From unknown Tue Aug 19 10:08:31 2025 X-Loop: help-debbugs@gnu.org Subject: bug#28326: exiv2 0.26 hash mismatch Resent-From: Maxim Cournoyer Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Sat, 02 Sep 2017 05:52:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 28326 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: 28326@debbugs.gnu.org X-Debbugs-Original-To: bug-guix Received: via spool by submit@debbugs.gnu.org id=B.150433150430923 (code B ref -1); Sat, 02 Sep 2017 05:52:01 +0000 Received: (at submit) by debbugs.gnu.org; 2 Sep 2017 05:51:44 +0000 Received: from localhost ([127.0.0.1]:41171 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1do1LH-00082d-T7 for submit@debbugs.gnu.org; Sat, 02 Sep 2017 01:51:43 -0400 Received: from eggs.gnu.org ([208.118.235.92]:39962) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1do1LF-00082P-KJ for submit@debbugs.gnu.org; Sat, 02 Sep 2017 01:51:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1do1L5-00052Z-Iq for submit@debbugs.gnu.org; Sat, 02 Sep 2017 01:51:32 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-0.5 required=5.0 tests=BAYES_05,FREEMAIL_FROM, T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:53625) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1do1L5-00052E-FK for submit@debbugs.gnu.org; Sat, 02 Sep 2017 01:51:27 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59080) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1do1L0-0005IA-Dj for bug-guix@gnu.org; Sat, 02 Sep 2017 01:51:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1do1Kv-0004er-Gs for bug-guix@gnu.org; Sat, 02 Sep 2017 01:51:22 -0400 Received: from mail-it0-x231.google.com ([2607:f8b0:4001:c0b::231]:37800) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1do1Kv-0004dX-B2 for bug-guix@gnu.org; Sat, 02 Sep 2017 01:51:17 -0400 Received: by mail-it0-x231.google.com with SMTP id k189so666720itk.0 for ; Fri, 01 Sep 2017 22:51:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:user-agent:mime-version; bh=nAdpbMrAXt11bWIKddmffK1kRGkl39m5E4nBAsVr9A8=; b=uLCxOLBjt8vErssUxqVjvZDrBvh5HiuHz+uvB6Tu/6nOx6YM5Hu1TBcFNDePnoOBCz hx4YY9sVPemOr8cY/9mCAuE6M5+R7iJK6LyeWnrvADN6xeylOszibD19xtP+0PpQ+I0a 3m1ZizAJJIOLLIifFe/O65xS+bvISJMZEqcWTVaVQNLmFkdUByvwE+fC9ITvM+RZ/Q3p S9yFgIeM4eup7kzFfY2c3pesBa1GDKGWaw8p4nO7gj0pp3cumZ82QdB9gUBUSICV7EVm RieDUDIDVrOUk3IdVIu7qksP5J858WOxWuG6ohpU0s+b7UavqvlQXBBEbaotlkDMZlOY FHhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:user-agent :mime-version; bh=nAdpbMrAXt11bWIKddmffK1kRGkl39m5E4nBAsVr9A8=; b=ZPVjWHT3q0QyW4oVcdElO1nRtLkUOxB4WonwWvK3aKP1bJUrt2ba4CHsowdA+PxR3R QD5cwaBaJr2UPEJbwUvz1+xOwS98PfPEaABLNa63EzNRsTN8e/ynM5ZvUBced5Dvccg/ iPJx2xYkDNKdexF96P1OVvBpFPZhBCOdluYCAzRfcjZfWrqXpj38KWrpbQkufbijuQ3Y 8hsNjb7HjRU9ih0asu6Z9l+61eLMLUV+QWiCdwDjoikbRl/Du9733BaQuOXZDFSioTqI VzagkpE21GKtmXsai+KuEreGWzC5qZ4sN+t0JOWKj+JqJwVRUoPNWmu8k2NHjuexHC9O C+Lw== X-Gm-Message-State: AHPjjUgTVKUa8I2mDqTfjp531K/jBeOl6Vg9GCgxaPiTUTTxRIZ2Ocn7 jVmb++cPLRsaTMgo X-Google-Smtp-Source: ADKCNb6R4VsMpT8G1hP3H7ZLQEZElzhjnw40xN0q8FGBunr32OyftHuNbIXxOYWyl1mwnE26Vly+5Q== X-Received: by 10.36.107.145 with SMTP id v139mr324038itc.41.1504331476357; Fri, 01 Sep 2017 22:51:16 -0700 (PDT) Received: from apteryx ([45.72.233.254]) by smtp.gmail.com with ESMTPSA id f140sm1031718ioe.27.2017.09.01.22.51.15 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 01 Sep 2017 22:51:15 -0700 (PDT) From: Maxim Cournoyer Date: Sat, 02 Sep 2017 01:51:14 -0400 Message-ID: <87fuc5wsvh.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.0 (----) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -4.0 (----) tl;dr: exiv2 source archive was updated in-place and the verification below gives us confidence that we can safely update the hash. On current master, the following happens: $ guix build exiv2 Starting download of /gnu/store/jcapi6vk4a14hch5jgsh5zps958g91sb-exiv2-0.26-trunk.tar.gz >From http://www.exiv2.org/builds/exiv2-0.26-trunk.tar.gz... [...] sha256 hash mismatch for output path `/gnu/store/jcapi6vk4a14hch5jgsh5zps958g91sb-exiv2-0.26-trunk.tar.gz' expected: 1hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc actual: 1yza317qxd8yshvqnay164imm0ks7cvij8y8j86p1gqi1153qpn7 Looking at what happened at the source obtained through the Wayback Machine at the time it was last updated in Guix[1] compared to now[2], we see that: 1. The project maintainers updated the MD5 and filesize of the file "exiv2-0.26-trunk.tar.gz", which name and URL remained unchanged. Let's validate those weak MD5 hashes: $ md5sum exiv2-0.26-trunk.tar.gz # old one f936d2ca5cbe1e18c71ca2baa5e84fb4 exiv2-0.26-trunk.tar.gz $ md5sum exiv2-0.26-trunk\(1\).tar.gz # new one 5399e3b570d7f9205f0e76d47582da4c exiv2-0.26-trunk(1).tar.gz OK, at least the advertized signature validates. 