bug#37437: hash mismatch for emacs-elixir-mode

bug#37437: hash mismatch for emacs-elixir-mode

[Josh Holland]

Hi, I just did the following:

$ guix install emacs-elixir-mode
substitute: updating substitutes from 'https://ci.guix.gnu.org'... 100.0%
substitute: updating substitutes from 'https://ci.guix.gnu.org'... 100.0%
downloading from https://ci.guix.gnu.org/nar/gzip/7n24v62aw8sjlrs06gbz4zvj11zvryry-emacs-epl-0.8...
 emacs-epl-0.8  24KiB                                2.6MiB/s 00:00 [##################] 100.0%

downloading from https://ci.guix.gnu.org/nar/gzip/152p023jxd5cf5lr87wighihp92pkal6-emacs-pkg-info-0.6...
 emacs-pkg-info-0.6  17KiB                           3.1MiB/s 00:00 [##################] 100.0%

building /gnu/store/b91172xfzkscfd9627d0ysrdjgpbxs6z-elixir-mode-2.3.1.tar.drv...
downloading from https://stable.melpa.org/packages/elixir-mode-2.3.1.tar...
\sha256 hash mismatch for /gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar:
  expected hash: 091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v
  actual hash:   13d5r64rqskdapnrbbxv0h91gn77c6af5kjjrg5mpphvl887s04c
hash mismatch for store item '/gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar'
build of /gnu/store/b91172xfzkscfd9627d0ysrdjgpbxs6z-elixir-mode-2.3.1.tar.drv failed
View build log at '/var/log/guix/drvs/b9/1172xfzkscfd9627d0ysrdjgpbxs6z-elixir-mode-2.3.1.tar.drv.bz2'.
cannot build derivation `/gnu/store/xqdxvb7xy4ydpwkqgp3jd985qb4vw8k2-emacs-elixir-mode-2.3.1.drv': 1 dependencies couldn't be built
guix install: error: build of `/gnu/store/xqdxvb7xy4ydpwkqgp3jd985qb4vw8k2-emacs-elixir-mode-2.3.1.drv' failed

Is something nefarious going on, or have upstream just changed their
tarballs?

Thanks,

--
Josh Holland

bug#37437: hash mismatch for emacs-elixir-mode

[Tobias Geerinckx-Rice via Bug reports for GNU Guix]

[-- Attachment #1: Type: text/plain, Size: 3870 bytes --]

Josh,

Thanks for the report!

Josh Holland 写道：
> \sha256 hash mismatch for 
> /gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar:
>   expected hash: 
>   091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v
>   actual hash: 
>   13d5r64rqskdapnrbbxv0h91gn77c6af5kjjrg5mpphvl887s04c

It's already changed again:

downloading from 
https://stable.melpa.org/packages/elixir-mode-2.3.1.tar...
 elixir-mode-2.3.1.tar  60KiB 
 359KiB/s 00:00 [##################] 100.0%
sha256 hash mismatch for 
/gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar:
  expected hash: 
  091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v
  actual hash: 
  1c4xp9dqnbndrn82qhvv2ix9fvh7abcbmbajiknjfrz2mf9pwxid

I can check my substitute server tomorrow for the ‘original’ 
(091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v) tarball if 
nobody else has a copy.  Guix servers don't seem to.

> Is something nefarious going on, or have upstream just changed 
> their
> tarballs?

If someone is trying something sneaky, they're making an 
incompetent amount of noise about it.

Looks like upstream's just gone a bit timestamp-crazy, judging 
from the small handful of (very recently) mirrored tarballs I 
could find:

/gnu/store/26akldw7c2y6fparfixycdb0lhds8ddj-elixir-mode-2.3.1.tar
  hash: 0jaxy4r7qyl63n9plinz8wc42ywr6sqy4d0p8ma7a1v0svi5cyfx
  https://elpa.emacs-china.org/melpa-stable/elixir-mode-2.3.1.tar
  https://mirrors.nju.edu.cn/elpa/melpa-stable/elixir-mode-2.3.1.tar
/gnu/store/6dh3amvmd4b6rxx995w4zmc582flbfhj-elixir-mode-2.3.1.tar
  hash: 05wdspd43b413x4x2wx1wa8xbasp9rprq3wy5hrai1w72bnpfamc
  http://mirrors.zju.edu.cn/elpa/melpa-stable/elixir-mode-2.3.1.tar
/gnu/store/443bcaq7g5787l0qx76myx7pv2mm8apc-elixir-mode-2.3.1.tar
  hash: 1c4xp9dqnbndrn82qhvv2ix9fvh7abcbmbajiknjfrz2mf9pwxid
  https://stable.melpa.org/packages/elixir-mode-2.3.1.tar
  [the current canonical upstream tarball, I guess, mentioned 
  above]

which differ[0] only in metadata:

