fossil: hash mismatch

  • Done
  • quality assurance status badge
Details
4 participants
  • Jack Hill
  • Ludovic Courtès
  • phodina
  • zimoun
Owner
unassigned
Submitted by
zimoun
Severity
normal
Z
Z
zimoun wrote on 29 Mar 2021 17:33
(name . Bug Guix)(address . bug-guix@gnu.org)
CAJ3okZ1V02C1R-1EYDJPbmZ8s7B6vxw09OFqi4sN_nPqquwexQ@mail.gmail.com
Hi,

Using Guix 55685e4, I get:

Toggle snippet (33 lines)
$ guix build -S --no-substitutes fossil
The following derivations will be built:
/gnu/store/0cb20s9w8l8jg7i1dnw2xw0j197cbhxq-fossil-src-2.11.tar.xz.drv
/gnu/store/l6wr7qb60ahg4kslajr3rqk3limhvs0a-fossil-src-2.11.tar.gz.drv
building /gnu/store/l6wr7qb60ahg4kslajr3rqk3limhvs0a-fossil-src-2.11.tar.gz.drv...

Starting download of
/gnu/store/pb5jmi9zalg6xylzsjmrskwxs0kar97l-fossil-src-2.11.tar.gz
From https://www.fossil-scm.org/index.html/uv/fossil-src-2.11.tar.gz...
following redirection to
`https://fossil-scm.org/home/uv/fossil-src-2.11.tar.gz'...
downloading from
https://www.fossil-scm.org/index.html/uv/fossil-src-2.11.tar.gz ...

sha256 hash mismatch for
/gnu/store/pb5jmi9zalg6xylzsjmrskwxs0kar97l-fossil-src-2.11.tar.gz:
expected hash: 0c9nzx42wxfmym9vf1pnbdb1c7gp7a7zqky60izxsph7w2xh8nix
actual hash: 0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73
hash mismatch for store item
'/gnu/store/pb5jmi9zalg6xylzsjmrskwxs0kar97l-fossil-src-2.11.tar.gz'
build of /gnu/store/l6wr7qb60ahg4kslajr3rqk3limhvs0a-fossil-src-2.11.tar.gz.drv
failed
View build log at
'/var/log/guix/drvs/l6/wr7qb60ahg4kslajr3rqk3limhvs0a-fossil-src-2.11.tar.gz.drv.bz2'.
cannot build derivation
`/gnu/store/0cb20s9w8l8jg7i1dnw2xw0j197cbhxq-fossil-src-2.11.tar.xz.drv':
1 dependencies couldn't be built
guix build: error: build of
`/gnu/store/0cb20s9w8l8jg7i1dnw2xw0j197cbhxq-fossil-src-2.11.tar.xz.drv'
failed


It is probably an upstream in-place replacement.

All the best,
simon
Z
Z
zimoun wrote on 2 Jul 2021 18:48
control message for bug #47474
(address . control@debbugs.gnu.org)
87v95sll0n.fsf@gmail.com
tags 47474 + easy
quit
P
P
phodina wrote on 4 Nov 2021 22:46
RE: fossil: hash mismatch
(name . 47474-done@debbugs.gnu.org)(address . 47474-done@debbugs.gnu.org)
HPFdLulitKvRjr5QxVNlctbDuK6e2wRLsgVf7kViLQhNBZaQrLeEMxe6EOlI_Lj_CpYTL7cRfuuOC1lzw7qi5GCq2ZOPG0PPsqtWx7kMsEc=@protonmail.com
Hi,

the checksum was corrected by Tobias Geerinckx-Rice in commit 20771f4043990632b73187b10d1851a1244df4e6 as well as the pkg was updated from 2.10 -> 2.11.

Petr
Closed
Z
Z
zimoun wrote on 8 Nov 2021 12:06
Re: bug#47474: fossil: hash mismatch
86tugmsy7v.fsf@gmail.com
Hi,

On Thu, 04 Nov 2021 at 21:46, phodina via Bug reports for GNU Guix <bug-guix@gnu.org> wrote:

Toggle quote (4 lines)
> the checksum was corrected by Tobias Geerinckx-Rice in commit
> 20771f4043990632b73187b10d1851a1244df4e6 as well as the pkg was
> updated from 2.10 -> 2.11.

Indeed, when looking forward. :-)

However, in the context of Disarchive and long-term, it is seems
relevant to keep it still open; as example to test “guix time-machine”
and various fallbacks, IMHO.


