Re: hash mismatch on permanently moved URL

[zimoun <zimon.toutoune@gmail.com>]

On Thu, 2 Jul 2020 at 15:38, Giovanni Biscuolo <g@xelera.eu> wrote:

> Actually this is a in-place *displacement* (with HTML) :-O

I do not know what is an "inplace displacement (with HTML)".

> Anyway: I guess there will be potentially other issues like this one in
> the future (permanent redirections to web pages instead of sources) and
> unfortunately (AFAIU) Guix will not be able to use alternative sources
> like Software Heritage: WDYT about considering 301 and 302 HTTP codes as
> "soft failures" and making Guix considering the alternative sources?

Redirection should not be an issue.  The important point is the
integrity of the data (the sha256 field).
And here, there is a mismatch:

expected hash: 0v0xsf14xwlj125y9fd8lrhsaych4d8liv8gr746zng6g225szb2
actual hash:   1qfbm2kh7hzd8752rky9dzis8qhgkhs6dkq71k8zar8y74nz7265
                     08m27r3wrlaxrzzgjqnqsbcz8hmll9sbd1z1wk3js9wr09q3l1q5

Well, even I am not sure if the tarball is stable and if the checksum
does not vary.  Anyway!

> Problems like this one are very bad for our time machine, I'm just
> thinking if Guix can do something to prevent them.

I agree.  But Guix cannot fix the world. :-)
What is currently done seems The Right Thing:

 1. fetch from the Guix farm
 2. try with the current upstream
2b. try a mirror if any
 3. fallback to SWH

You hit the problem because you turn off the fallback to the Guix farm,

BTW, the fallback to SWH is not ready yet for 2 main reasons:

 a) SWH has not yet ingested all the source tarballs in existence of
Guix; and it is not ready.  What is ready is to ingest the current
source tarballs but nothing has been done to feed with all the past
source tarballs.
 b) It is not clear how to fetch back the raw tarball from SWH since
they do not store the checksum but their own hash id (SWHID).  Some
discussion about correspondence and so on is happening right now. :-)

> and guix pull is going on now, building half of the world! :-)

Nice if it works for you! :-)

Cheers,
simon