From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tobias Geerinckx-Rice via Bug reports for GNU Guix Subject: bug#37437: hash mismatch for emacs-elixir-mode Date: Tue, 17 Sep 2019 13:59:34 +0200 Message-ID: <87imprb0bd.fsf@nckx> References: <874l1bky9f.fsf@inv.alid.pw> Reply-To: Tobias Geerinckx-Rice Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:59421) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iAC9L-0005WR-Um for bug-guix@gnu.org; Tue, 17 Sep 2019 08:00:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iAC9K-0002My-6G for bug-guix@gnu.org; Tue, 17 Sep 2019 08:00:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:42913) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1iAC9K-0002Mr-2F for bug-guix@gnu.org; Tue, 17 Sep 2019 08:00:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1iAC9J-00032M-UC for bug-guix@gnu.org; Tue, 17 Sep 2019 08:00:01 -0400 Sender: "Debbugs-submit" Resent-Message-ID: Received: from eggs.gnu.org ([2001:470:142:3::10]:59368) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iAC93-00059X-47 for bug-guix@gnu.org; Tue, 17 Sep 2019 07:59:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iAC90-0002BO-J8 for bug-guix@gnu.org; Tue, 17 Sep 2019 07:59:44 -0400 Received: from tobias.gr ([2001:470:7405::1]:59912) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1iAC90-000290-9K for bug-guix@gnu.org; Tue, 17 Sep 2019 07:59:42 -0400 In-reply-to: <874l1bky9f.fsf@inv.alid.pw> List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: 37437@debbugs.gnu.org --=-=-= Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Josh, Thanks for the report! Josh Holland =E5=86=99=E9=81=93=EF=BC=9A > \sha256 hash mismatch for=20 > /gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar: > expected hash:=20 > 091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v > actual hash:=20 > 13d5r64rqskdapnrbbxv0h91gn77c6af5kjjrg5mpphvl887s04c It's already changed again: downloading from=20 https://stable.melpa.org/packages/elixir-mode-2.3.1.tar... elixir-mode-2.3.1.tar 60KiB=20 359KiB/s 00:00 [##################] 100.0% sha256 hash mismatch for=20 /gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar: expected hash:=20 091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v actual hash:=20 1c4xp9dqnbndrn82qhvv2ix9fvh7abcbmbajiknjfrz2mf9pwxid I can check my substitute server tomorrow for the =E2=80=98original=E2=80= =99=20 (091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v) tarball if=20 nobody else has a copy. Guix servers don't seem to. > Is something nefarious going on, or have upstream just changed=20 > their > tarballs? If someone is trying something sneaky, they're making an=20 incompetent amount of noise about it. Looks like upstream's just gone a bit timestamp-crazy, judging=20 from the small handful of (very recently) mirrored tarballs I=20 could find: /gnu/store/26akldw7c2y6fparfixycdb0lhds8ddj-elixir-mode-2.3.1.tar hash: 0jaxy4r7qyl63n9plinz8wc42ywr6sqy4d0p8ma7a1v0svi5cyfx https://elpa.emacs-china.org/melpa-stable/elixir-mode-2.3.1.tar