Cheers,
simon
J
J
Jack Hill wrote on 5 Jul 2022 16:55
(name . zimoun)(address . zimon.toutoune@gmail.com)
alpine.DEB.2.21.2207051047260.32117@marsh.hcoop.net
On Mon, 8 Nov 2021, zimoun wrote:

Toggle quote (6 lines)
> Indeed, when looking forward. :-)
>
> However, in the context of Disarchive and long-term, it is seems
> relevant to keep it still open; as example to test “guix time-machine”
> and various fallbacks, IMHO.

I'm also curious to know to fill in the archive for old versions. I guess
the first step would be to preserve the tarballs with the original hashes.
Does anyone have them? I notice that this happened again with 2.17:

fossil-src-2.17.tar.gz 6.0MiB 4.0MiB/s 00:02 [##################] 100.0%
sha256 hash mismatch for /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz:
expected hash: 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
actual hash: 18q5rc1d9d2zvrvsas5h419dv525ig9lyqswrx7bcl38zbjxics4

Looking forward:

I have asked upstream how we might avoid this problem:

We'll see what they say.

Some other ideas in the meantime:

1) Develop a fossil-fetch that can be used like git-fetch to download from
the source code repository directly.

2) Use git-fetch with the git-mirror. This would allow us to make use of
our current git integration with Software Heritage.

Best,
Jack
L
L
Ludovic Courtès wrote on 5 Jul 2022 17:27
(name . Jack Hill)(address . jackhill@jackhill.us)
87edyz4m1f.fsf@gnu.org
Hi!

Jack Hill <jackhill@jackhill.us> skribis:

Toggle quote (11 lines)
> I'm also curious to know to fill in the archive for old versions. I
> guess the first step would be to preserve the tarballs with the
> original hashes. Does anyone have them? I notice that this happened
> again with 2.17:
>
> downloading from https://www.fossil-scm.org/home/tarball/f48180f2ff3169651a725396d4f7d667c99a92873b9c3df7eee2f144be7a0721/fossil-src-2.17.tar.gz ...
> fossil-src-2.17.tar.gz 6.0MiB 4.0MiB/s 00:02 [##################] 100.0%
> sha256 hash mismatch for /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz:
> expected hash: 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
> actual hash: 18q5rc1d9d2zvrvsas5h419dv525ig9lyqswrx7bcl38zbjxics4

I got a substitute for the tarball:

Toggle snippet (12 lines)
$ guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv"
6.3 MB will be downloaded:
/gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz
substituting /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz...
downloading from https://ci.guix.gnu.org/nar/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz ...
fossil-src-2.17.tar.gz 6.0MiB 16.3MiB/s 00:00 [##################] 100.0%

/gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz
$ guix hash $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")
1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw

Alternatively, we can get it via the content-addressed endpoint:

Toggle snippet (4 lines)
$ wget -qO- https://ci.guix.gnu.org/file/fossil-src-2.17.tar.gz/sha256/1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw |guix hash -
1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw

Last, Disarchive tarball metadata is available:

Toggle snippet (15 lines)
$ wget -qO- https://disarchive.guix.gnu.org/sha256/$(guix hash -f hex $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")) |head
(disarchive
(version 0)
(gzip-member
(name "fossil-src-2.17.tar.gz")
(digest
(sha256
"5c7f1c73f7b5e2af24e10e40f0e07391909c1230b9e284a9d548059e7f377dbf"))
(header
(mtime 1633790590)
(extra-flags 2)
$ wget -qO- https://disarchive.guix.gnu.org/sha256/$(guix hash -f hex $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")) |grep swhid
(swhid "swh:1:dir:1d10cd5c9e0afaf7c95fa87cd50d4b6b13e6c6c9"))

… and tarball content is in Software Heritage:


So we’re doing OK: it’s definitely archived and won’t ever vanish! :-)

Ludo’.
J
J
Jack Hill wrote on 5 Jul 2022 17:45
(name . Ludovic Courtès)(address . ludovic.courtes@inria.fr)
alpine.DEB.2.21.2207051139290.32117@marsh.hcoop.net
On Tue, 5 Jul 2022, Ludovic Courtès wrote:

