[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: mismatch of source tar ball hash
|
From: |
Leo Famulari |
|
Subject: |
Re: mismatch of source tar ball hash |
|
Date: |
Mon, 29 Oct 2018 21:00:14 -0400 |
|
User-agent: |
Mutt/1.10.1 (2018-07-13) |
On Sun, Oct 28, 2018 at 12:23:33PM +0100, Marco van Hulten wrote:
> substitution of /gnu/store/a77ap0vw0fnsz138paby8w55rlcd58zi-calcurse-4.3.0
> failed
> building
> /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv...
> downloading from http://calcurse.org/files/calcurse-4.3.0.tar.gz...
> sha256 hash mismatch for
> /gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz:
> expected hash: 16jzg0nasnxdlz23i121x41pq5kbxmjzk52c5d863rg117fc7v1i
> actual hash: 11q0r4dbi8vca22x3q1ad07nr1gs4y17cgnplbjzmmz9r9x0h8m2
> build of
> /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv failed
> View build log at
> '/var/log/guix/drvs/ya/1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv.bz2'.
> \guix package: error: build failed: build of
> `/gnu/store/r44sbjgn7gxwl3nxvlnq6946zc05xq0f-profile.drv' failed
Fixed by commit a2717e698619fed3204db978f954a1195e1d2b4b, which makes
Guix download the source code over HTTPS, since <calcurse.org> is no
longer available over HTTP.
Here is how I debugged it:
First, I tried downloading the source code, avoiding substitutes because
I still have the source code on my mirror:
------
$ guix build --source calcurse --no-substitutes
The following derivation will be built:
/gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv
building
/gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv...
Starting download of
/gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz
From http://calcurse.org/files/calcurse-4.3.0.tar.gz...
following redirection to `https://calcurse.org'...
downloading from http://calcurse.org/files/calcurse-4.3.0.tar.gz...
calcurse-4.3.0.tar.gz 6KiB
7.9MiB/s
00:00 [##################] 100.0%
sha256 hash mismatch for
/gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz:
expected hash: 16jzg0nasnxdlz23i121x41pq5kbxmjzk52c5d863rg117fc7v1i
actual hash: 11q0r4dbi8vca22x3q1ad07nr1gs4y17cgnplbjzmmz9r9x0h8m2
hash mismatch for store item
'/gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz'
build of /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv
failed
View build log at
'/var/log/guix/drvs/ya/1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv.bz2'.
guix build: error: build failed: build of
`/gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv' failed
------
Then, I downloaded the file in question and examined it:
------
$ guix download http://calcurse.org/files/calcurse-4.3.0.tar.gz
Starting download of /tmp/guix-file.nEHs4A
From http://calcurse.org/files/calcurse-4.3.0.tar.gz...
following redirection to `https://calcurse.org'...
….3.0.tar.gz 6KiB
11.2MiB/s
00:00 [##################] 100.0%
/gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz
11q0r4dbi8vca22x3q1ad07nr1gs4y17cgnplbjzmmz9r9x0h8m2
$ file /gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz
/gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz: HTML
document, ASCII text
$ head --lines 10
/gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz
<!DOCTYPE html>
<html lang="en">
<head>
<title>calcurse.org</title>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
<meta http-equiv="Content-Style-Type" content="text/css" />
<script type="text/javascript" src="/js/jquery-1.7.2.min.js"></script>
<script type="text/javascript" src="/js/lightbox.js"></script>
------
So, we see that we are actually getting an HTML file (their homepage),
rather than a tarball. Looking back to the original error message, we
can see some suspicious redirections, from HTTP to HTTPS and then back
to HTTP.
This was my first clue that we were not going to download what we
expected, because its rare to configure a webserver to downgrade from
HTTPS to HTTP in 2018.
From there, I made an educated guess that <calcurse.org> had enabled
HSTS, and that we simply needed to adjust our download URL.
[0]
https://www.gnu.org/software/guix/manual/en/html_node/Building-from-Git.html
signature.asc
Description: PGP signature