2. When extracting those two archives and diffing them, we see the changes: $ diff -ur exiv2-trunk-old/ exiv2-trunk-new/ Only in exiv2-trunk-old/: ._AUTHORS Only in exiv2-trunk-old/: ._bootstrap.macports Only in exiv2-trunk-old/: ._bootstrap.mxe Only in exiv2-trunk-old/: ._CMakeLists.txt Only in exiv2-trunk-old/: ._CMake_msvc.txt Only in exiv2-trunk-old/config: ._aclocal.m4 Only in exiv2-trunk-old/config: ._CMakeChecks.txt [...] Only in exiv2-trunk-old/xmpsdk/src: ._XMPMeta-Serialize.cpp Only in exiv2-trunk-old/xmpsdk/src: ._XMPUtils.cpp Only in exiv2-trunk-old/xmpsdk/src: ._XMPUtils-FileInfo.cpp Only in exiv2-trunk-old/xmpsdk/src: ._XMPUtils.hpp Only in exiv2-trunk-old/xmpsdk: ._src Only in exiv2-trunk-old/: ._xmpsdk A pretty harmless cleanup. Still, the practice of updating a release in place is not very good... Upon further digging, the issue was already reported and discussed[3][4]. Note: they are moving to Github and in the furure the releases will be offered directly through Github. Patch will follow. [1] https://web.archive.org/web/20170606065325/http://exiv2.org/download.html [2] http://exiv2.org/download.html [3] http://dev.exiv2.org/issues/1299 [4] https://github.com/Exiv2/exiv2/issues/19 From unknown Tue Aug 19 10:08:31 2025 X-Loop: help-debbugs@gnu.org Subject: bug#28326: [PATCH] Re: bug#28326: Acknowledgement (exiv2 0.26 hash mismatch) Resent-From: Maxim Cournoyer Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Sat, 02 Sep 2017 05:58:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 28326 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: 28326@debbugs.gnu.org Received: via spool by 28326-submit@debbugs.gnu.org id=B28326.150433187131467 (code B ref 28326); Sat, 02 Sep 2017 05:58:02 +0000 Received: (at 28326) by debbugs.gnu.org; 2 Sep 2017 05:57:51 +0000 Received: from localhost ([127.0.0.1]:41186 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1do1RH-0008BT-Fw for submit@debbugs.gnu.org; Sat, 02 Sep 2017 01:57:51 -0400 Received: from mail-io0-f173.google.com ([209.85.223.173]:36776) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1do1RF-0008BF-7c for 28326@debbugs.gnu.org; Sat, 02 Sep 2017 01:57:49 -0400 Received: by mail-io0-f173.google.com with SMTP id f99so8520527ioi.3 for <28326@debbugs.gnu.org>; Fri, 01 Sep 2017 22:57:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:references:date:in-reply-to:message-id:user-agent :mime-version; bh=WVppwPbHu88t6XGIeNcGT3XXx9WINnxxM1zjeuGb+xU=; b=oQe3ycDRGOw3kReLp2FY7J7bQXCglbxaVru/NP9rdb+RSRZSaU2bCt2CVJKlvEX09A GCbOtOCn+XoWfpbucnnz8ZtFZQszJA0kmBQZ2bRtu3Ed7W2K15m3nG73lLu3oGNl+Kqy eEYnghf4mlUijLfgDYxB7+tKHICWBsqIzi4ZYT6wfZCOd+b+4d/Ng2TTTjvYwQDAtrMU JEEwGs7KHPJ9IMhZ2JhQLcaF5uNqUzkbdTAHgFp/i+CaHmKCkUqdIg0D7QEsHj7zFazC CKtN9Fy8W4fuwFoL4lfn9K1N4ZpdigrKVuE9ajqd1Oe1BlSAsiLKiUSX4mKcGN8tmrbS EGCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:references:date:in-reply-to :message-id:user-agent:mime-version; bh=WVppwPbHu88t6XGIeNcGT3XXx9WINnxxM1zjeuGb+xU=; b=mI8A4nJfbzMr2l1Aj4cC4H0TW0Xp6T73ggLQdZItiEaLkNISGB3vCHWJSA19BSby0G r+MOo0ZrOBkuawvN5FV2n57HOGA16aEdDJBpWgIJ7jdieAsLT/EDcqEbGyjurTkcgoTK 7VPWGpJ8NwoDadh1dK9TojzVg7wrefrghNrKnLOzpWT8PEHRgjvrTMFbHDTh+Q94KZOs XiH51FJjlt7UWfqLWgymVGvmb4aF0E6Rm1cbP3CRLSrBuI01faHgzPiVCtfwUjlU1o2u bQs3/oiLw7Sd5Fs83NuQTXFs8dyqORXGTLwd1QM1jxwOlaglApF3CTKBp3L+JFraMwj2 XO6w== X-Gm-Message-State: AHPjjUjSu0VmJfRuAet0OdcTlri07mY/BgjmjxWyE0xiPkLAjeGb+Wj7 QzU4ui6xM2sF4+I/ X-Google-Smtp-Source: ADKCNb4ojRAXFvRDz515014SvodkMZLMLBWFaHWjPc7PVfpKOmxP93NUnigHlMBwCEA3PVl21JMeMQ== X-Received: by 10.107.9.209 with SMTP id 78mr3263934ioj.99.1504331863406; Fri, 01 Sep 2017 22:57:43 -0700 (PDT) Received: from apteryx ([45.72.233.254]) by smtp.gmail.com with ESMTPSA id q133sm972476iod.44.2017.09.01.22.57.42 for <28326@debbugs.gnu.org> (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 01 Sep 2017 22:57:42 -0700 (PDT) From: Maxim Cournoyer References: <87fuc5wsvh.fsf@gmail.com> Date: Sat, 02 Sep 2017 01:57:41 -0400 In-Reply-To: (GNU bug Tracking System's message of "Sat, 02 Sep 2017 05:52:03 +0000") Message-ID: <87a82dwskq.fsf_-_@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.2 (gnu/linux) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -2.3 (--) --=-=-= Content-Type: text/plain Here's the updated hash. --=-=-= Content-Type: text/x-patch Content-Disposition: attachment; filename=0001-gnu-Update-the-hash-of-the-exiv2-package.patch >From ea55dd50570e8c16e124cfefe6c7f1cf33e706b3 Mon Sep 17 00:00:00 2001 From: Maxim Cournoyer Date: Sat, 2 Sep 2017 01:45:24 -0400 Subject: [PATCH] gnu: Update the hash of the exiv2 package. The source archive was updated in place; only a cleanup of non functional files was done (see: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28326). * gnu/packages/image.scm (exiv2): Update hash. --- gnu/packages/image.scm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index e93248199..503a249a9 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -868,7 +868,7 @@ channels.") version ".tar.gz"))) (sha256 (base32 - "1hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc")))) + "1yza317qxd8yshvqnay164imm0ks7cvij8y8j86p1gqi1153qpn7")))) (build-system gnu-build-system) (arguments '(#:tests? #f)) ; no `check' target (propagated-inputs -- 2.13.1 --=-=-=-- From unknown Tue Aug 19 10:08:31 2025 MIME-Version: 