https://mirrors.nju.edu.cn/elpa/melpa-stable/elixir-mode-2.3.1.tar /gnu/store/6dh3amvmd4b6rxx995w4zmc582flbfhj-elixir-mode-2.3.1.tar hash: 05wdspd43b413x4x2wx1wa8xbasp9rprq3wy5hrai1w72bnpfamc http://mirrors.zju.edu.cn/elpa/melpa-stable/elixir-mode-2.3.1.tar /gnu/store/443bcaq7g5787l0qx76myx7pv2mm8apc-elixir-mode-2.3.1.tar hash: 1c4xp9dqnbndrn82qhvv2ix9fvh7abcbmbajiknjfrz2mf9pwxid https://stable.melpa.org/packages/elixir-mode-2.3.1.tar [the current canonical upstream tarball, I guess, mentioned=20 above] which differ[0] only in metadata: $ diffoscope all_the_things =2D--=20 /gnu/store/26akldw7c2y6fparfixycdb0lhds8ddj-elixir-mode-2.3.1.tar ###=20 /gnu/store/6dh3amvmd4b6rxx995w4zmc582flbfhj-elixir-mode-2.3.1.tar +++=20 /gnu/store/443bcaq7g5787l0qx76myx7pv2mm8apc-elixir-mode-2.3.1.tar =E2=94=9C=E2=94=80=E2=94=80 file list =E2=94=82 @@ -1,4 +1,4 @@ =E2=94=82 -drwxr-xr-x 0 root (0) root (0) 0=20 2019-09-17 06:17:34.000000 elixir-mode-2.3.1/ =E2=94=82 --rw-r--r-- 0 root (0) root (0) 20892=20 2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-mode.el =E2=94=82 --rw-r--r-- 0 root (0) root (0) 30321=20 2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-smie.el =E2=94=82 --rw-r--r-- 0 root (0) root (0) 257=20 2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-mode-pkg.el =E2=94=82 #drwxr-xr-x 0 root (0) root (0) 0=20 2019-09-17 03:49:10.000000 elixir-mode-2.3.1/ =E2=94=82 #-rw-r--r-- 0 root (0) root (0) 20892=20 2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-mode.el =E2=94=82 #-rw-r--r-- 0 root (0) root (0) 30321=20 2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-smie.el =E2=94=82 #-rw-r--r-- 0 root (0) root (0) 257=20 2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-mode-pkg.el =E2=94=82 +drwxr-xr-x 0 root (0) root (0) 0=20 2019-09-17 11:18:38.000000 elixir-mode-2.3.1/ =E2=94=82 +-rw-r--r-- 0 root (0) root (0) 20892=20 2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-mode.el =E2=94=82 +-rw-r--r-- 0 root (0) root (0) 30321=20 2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-smie.el =E2=94=82 +-rw-r--r-- 0 root (0) root (0) 257=20 2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-mode-pkg.el [no other differences] Kind regards, T G-R --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEfo+u0AlEeO9y5k0W2Imw8BjFSTwFAl2AyqYACgkQ2Imw8BjF STwUzQ/+Imj5trORWMiWR9flKPTPn/3GETMPlx79s+AwyEDuCpD/SPxiI1TzYDII gRmunSuYM2bUiHaekAXhGnXVh1tG3OGOrHoBdxlUy2n9vN1P6Bi9b3dEk2BHqmN/ eOtCim/5M2aAP5skTIUePqm0zNMk8Mv293cPtmfK7UAZLz2hYwxjw7Ggw7BswZSf oZL9rEedVnRbEQN7eL+yeSifvkce2i+3f6VL7Grz1+YQb6U5wcFgXLDizQ2KxA1a 6nzNfT4kujDWPD0MOSGICwtJUCu38trMlZMsK+7jCLYWP8ImK928cWT+PDrEiBwD BGlbks0xxuz3cqRfmm0o+v0Sc8B5e0JnvemA4HB5WoomqxChb9rFG6ehqQ/fr9KZ VaH7zuOaMQBSYepakCc8IPukeb/q1Yr5QcKdnI/MkaenbYl4GHTqCs7Lg4URuXIh 6pM/na2qUaXX9VRUISGuhNAgMroiyGqe/DUCYzLKxNI3Kyy0XZZH1f8GxDi8zDln ROZNt1vr6N7ymMvIle0ojypEFehLCxbWAbX3FyNrz/iWDd2jRpySDIjoFuOzXzH4 zRzBf8wWnpiSMbiC0hwamdwnQrXUV9yecEmvxamnhF+jdyGyADVY7i436c1gwTU2 fftcmimjM00cg4t2rlMyu/dGstr29xnPxDWLSi39mpL0Lw1f5dQ= =VPSG -----END PGP SIGNATURE----- --=-=-=--