hash of fish is wrong.

hash of fish is wrong.

[ng0]

Hi,

can someone else check which hash should be the correct one?

master tree of guix gives:

ng0@greendragon ~/src/guix-dev$ guix package -i fish

Starting download of /gnu/store/a44p5qn1idsy75qfgky7l3ksjjrxqmca-fish-2.5.0.tar.gz
From https://fishshell.com/files/2.5.0/fish-2.5.0.tar.gz...
 ....0.tar.gz  3.3MiB               1.2MiB/s 00:03 [####################] 100.0%
output path `/gnu/store/a44p5qn1idsy75qfgky7l3ksjjrxqmca-fish-2.5.0.tar.gz' should have sha256 hash `0kn2n9qr9cksg2cl78f3w0yd24368d35djhi6w5x3gbdxk23ywq3', instead has `19djav128nkhjxgfhwhc32i5y9d9c3karbh5yg67kqrdranyvh7q'
cannot build derivation `/gnu/store/01z7y3zp19g6jbniql2jm8kh11cjsl4c-fish-2.5.0.tar.xz.drv': 1 dependencies couldn't be built
cannot build derivation `/gnu/store/0j2l71rak7676qh7015mk80ib3j418p9-fish-2.5.0.drv': 1 dependencies couldn't be built
guix package: error: build failed: build of `/gnu/store/0j2l71rak7676qh7015mk80ib3j418p9-fish-2.5.0.drv' failed

A download from that url above gives me:

ng0@wasp ~/r/tarballs> torify wget https://fishshell.com/files/2.5.0/fish-2.5.0.tar.gz
--2017-02-14 17:16:04--  https://fishshell.com/files/2.5.0/fish-2.5.0.tar.gz
Resolving fishshell.com... 54.192.28.95
Connecting to fishshell.com|54.192.28.95|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3496831 (3.3M) [application/x-gzip]
Saving to: ‘fish-2.5.0.tar.gz’

fish-2.5.0.tar.gz   100%[===================>]   3.33M   246KB/s    in 14s     

2017-02-14 17:16:21 (251 KB/s) - ‘fish-2.5.0.tar.gz’ saved [3496831/3496831]

ng0@wasp ~/r/tarballs> guix hash fish-2.5.0.tar.gz 
19djav128nkhjxgfhwhc32i5y9d9c3karbh5yg67kqrdranyvh7q



I think 19djav128nkhjxgfhwhc32i5y9d9c3karbh5yg67kqrdranyvh7q is correct.


-- 
ng0 -- https://www.inventati.org/patternsinthechaos/

Re: hash of fish is wrong.

[Tobias Geerinckx-Rice]

[-- Attachment #1.1: Type: text/plain, Size: 1219 bytes --]

ng0 (again, and this time the list),

Thanks for catching and reporting this.

On 14/02/17 18:19, ng0 wrote:
> can someone else check which hash should be the correct one? I think
> 19djav128nkhjxgfhwhc32i5y9d9c3karbh5yg67kqrdranyvh7q is correct.

We're both right! Yay! It's a Valentine's day miracle:

  $ ~/guix/pre-inst-env guix hash /gnu/store/*-fish-2.5.0.tar.gz
  0kn2n9qr9cksg2cl78f3w0yd24368d35djhi6w5x3gbdxk23ywq3
  $ boring-old-wget https://fishshell.com/files/2.5.0/fish-2.5.0.tar.gz
  $ guix hash fish-2.5.0.tar.gz
  19djav128nkhjxgfhwhc32i5y9d9c3karbh5yg67kqrdranyvh7q

Hm. Did I mis-label an old fish-2.4.0 tarball by mistake when updating?
Nope:

  $ tar tf /gnu/store/*-fish-2.5.0.tar.gz | head -n1
  fish-shell-2.5.0/
  $ tar tf ~/fish-2.5.0.tar.gz | head -n1
  fish-2.5.0/

What the—

Once again, hashing all the things catches a sneaky upstream
dirty-handed. The original fish-2.5.0.tar.gz lacked a configure script
(see commit 89eb56f05fa1561b09d1050147d968b98a16b07a). Apparently, the
way to fix that is by silently replacing your tarball in-place.

Anyone want to scan a 20,357-line diff for a back door before I push an
update?

Kind regards,

T G-R




[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 476 bytes --]

Re: hash of fish is wrong.

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 211 bytes --]

On Tue, Feb 14, 2017 at 08:14:43PM +0100, Tobias Geerinckx-Rice wrote:
> Anyone want to scan a 20,357-line diff for a back door before I push an
> update?

We should file a bug report with the fish maintainers.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: hash of fish is wrong.

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 378 bytes --]

On Tue, Feb 14, 2017 at 02:27:00PM -0500, Leo Famulari wrote:
> On Tue, Feb 14, 2017 at 08:14:43PM +0100, Tobias Geerinckx-Rice wrote:
> > Anyone want to scan a 20,357-line diff for a back door before I push an
> > update?
> 
> We should file a bug report with the fish maintainers.

Somebody else already did it:

https://github.com/fish-shell/fish-shell/issues/3807

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]