1.0 X-Mailer: MIME-tools 5.505 (Entity 5.505) X-Loop: help-debbugs@gnu.org From: help-debbugs@gnu.org (GNU bug Tracking System) To: Maxim Cournoyer Subject: bug#28326: closed (Re: bug#28326: exiv2 0.26 hash mismatch) Message-ID: References: <87pob9l770.fsf@fastmail.com> <87fuc5wsvh.fsf@gmail.com> X-Gnu-PR-Message: they-closed 28326 X-Gnu-PR-Package: guix Reply-To: 28326@debbugs.gnu.org Date: Sat, 02 Sep 2017 10:36:01 +0000 Content-Type: multipart/mixed; boundary="----------=_1504348561-23654-1" This is a multi-part message in MIME format... ------------=_1504348561-23654-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Your bug report #28326: exiv2 0.26 hash mismatch which was filed against the guix package, has been closed. The explanation is attached below, along with your original report. If you require more details, please reply to 28326@debbugs.gnu.org. --=20 28326: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D28326 GNU Bug Tracking System Contact help-debbugs@gnu.org with problems ------------=_1504348561-23654-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at 28326-done) by debbugs.gnu.org; 2 Sep 2017 10:35:05 +0000 Received: from localhost ([127.0.0.1]:41499 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1do5lZ-00068H-7u for submit@debbugs.gnu.org; Sat, 02 Sep 2017 06:35:05 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:42415) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1do5lW-00067w-7d for 28326-done@debbugs.gnu.org; Sat, 02 Sep 2017 06:35:03 -0400 Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id 833D020B19; Sat, 2 Sep 2017 06:35:01 -0400 (EDT) Received: from frontend1 ([10.202.2.160]) by compute5.internal (MEProxy); Sat, 02 Sep 2017 06:35:01 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.com; h= content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc :x-sasl-enc; s=fm1; bh=E6zVgimcwLxfaSeL0T0FRpvugwSKlm+AQk2SF13Iv Uw=; b=Zlquw/+lsZszexyX/Rny+liFFWrwc0K6AUa6ncb7Pjs3VJYjxRZ92tNv0 EGpiVL4R1kgSpa+9/ixCelKmPSSrnyLt2IAKzWFMIw1KIt+TJeG4oVsE6WbWAtIa AZOnx55ttkFoh0dR3u7yiqywmR7LknVVHbo45OVPDL7DNRIngxv+XjAGCK0yN4o5 9cdl5I60X1Xtokh4+432B2tBxCGu7chCn6kUjziL8wo36qHjQgLBuO8MedxAN5LM D8ckAn2h1zR5RYbpf358o+WAQPh9KCgfWEgxFf2BJBzg0XegZMx6eaG7AgsF046V YOSeqSQMyHRRWbR+VqH4DCOFZDbRw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=E6zVgimcwLxfaSeL0T 0FRpvugwSKlm+AQk2SF13IvUw=; b=LwNoT7Hw4nIz9SaQa+3JEeFUym6IC7LprT lU6ojrFDHxBqWeJejlLRe8JsHEGg9F4hHkryXG/qBA0aRjkQKsMGW9+mSAUMr2Cm QVA3MB4Hqenjh9NPrToaDhkwNnEInyjS1QkNj3PWJFFro9wSc6kOIjDHGcSeseFG f3RL9AOHvREmvCVsPIJoZmUWMV8E7qW3zwlAq9ZWfWDn+0D6+67UM846dqUpzReq OSduY8omW0MVC6Rx4GDXrUlZS1egy6QXZ8Un4T4KJjWeP2Y9hL1GzxuSagqqvrFu lNI9Jeg/wmoqoVABsc/9Y3I8pSEw2EKnTnnyoNyplNfZoLvtuVsg== X-ME-Sender: X-Sasl-enc: AZPaFZJbbhe5I5XHuDoOyAEyHMDsfg6NYNWIliKoJ8+G 1504348501 Received: from localhost (unknown [188.113.81.93]) by mail.messagingengine.com (Postfix) with ESMTPA id 08AD77F988; Sat, 2 Sep 2017 06:35:00 -0400 (EDT) From: Marius Bakke To: Maxim Cournoyer , 28326-done@debbugs.gnu.org Subject: Re: bug#28326: exiv2 0.26 hash mismatch In-Reply-To: <87fuc5wsvh.fsf@gmail.com> References: <87fuc5wsvh.fsf@gmail.com> User-Agent: Notmuch/0.25 (https://notmuchmail.org) Emacs/25.2.1 (x86_64-unknown-linux-gnu) Date: Sat, 02 Sep 2017 12:34:59 +0200 Message-ID: <87pob9l770.fsf@fastmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 28326-done X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) --=-=-= Content-Type: text/plain Maxim Cournoyer writes: > tl;dr: exiv2 source archive was updated in-place and the verification > below gives us confidence that we can safely update the hash. > > On current master, the following happens: > > $ guix build exiv2 > > Starting download of /gnu/store/jcapi6vk4a14hch5jgsh5zps958g91sb-exiv2-0.26-trunk.tar.gz > From http://www.exiv2.org/builds/exiv2-0.26-trunk.tar.gz... > > [...] > > sha256 hash mismatch for output path `/gnu/store/jcapi6vk4a14hch5jgsh5zps958g91sb-exiv2-0.26-trunk.tar.gz' > expected: 1hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc > actual: 1yza317qxd8yshvqnay164imm0ks7cvij8y8j86p1gqi1153qpn7 > > Looking at what happened at the source obtained through the Wayback > Machine at the time it was last updated in Guix[1] compared to now[2], we see > that: > > 1. The project maintainers updated the MD5 and filesize of the file > "exiv2-0.26-trunk.tar.gz", which name and URL remained unchanged. > > Let's validate those weak MD5 hashes: > > $ md5sum exiv2-0.26-trunk.tar.gz # old one > f936d2ca5cbe1e18c71ca2baa5e84fb4 exiv2-0.26-trunk.tar.gz > > $ md5sum exiv2-0.26-trunk\(1\).tar.gz # new one > 5399e3b570d7f9205f0e76d47582da4c exiv2-0.26-trunk(1).tar.gz > > OK, at least the advertized signature validates. > > 2. When extracting those two archives and diffing them, we see the changes: > > $ diff -ur exiv2-trunk-old/ exiv2-trunk-new/ > Only in exiv2-trunk-old/: ._AUTHORS > Only in exiv2-trunk-old/: ._bootstrap.macports > Only in exiv2-trunk-old/: ._bootstrap.mxe > Only in exiv2-trunk-old/: ._CMakeLists.txt > Only in