Wrong hashes for libgit2 archives

Wrong hashes for libgit2 archives

[Hartmut Goebel]

[-- Attachment #1: Type: text/plain, Size: 1064 bytes --]

Hi,

I'm currently stuck with building kde-frameworks due to mismatching
hashes for libgit2:

@ build-failed
/gnu/store/mgh4yjxkxfyqmc7c61vwq4vs8v837602-libgit2-0.26.0.tar.gz.drv -
1 sha256 hash mismatch for output path
`/gnu/store/53lj4z9cavl7n27r89zjnvyd8fk854kj-libgit2-0.26.0.tar.gz'
  expected: 1fdk9yhwvl1w1z71ykzcvgh4nsf8scxcbclz5anh98zpplmhmisa
  actual:   1b3figbhp5l83vd37vq6j2narrq4yl9pfw6mw0px0dzb1hz3jqka

I tried downgrading to v0.25.1 (by reverting 58dce7bf), but that failed
with the same error:

@ build-failed
/gnu/store/h8vrairp09vg239d9vpli12661vrv9d3-libgit2-0.25.1.tar.gz.drv -
1 sha256 hash mismatch for output path
`/gnu/store/c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar.gz'
  expected: 1cdwcw38frc1wf28x5ppddazv9hywc718j92f3xa3ybzzycyds3s
  actual:   0ywcxw1mwd56c8qc14hbx31bf198gxck3nja3laxyglv7l57qp26

Any ideas?

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          | h.goebel@crazy-compilers.com               |
| www.crazy-compilers.com | compilers which you thought are impossible |


[-- Attachment #2: 0xBF773B65.asc --]
[-- Type: application/pgp-keys, Size: 14855 bytes --]

Re: Wrong hashes for libgit2 archives

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 1228 bytes --]

On Sun, Oct 08, 2017 at 06:46:04PM +0200, Hartmut Goebel wrote:
> Hi,
> 
> I'm currently stuck with building kde-frameworks due to mismatching
> hashes for libgit2:
> 
> @ build-failed
> /gnu/store/mgh4yjxkxfyqmc7c61vwq4vs8v837602-libgit2-0.26.0.tar.gz.drv -
> 1 sha256 hash mismatch for output path
> `/gnu/store/53lj4z9cavl7n27r89zjnvyd8fk854kj-libgit2-0.26.0.tar.gz'
>   expected: 1fdk9yhwvl1w1z71ykzcvgh4nsf8scxcbclz5anh98zpplmhmisa
>   actual:   1b3figbhp5l83vd37vq6j2narrq4yl9pfw6mw0px0dzb1hz3jqka
> 
> I tried downgrading to v0.25.1 (by reverting 58dce7bf), but that failed
> with the same error:
> 
> @ build-failed
> /gnu/store/h8vrairp09vg239d9vpli12661vrv9d3-libgit2-0.25.1.tar.gz.drv -
> 1 sha256 hash mismatch for output path
> `/gnu/store/c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar.gz'
>   expected: 1cdwcw38frc1wf28x5ppddazv9hywc718j92f3xa3ybzzycyds3s
>   actual:   0ywcxw1mwd56c8qc14hbx31bf198gxck3nja3laxyglv7l57qp26

The auto-generated GitHub snapshots, which is what we use for libgit2,
are not created deterministically:

https://bugs.gnu.org/28659
https://github.com/libgit2/libgit2/issues/4343

For now, the workaround is to get the tarball from a substitute server.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Wrong hashes for libgit2 archives

[Hartmut Goebel]

Am 08.10.2017 um 19:40 schrieb Leo Famulari:
> The auto-generated GitHub snapshots, which is what we use for libgit2,
> are not created deterministically:

I was afraid of this :-(

But this is a good argument why projects should *release* archives.

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          | h.goebel@crazy-compilers.com               |
| www.crazy-compilers.com | compilers which you thought are impossible |