Toggle quote (63 lines)
> Hi!
>
> Jack Hill <jackhill@jackhill.us> skribis:
>
>> I'm also curious to know to fill in the archive for old versions. I
>> guess the first step would be to preserve the tarballs with the
>> original hashes. Does anyone have them? I notice that this happened
>> again with 2.17:
>>
>> downloading from https://www.fossil-scm.org/home/tarball/f48180f2ff3169651a725396d4f7d667c99a92873b9c3df7eee2f144be7a0721/fossil-src-2.17.tar.gz ...
>> fossil-src-2.17.tar.gz 6.0MiB 4.0MiB/s 00:02 [##################] 100.0%
>> sha256 hash mismatch for /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz:
>> expected hash: 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
>> actual hash: 18q5rc1d9d2zvrvsas5h419dv525ig9lyqswrx7bcl38zbjxics4
>
> I got a substitute for the tarball:
>
> --8<---------------cut here---------------start------------->8---
> $ guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv"
> 6.3 MB will be downloaded:
> /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz
> substituting /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz...
> downloading from https://ci.guix.gnu.org/nar/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz ...
> fossil-src-2.17.tar.gz 6.0MiB 16.3MiB/s 00:00 [##################] 100.0%
>
> /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz
> $ guix hash $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")
> 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
> --8<---------------cut here---------------end--------------->8---
>
> Alternatively, we can get it via the content-addressed endpoint:
>
> --8<---------------cut here---------------start------------->8---
> $ wget -qO- https://ci.guix.gnu.org/file/fossil-src-2.17.tar.gz/sha256/1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw |guix hash -
> 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
> --8<---------------cut here---------------end--------------->8---
>
> Last, Disarchive tarball metadata is available:
>
> --8<---------------cut here---------------start------------->8---
> $ wget -qO- https://disarchive.guix.gnu.org/sha256/$(guix hash -f hex $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")) |head
> (disarchive
> (version 0)
> (gzip-member
> (name "fossil-src-2.17.tar.gz")
> (digest
> (sha256
> "5c7f1c73f7b5e2af24e10e40f0e07391909c1230b9e284a9d548059e7f377dbf"))
> (header
> (mtime 1633790590)
> (extra-flags 2)
> $ wget -qO- https://disarchive.guix.gnu.org/sha256/$(guix hash -f hex $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")) |grep swhid
> (swhid "swh:1:dir:1d10cd5c9e0afaf7c95fa87cd50d4b6b13e6c6c9"))
> --8<---------------cut here---------------end--------------->8---
>
> … and tarball content is in Software Heritage:
>
> https://archive.softwareheritage.org/browse/directory/1d10cd5c9e0afaf7c95fa87cd50d4b6b13e6c6c9/
>
> So we’re doing OK: it’s definitely archived and won’t ever vanish! :-)
>
> Ludo’.

That's great!

I guess I ran into this because I was using `guix build` with
`--no-substitutes`. Is it expected that we don't fallback to disarchive
and Software Heritage in that case? If so, I guess my problem was an
operator error. Can we close this ticket then, or are we still missing the
tarballs for the older releases?

Best,
Jack
L
L
Ludovic Courtès wrote on 5 Jul 2022 17:49
(name . Jack Hill)(address . jackhill@jackhill.us)
87a69n4l0r.fsf@inria.fr
Hi!

Jack Hill <jackhill@jackhill.us> skribis:

Toggle quote (4 lines)
> I guess I ran into this because I was using `guix build` with
> `--no-substitutes`. Is it expected that we don't fallback to
> disarchive and Software Heritage in that case?

Yes, and that’s actually suboptimal:


Toggle quote (4 lines)
> If so, I guess my problem was an operator error. Can we close this
> ticket then, or are we still missing the tarballs for the older
> releases?

We would need to check whether older releases are available. Disarchive
is relatively recent so they’re likely to be missing there, but Timothy
Sample has a Disarchive database that goes several years back, unlike
disarchive.guix.gnu.org. Worth checking!

Anyhow, I think this issue can be closed.

Ludo’.
Z
Z
zimoun wrote on 5 Jul 2022 18:50
(name . Ludovic Courtès)(address . ludovic.courtes@inria.fr)
86zghnqzac.fsf@gmail.com
Hi,

Thanks Jack for the follow up. :-)

On Tue, 05 Jul 2022 at 17:49, Ludovic Courtès <ludovic.courtes@inria.fr> wrote:

Toggle quote (5 lines)
> We would need to check whether older releases are available. Disarchive
> is relatively recent so they’re likely to be missing there, but Timothy
> Sample has a Disarchive database that goes several years back, unlike
> disarchive.guix.gnu.org. Worth checking!

I guess the Timothy’s database starts on 2019-05-05 which is v1.0. The
last coverage is from Jan 2022.



Toggle quote (2 lines)
> Anyhow, I think this issue can be closed.

Done.


Cheers,
simon
Closed
?
Your comment

This issue is archived.

To comment on this conversation send an email to 47474@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it
mumi current 47474
Then, you may apply the latest patchset in this issue (with sign off)
mumi am -- -s
Or, compose a reply to this issue
mumi compose
Or, send patches to this issue
mumi send-email *.patch