exiv2-trunk-old/: ._CMake_msvc.txt > Only in exiv2-trunk-old/config: ._aclocal.m4 > Only in exiv2-trunk-old/config: ._CMakeChecks.txt > [...] > Only in exiv2-trunk-old/xmpsdk/src: ._XMPMeta-Serialize.cpp > Only in exiv2-trunk-old/xmpsdk/src: ._XMPUtils.cpp > Only in exiv2-trunk-old/xmpsdk/src: ._XMPUtils-FileInfo.cpp > Only in exiv2-trunk-old/xmpsdk/src: ._XMPUtils.hpp > Only in exiv2-trunk-old/xmpsdk: ._src > Only in exiv2-trunk-old/: ._xmpsdk > > A pretty harmless cleanup. Still, the practice of updating a release in > place is not very good... Upon further digging, the issue was already > reported and discussed[3][4]. > > Note: they are moving to Github and in the furure the releases will be > offered directly through Github. > > Patch will follow. > > [1] https://web.archive.org/web/20170606065325/http://exiv2.org/download.html > [2] http://exiv2.org/download.html > [3] http://dev.exiv2.org/issues/1299 > [4] https://github.com/Exiv2/exiv2/issues/19 Hi Maxim, Thanks a lot for the detailed analysis! I've applied the patch with a slightly adjusted commit message. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlmqiVMACgkQoqBt8qM6 VPqDeQf/RHWWPny569Fg0waHPBp54YIXCo0LXPZfP29cirPAX2uZxY5ptQxlVgf1 E7u4kCckNo6v/50hJtLr/4WIU9vPpi+SmOKSI+y3uX2xpU53Y4cOJxups3dfbiji cX+xehPuXCZj6eU1BVQArWHC3O2QO4UVKewJ59kZjFnOSZsDS+1rBreMwYOngC6K r3Pd7ai0Upclq9UppqrPF7Xe9Qxx3W7jczlQiJJFuKbFUopijkMt4KbGuxC93TmF fHWdZPfUcGfdq5UagqcJLnL00X5orhlbA0ooxpB0VxKcC4O2vtwt3xVMmRtlveXu nz+8OE74UlQBg+qm2Oka8BotqOQN4w== =lRJP -----END PGP SIGNATURE----- --=-=-=-- ------------=_1504348561-23654-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at submit) by debbugs.gnu.org; 2 Sep 2017 05:51:44 +0000 Received: from localhost ([127.0.0.1]:41171 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1do1LH-00082d-T7 for submit@debbugs.gnu.org; Sat, 02 Sep 2017 01:51:43 -0400 Received: from eggs.gnu.org ([208.118.235.92]:39962) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1do1LF-00082P-KJ for submit@debbugs.gnu.org; Sat, 02 Sep 2017 01:51:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1do1L5-00052Z-Iq for submit@debbugs.gnu.org; Sat, 02 Sep 2017 01:51:32 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-0.5 required=5.0 tests=BAYES_05,FREEMAIL_FROM, T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:53625) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1do1L5-00052E-FK for submit@debbugs.gnu.org; Sat, 02 Sep 2017 01:51:27 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59080) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1do1L0-0005IA-Dj for bug-guix@gnu.org; Sat, 02 Sep 2017 01:51:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1do1Kv-0004er-Gs for bug-guix@gnu.org; Sat, 02 Sep 2017 01:51:22 -0400 Received: from mail-it0-x231.google.com ([2607:f8b0:4001:c0b::231]:37800) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1do1Kv-0004dX-B2 for bug-guix@gnu.org; Sat, 02 Sep 2017 01:51:17 -0400 Received: by mail-it0-x231.google.com with SMTP id k189so666720itk.0 for ; Fri, 01 Sep 2017 22:51:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:user-agent:mime-version; bh=nAdpbMrAXt11bWIKddmffK1kRGkl39m5E4nBAsVr9A8=; b=uLCxOLBjt8vErssUxqVjvZDrBvh5HiuHz+uvB6Tu/6nOx6YM5Hu1TBcFNDePnoOBCz hx4YY9sVPemOr8cY/9mCAuE6M5+R7iJK6LyeWnrvADN6xeylOszibD19xtP+0PpQ+I0a 3m1ZizAJJIOLLIifFe/O65xS+bvISJMZEqcWTVaVQNLmFkdUByvwE+fC9ITvM+RZ/Q3p S9yFgIeM4eup7kzFfY2c3pesBa1GDKGWaw8p4nO7gj0pp3cumZ82QdB9gUBUSICV7EVm RieDUDIDVrOUk3IdVIu7qksP5J858WOxWuG6ohpU0s+b7UavqvlQXBBEbaotlkDMZlOY FHhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:user-agent :mime-version; bh=nAdpbMrAXt11bWIKddmffK1kRGkl39m5E4nBAsVr9A8=; b=ZPVjWHT3q0QyW4oVcdElO1nRtLkUOxB4WonwWvK3aKP1bJUrt2ba4CHsowdA+PxR3R QD5cwaBaJr2UPEJbwUvz1+xOwS98PfPEaABLNa63EzNRsTN8e/ynM5ZvUBced5Dvccg/ iPJx2xYkDNKdexF96P1OVvBpFPZhBCOdluYCAzRfcjZfWrqXpj38KWrpbQkufbijuQ3Y 8hsNjb7HjRU9ih0asu6Z9l+61eLMLUV+QWiCdwDjoikbRl/Du9733BaQuOXZDFSioTqI VzagkpE21GKtmXsai+KuEreGWzC5qZ4sN+t0JOWKj+JqJwVRUoPNWmu8k2NHjuexHC9O C+Lw== X-Gm-Message-State: AHPjjUgTVKUa8I2mDqTfjp531K/jBeOl6Vg9GCgxaPiTUTTxRIZ2Ocn7 jVmb++cPLRsaTMgo X-Google-Smtp-Source: ADKCNb6R4VsMpT8G1hP3H7ZLQEZElzhjnw40xN0q8FGBunr32OyftHuNbIXxOYWyl1mwnE26Vly+5Q== X-Received: by 10.36.107.145 with SMTP id v139mr324038itc.41.1504331476357; Fri, 01 Sep 2017 22:51:16 -0700 (PDT) Received: from apteryx ([45.72.233.254]) by smtp.gmail.com with ESMTPSA id f140sm1031718ioe.27.2017.09.01.22.51.15 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 01 Sep 2017 22:51:15 -0700 (PDT) From: Maxim Cournoyer To: bug-guix Subject: exiv2 0.26 hash mismatch Date: Sat, 02 Sep 2017 01:51:14 -0400 Message-ID: <87fuc5wsvh.