tar.gz 6KiB 11.2MiB/s 00:00 [##################] 100.0%
/gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz
11q0r4dbi8vca22x3q1ad07nr1gs4y17cgnplbjzmmz9r9x0h8m2
$ file /gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz
/gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz: HTML document, ASCII text
$ head --lines 10 /gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz
<!DOCTYPE html>
<html lang="en">
<head>
<title>calcurse.org</title>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
<meta http-equiv="Content-Style-Type" content="text/css" />
<script type="text/javascript" src="/js/jquery-1.7.2.min.js"></script>
<script type="text/javascript" src="/js/lightbox.js"></script>
------
So, we see that we are actually getting an HTML file (their homepage),
rather than a tarball. Looking back to the original error message, we
can see some suspicious redirections, from HTTP to HTTPS and then back
to HTTP.
This was my first clue that we were not going to download what we
expected, because its rare to configure a webserver to downgrade from
HTTPS to HTTP in 2018.
From there, I made an educated guess that <calcurse.org> had enabled
HSTS, and that we simply needed to adjust our download URL.
[0]
https://www.gnu.org/software/guix/manual/en/html_node/Building-from-Git.html
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
prev parent reply other threads:[~2018-10-30 1:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-28 11:23 mismatch of source tar ball hash Marco van Hulten
2018-10-28 11:30 ` Marco van Hulten
2018-10-28 15:11 ` Gábor Boskovits
2018-10-30 1:00 ` Leo Famulari [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181030010014.GA17436@jasmine.lan \
--to=leo@famulari.name \
--cc=guix-devel@gnu.org \
--cc=marco@hulten.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).