$ diffoscope all_the_things
--- 
    /gnu/store/26akldw7c2y6fparfixycdb0lhds8ddj-elixir-mode-2.3.1.tar
### 
    /gnu/store/6dh3amvmd4b6rxx995w4zmc582flbfhj-elixir-mode-2.3.1.tar
+++ 
/gnu/store/443bcaq7g5787l0qx76myx7pv2mm8apc-elixir-mode-2.3.1.tar
├── file list
│ @@ -1,4 +1,4 @@
│ -drwxr-xr-x   0 root         (0) root         (0)        0 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/
│ --rw-r--r--   0 root         (0) root         (0)    20892 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-mode.el
│ --rw-r--r--   0 root         (0) root         (0)    30321 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-smie.el
│ --rw-r--r--   0 root         (0) root         (0)      257 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-mode-pkg.el
│ #drwxr-xr-x   0 root         (0) root         (0)        0 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/
│ #-rw-r--r--   0 root         (0) root         (0)    20892 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-mode.el
│ #-rw-r--r--   0 root         (0) root         (0)    30321 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-smie.el
│ #-rw-r--r--   0 root         (0) root         (0)      257 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-mode-pkg.el
│ +drwxr-xr-x   0 root         (0) root         (0)        0 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/
│ +-rw-r--r--   0 root         (0) root         (0)    20892 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-mode.el
│ +-rw-r--r--   0 root         (0) root         (0)    30321 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-smie.el
│ +-rw-r--r--   0 root         (0) root         (0)      257 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-mode-pkg.el
[no other differences]

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

bug#37437: hash mismatch for emacs-elixir-mode

[Björn Höfling]

[-- Attachment #1: Type: text/plain, Size: 1184 bytes --]

Hi Josh and Tobias,

thanks for reporting and checking. I'm very surprised someone is
already using this :-) I only added this package three days ago, that's
probably the reason why the source code is not available via hash on
ci.guix.gnu.org or any other CAN. There it failed to build due to a
dependency, though it doesn't tell which dependency if failing:

https://ci.guix.gnu.org/build/1713420/details

Is that maybe the source dependency? I thought that Ricardo added a
feature to Cuirass to see the failing dependency?

Anyway, I checked the downloaded source code from the "original"
091cizx hash and it is exactly the same as what I found in Github
(under the version tag). I changed the package definition, the sources
are now taken from the git repository. After compilation, the result is
exactly the same.

Commited as 3a8d68badaca85122d91d8b7045daee87acb0aea

This was my first Emacs package and I used the importer, which went
through very smooth. Have I done anything wrong? I noticed that only 7
packages in emacs-xyz.scm are from stable.melpa.org, where 2 of them
have a 404. Is this repository not as stable as the name suggests? 

Björn

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

bug#37437: hash mismatch for emacs-elixir-mode

[Tobias Geerinckx-Rice via Bug reports for GNU Guix]

[-- Attachment #1: Type: text/plain, Size: 558 bytes --]

Tobias Geerinckx-Rice 写道：
> I can check my substitute server tomorrow for the ‘original’
> (091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v) tarball 
> if
> nobody else has a copy.  Guix servers don't seem to.

I didn't have the chance while in LAN range, and the point's now 
moot anyway.  Thanks, Björn!

Björn Höfling 写道：
> Is [MELPA] not as stable as the name suggests.

Indeed[0], quite unfortunate.

Kind regards,

T G-R

[0]: 
https://guix-devel.gnu.narkive.com/6iiqs1hT/patch-emacs-danneskjold-theme#post3

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

bug#37437: hash mismatch for emacs-elixir-mode

[Efraim Flashner]

[-- Attachment #1: Type: text/plain, Size: 930 bytes --]

On Tue, Sep 17, 2019 at 10:49:36PM +0200, Björn Höfling wrote:
> Hi Josh and Tobias,
> 
> thanks for reporting and checking. I'm very surprised someone is
> already using this :-) I only added this package three days ago, that's
> probably the reason why the source code is not available via hash on
> ci.guix.gnu.org or any other CAN. There it failed to build due to a
> dependency, though it doesn't tell which dependency if failing:
> 
> https://ci.guix.gnu.org/build/1713420/details
> 

It's not clear, but one of the dependencies of the package is the
source. So if it already changed between pushing the commit and the
build farm building the package then it may have failed for that reason.


-- 
Efraim Flashner   <efraim@flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]