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.0 (----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -4.0 (----) tl;dr: exiv2 source archive was updated in-place and the verification below gives us confidence that we can safely update the hash. On current master, the following happens: $ guix build exiv2 Starting download of /gnu/store/jcapi6vk4a14hch5jgsh5zps958g91sb-exiv2-0.26-trunk.tar.gz >From http://www.exiv2.org/builds/exiv2-0.26-trunk.tar.gz... [...] sha256 hash mismatch for output path `/gnu/store/jcapi6vk4a14hch5jgsh5zps958g91sb-exiv2-0.26-trunk.tar.gz' expected: 1hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc actual: 1yza317qxd8yshvqnay164imm0ks7cvij8y8j86p1gqi1153qpn7 Looking at what happened at the source obtained through the Wayback Machine at the time it was last updated in Guix[1] compared to now[2], we see that: 1. The project maintainers updated the MD5 and filesize of the file "exiv2-0.26-trunk.tar.gz", which name and URL remained unchanged. Let's validate those weak MD5 hashes: $ md5sum exiv2-0.26-trunk.tar.gz # old one f936d2ca5cbe1e18c71ca2baa5e84fb4 exiv2-0.26-trunk.tar.gz $ md5sum exiv2-0.26-trunk\(1\).tar.gz # new one 5399e3b570d7f9205f0e76d47582da4c exiv2-0.26-trunk(1).tar.gz OK, at least the advertized signature validates. 2. When extracting those two archives and diffing them, we see the changes: $ diff -ur exiv2-trunk-old/ exiv2-trunk-new/ Only in exiv2-trunk-old/: ._AUTHORS Only in exiv2-trunk-old/: ._bootstrap.macports Only in exiv2-trunk-old/: ._bootstrap.mxe Only in exiv2-trunk-old/: ._CMakeLists.txt Only in exiv2-trunk-old/: ._CMake_msvc.txt Only in exiv2-trunk-old/config: ._aclocal.m4 Only in exiv2-trunk-old/config: ._CMakeChecks.txt [...] Only in exiv2-trunk-old/xmpsdk/src: ._XMPMeta-Serialize.cpp Only in exiv2-trunk-old/xmpsdk/src: ._XMPUtils.cpp Only in exiv2-trunk-old/xmpsdk/src: ._XMPUtils-FileInfo.cpp Only in exiv2-trunk-old/xmpsdk/src: ._XMPUtils.hpp Only in exiv2-trunk-old/xmpsdk: ._src Only in exiv2-trunk-old/: ._xmpsdk A pretty harmless cleanup. Still, the practice of updating a release in place is not very good... Upon further digging, the issue was already reported and discussed[3][4]. Note: they are moving to Github and in the furure the releases will be offered directly through Github. Patch will follow. [1] https://web.archive.org/web/20170606065325/http://exiv2.org/download.html [2] http://exiv2.org/download.html [3] http://dev.exiv2.org/issues/1299 [4] https://github.com/Exiv2/exiv2/issues/19 ------------=_1504348561-23654-1-- From unknown Tue Aug 19 10:08:31 2025 X-Loop: help-debbugs@gnu.org Subject: bug#28326: exiv2 0.26 hash mismatch Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Sat, 02 Sep 2017 14:52:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 28326 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: Maxim Cournoyer Cc: 28326@debbugs.gnu.org Received: via spool by 28326-submit@debbugs.gnu.org id=B28326.150436391730846 (code B ref 28326); Sat, 02 Sep 2017 14:52:02 +0000 Received: (at 28326) by debbugs.gnu.org; 2 Sep 2017 14:51:57 +0000 Received: from localhost ([127.0.0.1]:43614 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1do9m9-00081S-G0 for submit@debbugs.gnu.org; Sat, 02 Sep 2017 10:51:57 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:56771) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1do9m7-00081K-Iu for 28326@debbugs.gnu.org; Sat, 02 Sep 2017 10:51:56 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 14EF720C8C; Sat, 2 Sep 2017 10:51:55 -0400 (EDT) Received: from frontend1 ([10.202.2.160]) by compute4.internal (MEProxy); Sat, 02 Sep 2017 10:51:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=cc:content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc :x-sasl-enc; s=mesmtp; bh=NgZkuDDWkz3xB40lUlK8ehKi+V4kzgc/0iylKH jcLTw=; b=PFvbjdzeX7Bq3H7I5Cgj2+gBAGq20sH60OnzKVKXzdZwdQFDDQzRIP PyAK05svgxCFnCQTvDzv1k+B8ZbpK1NabnQ/NRoRhAQkuP/9pF/xmBZws3ExWNeZ HItwtcvhQipjIH+jR3nm6LERqLtKV0rI2Zp077CCynSaOj/D9HE+o= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=NgZkuDDWkz3xB40lUl K8ehKi+V4kzgc/0iylKHjcLTw=; b=caNNeK78E5UVgYq5kClqeJpGlwA4BHQE3w ELrtS8wv5ureW26GSxSMxfZWYiwWeMvbuR4TAC8bVWnfnyjdGlZ9OHfWty2cBNDp jGqHAO4PnM1rjnP+9NUcTd4CXC04hvi4qE3fd0RkKctLJ+UQTI9CjI9sL/KqhPCU mQPN0jh004/A2acHCDHMm+8mg/53I4+dnsfUH+kPyzxiNz4FlEzry3jUa2Tbabom UG2mVaJMmWASVgROJ6CEdw6kN6n38Y73tJxfOuCE1ZS8Smo8ej1eEPGgkVi+cdHe 0WJIwVxFXPVqXwI+1hE1GOORPL/MetmoSZmBnzrRpz6d8ZPX1pyg== X-ME-Sender: X-Sasl-enc: thEOVoLluuEDVXirbIohRO0zLPvGDRiTaZyshNvJi9jc 1504363914 Received: from localhost (c-73-165-108-70.hsd1.pa.comcast.net [73.165.108.70]) by mail.messagingengine.com (Postfix) with ESMTPA id C75427F96A; Sat, 2 Sep 2017 10:51:54 -0400 (EDT) Date: Sat, 2 Sep 2017 10:51:50 -0400 From: Leo Famulari Message-ID: <20170902145150.GA31990@jasmine.lan> References: <87fuc5wsvh.fsf@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="Qxx1br4bt0+wmkIi" Content-Disposition: inline In-Reply-To: <87fuc5wsvh.fsf@gmail.com> User-Agent: Mutt/1.8.3 (2017-05-23) X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) --Qxx1br4bt0+wmkIi Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Sep 02, 2017 at 01:51:14AM -0400, Maxim Cournoyer wrote: > tl;dr: exiv2 source archive was updated in-place and the verification > below gives us confidence that we can safely update the hash. Thanks for your investigation! > A pretty harmless cleanup. Still, the practice of updating a