bug#37437: hash mismatch for emacs-elixir-mode

[Tobias Geerinckx-Rice via Bug reports for GNU Guix <bug-guix@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 3870 bytes --]

Josh,

Thanks for the report!

Josh Holland 写道：
> \sha256 hash mismatch for 
> /gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar:
>   expected hash: 
>   091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v
>   actual hash: 
>   13d5r64rqskdapnrbbxv0h91gn77c6af5kjjrg5mpphvl887s04c

It's already changed again:

downloading from 
https://stable.melpa.org/packages/elixir-mode-2.3.1.tar...
 elixir-mode-2.3.1.tar  60KiB 
 359KiB/s 00:00 [##################] 100.0%
sha256 hash mismatch for 
/gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar:
  expected hash: 
  091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v
  actual hash: 
  1c4xp9dqnbndrn82qhvv2ix9fvh7abcbmbajiknjfrz2mf9pwxid

I can check my substitute server tomorrow for the ‘original’ 
(091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v) tarball if 
nobody else has a copy.  Guix servers don't seem to.

> Is something nefarious going on, or have upstream just changed 
> their
> tarballs?

If someone is trying something sneaky, they're making an 
incompetent amount of noise about it.

Looks like upstream's just gone a bit timestamp-crazy, judging 
from the small handful of (very recently) mirrored tarballs I 
could find:

/gnu/store/26akldw7c2y6fparfixycdb0lhds8ddj-elixir-mode-2.3.1.tar
  hash: 0jaxy4r7qyl63n9plinz8wc42ywr6sqy4d0p8ma7a1v0svi5cyfx
  https://elpa.emacs-china.org/melpa-stable/elixir-mode-2.3.1.tar
  https://mirrors.nju.edu.cn/elpa/melpa-stable/elixir-mode-2.3.1.tar
/gnu/store/6dh3amvmd4b6rxx995w4zmc582flbfhj-elixir-mode-2.3.1.tar
  hash: 05wdspd43b413x4x2wx1wa8xbasp9rprq3wy5hrai1w72bnpfamc
  http://mirrors.zju.edu.cn/elpa/melpa-stable/elixir-mode-2.3.1.tar
/gnu/store/443bcaq7g5787l0qx76myx7pv2mm8apc-elixir-mode-2.3.1.tar
  hash: 1c4xp9dqnbndrn82qhvv2ix9fvh7abcbmbajiknjfrz2mf9pwxid
  https://stable.melpa.org/packages/elixir-mode-2.3.1.tar
  [the current canonical upstream tarball, I guess, mentioned 
  above]

which differ[0] only in metadata:

$ diffoscope all_the_things
--- 
    /gnu/store/26akldw7c2y6fparfixycdb0lhds8ddj-elixir-mode-2.3.1.tar
### 
    /gnu/store/6dh3amvmd4b6rxx995w4zmc582flbfhj-elixir-mode-2.3.1.tar
+++ 
/gnu/store/443bcaq7g5787l0qx76myx7pv2mm8apc-elixir-mode-2.3.1.tar
├── file list
│ @@ -1,4 +1,4 @@
│ -drwxr-xr-x   0 root         (0) root         (0)        0 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/
│ --rw-r--r--   0 root         (0) root         (0)    20892 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-mode.el
│ --rw-r--r--   0 root         (0) root         (0)    30321 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-smie.el
│ --rw-r--r--   0 root         (0) root         (0)      257 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-mode-pkg.el
│ #drwxr-xr-x   0 root         (0) root         (0)        0 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/
│ #-rw-r--r--   0 root         (0) root         (0)    20892 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-mode.el
│ #-rw-r--r--   0 root         (0) root         (0)    30321 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-smie.el
│ #-rw-r--r--   0 root         (0) root         (0)      257 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-mode-pkg.el
│ +drwxr-xr-x   0 root         (0) root         (0)        0 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/
│ +-rw-r--r--   0 root         (0) root         (0)    20892 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-mode.el
│ +-rw-r--r--   0 root         (0) root         (0)    30321 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-smie.el
│ +-rw-r--r--   0 root         (0) root         (0)      257 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-mode-pkg.el
[no other differences]

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]