On Sun, Oct 08, 2017 at 06:46:04PM +0200, Hartmut Goebel wrote:
> Hi,
> 
> I'm currently stuck with building kde-frameworks due to mismatching
> hashes for libgit2:
> 
> @ build-failed
> /gnu/store/mgh4yjxkxfyqmc7c61vwq4vs8v837602-libgit2-0.26.0.tar.gz.drv -
> 1 sha256 hash mismatch for output path
> `/gnu/store/53lj4z9cavl7n27r89zjnvyd8fk854kj-libgit2-0.26.0.tar.gz'
>   expected: 1fdk9yhwvl1w1z71ykzcvgh4nsf8scxcbclz5anh98zpplmhmisa
>   actual:   1b3figbhp5l83vd37vq6j2narrq4yl9pfw6mw0px0dzb1hz3jqka
> 
> I tried downgrading to v0.25.1 (by reverting 58dce7bf), but that failed
> with the same error:
> 
> @ build-failed
> /gnu/store/h8vrairp09vg239d9vpli12661vrv9d3-libgit2-0.25.1.tar.gz.drv -
> 1 sha256 hash mismatch for output path
> `/gnu/store/c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar.gz'
>   expected: 1cdwcw38frc1wf28x5ppddazv9hywc718j92f3xa3ybzzycyds3s
>   actual:   0ywcxw1mwd56c8qc14hbx31bf198gxck3nja3laxyglv7l57qp26

The auto-generated GitHub snapshots, which is what we use for libgit2,
are not created deterministically:

https://bugs.gnu.org/28659
https://github.com/libgit2/libgit2/issues/4343

For now, the workaround is to get the tarball from a substitute server.