release in > place is not very good... Upon further digging, the issue was already > reported and discussed[3][4]. >=20 > Note: they are moving to Github and in the furure the releases will be > offered directly through Github. >=20 > Patch will follow. Okay, great! --Qxx1br4bt0+wmkIi Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlmqxYIACgkQJkb6MLrK fwi2BA/9Ej+G0G/qSQy2tBMGr/yg1zL4hmXybyKiylfeCg2mEPo5yUoqDD43Jwse p9bashVvnvsqVae274T+UC1UG+yjznHxp7E/60M93y6JCgTQyIpEB1iE39mff3KW b2oS/V0Ii0wqIQhrUUcK9kZuTRILvJLtbMO/T+6xrydzYIB5OGJRpocThL6Wzo0p 2OSCAbUDUmZXWni6sQE8ZiQujEqvRo8HiXSsBISTVDA9A7ndixSxOmY8xuboERSp yI13On8GvJGuhTkjR6cwCqOK0fq7itnDdf+6nrODNub/QuM0e+W+E4wC5hi4Edq+ PvFxcH4duVanWsFmI7sbPWB63um4toYVfnpXBSl5UFCk8DtVHTC20towFOAFYB0G HbSRVKjD+8xs7sn7y44p3apwsaPlq75RAgnqWJ0LkHh2GChUUlWHSvXpOULWMhD+ 88KbGEpjKnjvVZBnZSJlLHJbySBfbC/uj8E1Gk6IE0raMJA4MeacJVNstvXSD24u /RyCPmPCyV0vjwsuTuzrAv7oqrUodOmGnE8Juz/vToj4nwj1zPom0Cn8i2Sm4oFj fnVK9Lkg4F6yEacg9aX0mHcKLhVQaxnHgyD/YmTXHe/ao+R9CAvodcfFTnCuYX3s us7OK1OLJJ6A+2BkHmO5s0hGSSWQ1P5UttgfGP+TF7TYd7hxmGo= =yPNv -----END PGP SIGNATURE----- --Qxx1br4bt0+wmkIi-- From unknown Tue Aug 19 10:08:31 2025 X-Loop: help-debbugs@gnu.org Subject: bug#28326: exiv2 0.26 hash mismatch Resent-From: ludo@gnu.org (Ludovic =?UTF-8?Q?Court=C3=A8s?=) Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Sat, 02 Sep 2017 21:36:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 28326 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: Maxim Cournoyer Cc: 28326@debbugs.gnu.org Received: via spool by 28326-submit@debbugs.gnu.org id=B28326.150438810410347 (code B ref 28326); Sat, 02 Sep 2017 21:36:01 +0000 Received: (at 28326) by debbugs.gnu.org; 2 Sep 2017 21:35:04 +0000 Received: from localhost ([127.0.0.1]:44099 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1doG4F-0002gp-SE for submit@debbugs.gnu.org; Sat, 02 Sep 2017 17:35:04 -0400 Received: from eggs.gnu.org ([208.118.235.92]:33522) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1doG4E-0002gH-G4 for 28326@debbugs.gnu.org; Sat, 02 Sep 2017 17:35:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1doG44-0008Sx-AF for 28326@debbugs.gnu.org; Sat, 02 Sep 2017 17:34:57 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:57880) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1doG44-0008Ss-6R; Sat, 02 Sep 2017 17:34:52 -0400 Received: from [2a01:e0a:1d:7270:6a6c:dc17:fc02:cfda] (port=43906 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1doG43-0002x6-IJ; Sat, 02 Sep 2017 17:34:51 -0400 From: ludo@gnu.org (Ludovic =?UTF-8?Q?Court=C3=A8s?=) References: <87fuc5wsvh.fsf@gmail.com> X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 16 Fructidor an 225 de la =?UTF-8?Q?R=C3=A9volution?= X-PGP-Key-ID: 0x090B11993D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-unknown-linux-gnu Date: Sat, 02 Sep 2017 23:34:49 +0200 In-Reply-To: <87fuc5wsvh.fsf@gmail.com> (Maxim Cournoyer's message of "Sat, 02 Sep 2017 01:51:14 -0400") Message-ID: <871snovl6u.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) Maxim Cournoyer skribis: > sha256 hash mismatch for output path `/gnu/store/jcapi6vk4a14hch5jgsh5zps= 958g91sb-exiv2-0.26-trunk.tar.gz' > expected: 1hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc > actual: 1yza317qxd8yshvqnay164imm0ks7cvij8y8j86p1gqi1153qpn7 > > Looking at what happened at the source obtained through the Wayback > Machine at the time it was last updated in Guix[1] compared to now[2], we= see > that: For the record, as an alternative to the Wayback Machine, you can use: wget https://mirror.hydra.gnu.org/file/exiv2-0.26-trunk.tar.gz/sha256/1hs= dzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc Ludo=E2=80=99. From unknown Tue Aug 19 10:08:31 2025 X-Loop: help-debbugs@gnu.org Subject: bug#28326: exiv2 0.26 hash mismatch Resent-From: Maxim Cournoyer Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Mon, 04 Sep 2017 13:53:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 28326 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: ludo@gnu.org (Ludovic =?UTF-8?Q?Court=C3=A8s?=) Cc: 28326@debbugs.gnu.org Received: via spool by 28326-submit@debbugs.gnu.org id=B28326.150453317512374 (code B ref 28326); Mon, 04 Sep 2017 13:53:01 +0000 Received: (at 28326) by debbugs.gnu.org; 4 Sep 2017 13:52:55 +0000 Received: from localhost ([127.0.0.1]:48082 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1doro7-0003DW-EO for submit@debbugs.gnu.org; Mon, 04 Sep 2017 09:52:55 -0400 Received: from mail-it0-f46.google.com ([209.85.214.46]:34179) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1doro6-0003DJ-GI for 28326@debbugs.gnu.org; Mon, 04 Sep 2017 09:52:54 -0400 Received: by mail-it0-f46.google.com with SMTP id f199so9552802ita.1 for <28326@debbugs.gnu.org>; Mon, 04 Sep 2017 06:52:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:references:date:in-reply-to:message-id :user-agent:mime-version:content-transfer-encoding; bh=AsT2vyTvIg+i8hVlanUKGYhoOdNcHAeN9UjKvvRV+h0=; b=N6xuyNdqA9JYfqNKN02P563bX0NdtTWH5m79EfRiB9gqBFfTLTksApVWy0YOZ/nrZj