bug#47474: fossil: hash mismatch

[Jack Hill <jackhill@jackhill.us>]

[-- Attachment #1: Type: text/plain, Size: 3647 bytes --]

On Tue, 5 Jul 2022, Ludovic Courtès wrote:

> Hi!
>
> Jack Hill <jackhill@jackhill.us> skribis:
>
>> I'm also curious to know to fill in the archive for old versions. I
>> guess the first step would be to preserve the tarballs with the
>> original hashes. Does anyone have them? I notice that this happened
>> again with 2.17:
>>
>> downloading from https://www.fossil-scm.org/home/tarball/f48180f2ff3169651a725396d4f7d667c99a92873b9c3df7eee2f144be7a0721/fossil-src-2.17.tar.gz ...
>>  fossil-src-2.17.tar.gz  6.0MiB                                                           4.0MiB/s 00:02 [##################] 100.0%
>> sha256 hash mismatch for /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz:
>>   expected hash: 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
>>   actual hash:   18q5rc1d9d2zvrvsas5h419dv525ig9lyqswrx7bcl38zbjxics4
>
> I got a substitute for the tarball:
>
> --8<---------------cut here---------------start------------->8---
> $ guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv"
> 6.3 MB will be downloaded:
>  /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz
> substituting /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz...
> downloading from https://ci.guix.gnu.org/nar/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz ...
> fossil-src-2.17.tar.gz  6.0MiB                                                                     16.3MiB/s 00:00 [##################] 100.0%
>
> /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz
> $ guix hash $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")
> 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
> --8<---------------cut here---------------end--------------->8---
>
> Alternatively, we can get it via the content-addressed endpoint:
>
> --8<---------------cut here---------------start------------->8---
> $ wget -qO- https://ci.guix.gnu.org/file/fossil-src-2.17.tar.gz/sha256/1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw |guix hash -
> 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
> --8<---------------cut here---------------end--------------->8---
>
> Last, Disarchive tarball metadata is available:
>
> --8<---------------cut here---------------start------------->8---
> $ wget -qO- https://disarchive.guix.gnu.org/sha256/$(guix hash -f hex $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")) |head
> (disarchive
>  (version 0)
>  (gzip-member
>    (name "fossil-src-2.17.tar.gz")
>    (digest
>      (sha256
>        "5c7f1c73f7b5e2af24e10e40f0e07391909c1230b9e284a9d548059e7f377dbf"))
>    (header
>      (mtime 1633790590)
>      (extra-flags 2)
> $ wget -qO- https://disarchive.guix.gnu.org/sha256/$(guix hash -f hex $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")) |grep swhid
>                        (swhid "swh:1:dir:1d10cd5c9e0afaf7c95fa87cd50d4b6b13e6c6c9"))
> --8<---------------cut here---------------end--------------->8---
>
> … and tarball content is in Software Heritage:
>
>  https://archive.softwareheritage.org/browse/directory/1d10cd5c9e0afaf7c95fa87cd50d4b6b13e6c6c9/
>
> So we’re doing OK: it’s definitely archived and won’t ever vanish!  :-)
>
> Ludo’.

That's great!

I guess I ran into this because I was using `guix build` with 
`--no-substitutes`. Is it expected that we don't fallback to disarchive 
and Software Heritage in that case? If so, I guess my problem was an 
operator error. Can we close this ticket then, or are we still missing the 
tarballs for the older releases?

Best,
Jack