P7jF7U05eul8RULvItXkxg+UNeXnzZcDgbGh8ztwMuatnx64JR84AhtUfRddb4OO+fCH 2L9cUFis2ph0xPyNcdPw8fNcmhqTvmRQzZRPrt9R+0Y0ocN5zFkaXyFWXkUqqcqs5HB6 lrT5m4zh4bTc5V+USiy+Z4Vp5k6la7S3kRLsYHmXC5WvOxhvlrnK3Ofu/5LdgKn3MBQV D4o3qOBojLNYRscP51DhN/aZApU65CnMrEkrXN17lac24CFlOZODIDvi/JvQT+ePJQK1 fX+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:references:date:in-reply-to :message-id:user-agent:mime-version:content-transfer-encoding; bh=AsT2vyTvIg+i8hVlanUKGYhoOdNcHAeN9UjKvvRV+h0=; b=YzXBlprVe7YSW8G5kKUTnUJt57uzppoB6JODxKwvbbpq4SLEH45fOxNeleKHJeumG1 iYT8DOAPC3u5cBsZlPGwQAmLzO6qvHOj+xYXbHYWZ1cVRCC1/yF8+wykbBdHEPkmzBIJ a1mm7//Ixnx3pHkOuI2U6gHKq4YET4DLzceJOLo0Zx3ND2iMXdDFQyL5cx3oKMUAnoiZ Xk8yeCuiJCMWZQKLc25spaqNe8VWOteG0ldd/jyk0c9jQg2iOtKnXtGlgXzlgEI7cRfA 9lr+bwVX3dRHF35bL9iU7VlSl1HMnctScS/ODFPU6oOnvo2lLQVb8SUijRhRnLXP0Ha3 hzjg== X-Gm-Message-State: AHPjjUjJG/EioKATZySbEIeFIpJ6pia98OZ9HXV2q+LXp9dSIZv0UVN4 OgZ2oDZFsJu4wSeY X-Google-Smtp-Source: ADKCNb6bKfG7D9d3yk+KrnQuDKW6wTmVNr1lrHGnYyKeN+vRTHDRQiXIWHDnQeEf5tcoCpJS4Depmg== X-Received: by 10.36.2.136 with SMTP id 130mr541495itu.83.1504533168563; Mon, 04 Sep 2017 06:52:48 -0700 (PDT) Received: from apteryx ([45.72.233.254]) by smtp.gmail.com with ESMTPSA id b64sm309866itd.10.2017.09.04.06.52.47 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 04 Sep 2017 06:52:48 -0700 (PDT) From: Maxim Cournoyer References: <87fuc5wsvh.fsf@gmail.com> <871snovl6u.fsf@gnu.org> Date: Mon, 04 Sep 2017 09:52:47 -0400 In-Reply-To: <871snovl6u.fsf@gnu.org> ("Ludovic \=\?utf-8\?Q\?Court\=C3\=A8s\=22'\?\= \=\?utf-8\?Q\?s\?\= message of "Sat, 02 Sep 2017 23:34:49 +0200") Message-ID: <8737828tao.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: 0.5 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.5 (/) ludo@gnu.org (Ludovic Court=C3=A8s) writes: > Maxim Cournoyer skribis: > >> sha256 hash mismatch for output path `/gnu/store/jcapi6vk4a14hch5jgsh5zp= s958g91sb-exiv2-0.26-trunk.tar.gz' >> expected: 1hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc >> actual: 1yza317qxd8yshvqnay164imm0ks7cvij8y8j86p1gqi1153qpn7 >> >> Looking at what happened at the source obtained through the Wayback >> Machine at the time it was last updated in Guix[1] compared to now[2], w= e see >> that: > > For the record, as an alternative to the Wayback Machine, you can use: > > wget https://mirror.hydra.gnu.org/file/exiv2-0.26-trunk.tar.gz/sha256/1= hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc Thanks for the tip! I actually tried to find a way to download that file from Hydra for the investigation but couldn't figure it out (by using the Hydra web front-end). Maxim From unknown Tue Aug 19 10:08:31 2025 X-Loop: help-debbugs@gnu.org Subject: bug#28326: exiv2 0.26 hash mismatch Resent-From: ludo@gnu.org (Ludovic =?UTF-8?Q?Court=C3=A8s?=) Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Mon, 04 Sep 2017 21:52:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 28326 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: Maxim Cournoyer Cc: 28326@debbugs.gnu.org Received: via spool by 28326-submit@debbugs.gnu.org id=B28326.150456189723815 (code B ref 28326); Mon, 04 Sep 2017 21:52:02 +0000 Received: (at 28326) by debbugs.gnu.org; 4 Sep 2017 21:51:37 +0000 Received: from localhost ([127.0.0.1]:49521 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dozHN-0006C3-Co for submit@debbugs.gnu.org; Mon, 04 Sep 2017 17:51:37 -0400 Received: from eggs.gnu.org ([208.118.235.92]:58165) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dozHL-0006Bp-3L for 28326@debbugs.gnu.org; Mon, 04 Sep 2017 17:51:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dozHB-00060l-CQ for 28326@debbugs.gnu.org; Mon, 04 Sep 2017 17:51:30 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD, URIBL_BLOCKED autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:41143) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dozHB-00060X-93; Mon, 04 Sep 2017 17:51:25 -0400 Received: from [2a01:e0a:1d:7270:426d:6e94:eb6:ccd6] (port=42030 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1dozHA-000255-Nq; Mon, 04 Sep 2017 17:51:25 -0400 From: ludo@gnu.org (Ludovic =?UTF-8?Q?Court=C3=A8s?=) References: <87fuc5wsvh.fsf@gmail.com> <871snovl6u.fsf@gnu.org> <8737828tao.fsf@gmail.com> X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 18 Fructidor an 225 de la =?UTF-8?Q?R=C3=A9volution?= X-PGP-Key-ID: 0x090B11993D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-unknown-linux-gnu Date: Mon, 04 Sep 2017 23:51:22 +0200 In-Reply-To: <8737828tao.fsf@gmail.com> (Maxim Cournoyer's message of "Mon, 04 Sep 2017 09:52:47 -0400") Message-ID: <874lsii145.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) Maxim Cournoyer skribis: > ludo@gnu.org (Ludovic Court=C3=A8s) writes: > >> Maxim Cournoyer skribis: >> >>> sha256 hash mismatch for output path `/gnu/store/jcapi6vk4a14hch5jgsh5z= ps958g91sb-exiv2-0.26-trunk.tar.gz' >>> expected: 1hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc >>> actual: 1yza317qxd8yshvqnay164imm0ks7cvij8y8j86p1gqi1153qpn7 >>> >>> Looking at what happened at the source obtained through the Wayback >>> Machine at the time it was last updated in Guix[1] compared to now[2], = we see >>> that: >> >> For the record, as an alternative to the Wayback Machine, you can use: >> >> wget https://mirror.hydra.gnu.org/file/exiv2-0.26-trunk.tar.gz/sha256/= 1hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc > > Thanks for the tip! I actually tried to find a way to download that file > from Hydra for the investigation but couldn't figure it out (by using > the Hydra web front-end). This URL is implemented by =E2=80=98guix publish=E2=80=99: https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-publish.= html Not very discoverable I admit! Ludo=E2=80=99. From unknown Tue Aug 19 10:08:31 2025 X-Loop: help-debbugs@gnu.org Subject: bug#28326: exiv2 0.26 hash mismatch Resent-From: Maxim Cournoyer Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Mon, 11 Sep 2017 02:48:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 28326 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: ludo@gnu.org (Ludovic =?UTF-8?Q?Court=C3=A8s?=) Cc: 28326@debbugs.gnu.org Received: via spool by 28326-submit@debbugs.gnu.org id=B28326.150509805310735 (code B ref 28326); Mon, 11 Sep 2017 02:48:01 +0000 Received: (at 28326) by debbugs.gnu.org; 11 Sep 2017 02:47:33 +0000 Received: from localhost ([127.0.0.1]:60139 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1drEl3-0002n4-01 for submit@debbugs.gnu.org; Sun, 10 Sep 2017 22:47:33 -0400 Received: from mail-io0-f180.google.com ([209.85.223.180]:38703) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1drEl1-0002mr-B3 for 28326@debbugs.gnu.org; Sun, 10 Sep 2017 22:47:31 -0400 Received: by mail-io0-f180.google.com with SMTP id n69so16677611ioi.5 for <28326@debbugs.gnu.org>; Sun, 10 Sep 2017 19:47:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:references:date:in-reply-to:message-id :user-agent:mime-version:content-transfer-encoding; bh=6/+j+OOU9P6ibvNftEjYMIrJup5FLmveCpXkeyrPd8U=; b=cX7X7odKtqEUO2XtV1Nh8DWF0xCtYxIdzGYhBIeBp8rIAWyEcpbFMqF0NlN2W7haa7 IrKXms6+ITySCPUzeDl9KAlFTLeyc/f7YHIxO3DIcD4eF41Gb85hWurpofB1DW8QlDoY d34QMvkwBE140R7FMHoushzkMzLBQ9mA7fuvuiHva8kcaEageiwz89hLR9itb66YKfrz hMRT5LLIrlFnwJWtpfhNE0n/zs7dKb/6EGZiP5FVJPtrr71IuWRsUZC1Ze9Jmi0UhaAZ PA5o3Ji4rcITvW3QZ8Y5FrDU+019bjjlAhnLK0iqqQU+9oXHLdXq377ZvCQ7ENTETLxi 8eLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:references:date:in-reply-to :message-id:user-agent:mime-version:content-transfer-encoding; bh=6/+j+OOU9P6ibvNftEjYMIrJup5FLmveCpXkeyrPd8U=; b=gQQCVpMgxM+ABbUkfDojJqBf536YrUl/BQ9hhN5Kk5PwepEvwZ19hKQ9VEMZSb5Dkv o7A50i9C8NwQ/udmc972Hqqyu4EtjSK82gf5OG9qoc5e+9CQopst8qQ5FKdyJ1UjMhJC psQTjeiVF/p20goRQASLbOpuG1nSmhiCv0F/U0l8Dj4xCGu4bnseit3y1vcsUi2LAIXM xnFkkXlfzBcfXOCYBtT7MJ7oK384L4W9DqTJ7G50HtUn3hTLsYMSz4AHeQgaynHSrlj6 5ArZGXk/YRdMc4jrdjqxN7m73nq5A0Oc+/p7qgSMED950t26RVbTvVNiBy9/YwBALAsd jBdw== X-Gm-Message-State: AHPjjUgulDnG/+L4W42uxq+kq1S/VGN8a7u/hj6S76x/+aTbs8YlikYG vkW1sPjwEkwI6/Ck X-Google-Smtp-Source: AOwi7QDufWnt3KO7/fyMl/9223l1DwGhSStw31zAMOflEyH8XCvdlJej+HdrURsBmC2/ESGEJmjYrQ== X-Received: by 10.107.18.85 with SMTP id a82mr12781153ioj.251.1505098045424; Sun, 10 Sep 2017 19:47:25 -0700 (PDT) Received: from apteryx ([45.72.233.254]) by smtp.gmail.com with ESMTPSA id e95sm3925497iod.30.2017.09.10.19.47.24 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sun, 10 Sep 2017 19:47:25 -0700 (PDT) From: Maxim Cournoyer References: <87fuc5wsvh.fsf@gmail.com> <871snovl6u.fsf@gnu.org> <8737828tao.fsf@gmail.com> <874lsii145.fsf@gnu.org> Date: Sun, 10 Sep 2017 22:47:24 -0400 In-Reply-To: <874lsii145.fsf@gnu.org> ("Ludovic \=\?utf-8\?Q\?Court\=C3\=A8s\=22'\?\= \=\?utf-8\?Q\?s\?\= message of "Mon, 04 Sep 2017 23:51:22 +0200") Message-ID: <878thm54ub.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -2.3 (--) ludo@gnu.org (Ludovic Court=C3=A8s) writes: > Maxim Cournoyer skribis: > >> ludo@gnu.org (Ludovic Court=C3=A8s) writes: >> >>> Maxim Cournoyer skribis: >>> >>>> sha256 hash mismatch for output path `/gnu/store/jcapi6vk4a14hch5jgsh5= zps958g91sb-exiv2-0.26-trunk.tar.gz' >>>> expected: 1hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc >>>> actual: 1yza317qxd8yshvqnay164imm0ks7cvij8y8j86p1gqi1153qpn7 >>>> >>>> Looking at what happened at the source obtained through the Wayback >>>> Machine at the time it was last updated in Guix[1] compared to now[2],= we see >>>> that: >>> >>> For the record, as an alternative to the Wayback Machine, you can use: >>> >>> wget https://mirror.hydra.gnu.org/file/exiv2-0.26-trunk.tar.gz/sha256= /1hsdzlzgkipprqh93yj81mrckl2l7c2mn2i84691pallnjz5qqhc >> >> Thanks for the tip! I actually tried to find a way to download that file >> from Hydra for the investigation but couldn't figure it out (by using >> the Hydra web front-end). > > This URL is implemented by =E2=80=98guix publish=E2=80=99: > > https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-publis= h.html > > Not very discoverable I admit! > > Ludo=E2=80=99. I just (re)read it. Neat! Thanks for the pointer. Maxim