GNU bug report logs - #47474
fossil: hash mismatch

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 47474 in the body.
You can then email your comments to 47474 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: zimoun <zimon.toutoune <at> gmail.com>
To: Bug Guix <bug-guix <at> gnu.org>
Subject: fossil: hash mismatch
Date: Mon, 29 Mar 2021 17:33:31 +0200

Hi,

Using Guix 55685e4, I get:

--8<---------------cut here---------------start------------->8---
$ guix build -S --no-substitutes fossil
The following derivations will be built:
   /gnu/store/0cb20s9w8l8jg7i1dnw2xw0j197cbhxq-fossil-src-2.11.tar.xz.drv
   /gnu/store/l6wr7qb60ahg4kslajr3rqk3limhvs0a-fossil-src-2.11.tar.gz.drv
building /gnu/store/l6wr7qb60ahg4kslajr3rqk3limhvs0a-fossil-src-2.11.tar.gz.drv...

Starting download of
/gnu/store/pb5jmi9zalg6xylzsjmrskwxs0kar97l-fossil-src-2.11.tar.gz
From https://www.fossil-scm.org/index.html/uv/fossil-src-2.11.tar.gz...
following redirection to
`https://fossil-scm.org/home/uv/fossil-src-2.11.tar.gz'...
downloading from
https://www.fossil-scm.org/index.html/uv/fossil-src-2.11.tar.gz ...

sha256 hash mismatch for
/gnu/store/pb5jmi9zalg6xylzsjmrskwxs0kar97l-fossil-src-2.11.tar.gz:
  expected hash: 0c9nzx42wxfmym9vf1pnbdb1c7gp7a7zqky60izxsph7w2xh8nix
  actual hash:   0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73
hash mismatch for store item
'/gnu/store/pb5jmi9zalg6xylzsjmrskwxs0kar97l-fossil-src-2.11.tar.gz'
build of /gnu/store/l6wr7qb60ahg4kslajr3rqk3limhvs0a-fossil-src-2.11.tar.gz.drv
failed
View build log at
'/var/log/guix/drvs/l6/wr7qb60ahg4kslajr3rqk3limhvs0a-fossil-src-2.11.tar.gz.drv.bz2'.
cannot build derivation
`/gnu/store/0cb20s9w8l8jg7i1dnw2xw0j197cbhxq-fossil-src-2.11.tar.xz.drv':
1 dependencies couldn't be built
guix build: error: build of
`/gnu/store/0cb20s9w8l8jg7i1dnw2xw0j197cbhxq-fossil-src-2.11.tar.xz.drv'
failed
--8<---------------cut here---------------end--------------->8---


It is probably an upstream in-place replacement.

All the best,
simon

Message #12 received at 47474-done <at> debbugs.gnu.org (full text, mbox):

From: phodina <phodina <at> protonmail.com>
To: "47474-done <at> debbugs.gnu.org" <47474-done <at> debbugs.gnu.org>
Subject: RE: fossil: hash mismatch
Date: Thu, 04 Nov 2021 21:46:36 +0000

Hi,

the checksum was corrected by Tobias Geerinckx-Rice in commit 20771f4043990632b73187b10d1851a1244df4e6 as well as the pkg was updated from 2.10 -> 2.11.

Petr

Message #17 received at 47474 <at> debbugs.gnu.org (full text, mbox):

From: zimoun <zimon.toutoune <at> gmail.com>
To: phodina <phodina <at> protonmail.com>, <47474 <at> debbugs.gnu.org>
Subject: Re: bug#47474: fossil: hash mismatch
Date: Mon, 08 Nov 2021 12:06:44 +0100

Hi,

On Thu, 04 Nov 2021 at 21:46, phodina via Bug reports for GNU Guix <bug-guix <at> gnu.org> wrote:

> the checksum was corrected by Tobias Geerinckx-Rice in commit
> 20771f4043990632b73187b10d1851a1244df4e6 as well as the pkg was
> updated from 2.10 -> 2.11.

Indeed, when looking forward. :-)

However, in the context of Disarchive and long-term, it is seems
relevant to keep it still open; as example to test “guix time-machine”
and various fallbacks, IMHO.


Cheers,
simon

Message #20 received at 47474 <at> debbugs.gnu.org (full text, mbox):

From: Jack Hill <jackhill <at> jackhill.us>
To: zimoun <zimon.toutoune <at> gmail.com>
Cc: 47474 <at> debbugs.gnu.org, phodina <phodina <at> protonmail.com>
Subject: Re: bug#47474: fossil: hash mismatch
Date: Tue, 5 Jul 2022 10:55:03 -0400 (EDT)

[Message part 1 (text/plain, inline)]

On Mon, 8 Nov 2021, zimoun wrote:

> Indeed, when looking forward. :-)
>
> However, in the context of Disarchive and long-term, it is seems
> relevant to keep it still open; as example to test “guix time-machine”
> and various fallbacks, IMHO.

I'm also curious to know to fill in the archive for old versions. I guess 
the first step would be to preserve the tarballs with the original hashes. 
Does anyone have them? I notice that this happened again with 2.17:

downloading from https://www.fossil-scm.org/home/tarball/f48180f2ff3169651a725396d4f7d667c99a92873b9c3df7eee2f144be7a0721/fossil-src-2.17.tar.gz ...
 fossil-src-2.17.tar.gz  6.0MiB                                                           4.0MiB/s 00:02 [##################] 100.0%
sha256 hash mismatch for /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz:
  expected hash: 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
  actual hash:   18q5rc1d9d2zvrvsas5h419dv525ig9lyqswrx7bcl38zbjxics4

Looking forward:

I have asked upstream how we might avoid this problem: 
https://fossil-scm.org/forum/forumpost/4903c3fcc1

We'll see what they say.

Some other ideas in the meantime:

1) Develop a fossil-fetch that can be used like git-fetch to download from 
the source code repository directly.

2) Use git-fetch with the git-mirror. This would allow us to make use of 
our current git integration with Software Heritage.

Best,
Jack

Message #23 received at 47474 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludovic.courtes <at> inria.fr>
To: Jack Hill <jackhill <at> jackhill.us>
Cc: 47474 <at> debbugs.gnu.org, phodina <phodina <at> protonmail.com>,
 zimoun <zimon.toutoune <at> gmail.com>
Subject: Re: bug#47474: fossil: hash mismatch
Date: Tue, 05 Jul 2022 17:27:40 +0200

Hi!

Jack Hill <jackhill <at> jackhill.us> skribis:

> I'm also curious to know to fill in the archive for old versions. I
> guess the first step would be to preserve the tarballs with the
> original hashes. Does anyone have them? I notice that this happened
> again with 2.17:
>
> downloading from https://www.fossil-scm.org/home/tarball/f48180f2ff3169651a725396d4f7d667c99a92873b9c3df7eee2f144be7a0721/fossil-src-2.17.tar.gz ...
>  fossil-src-2.17.tar.gz  6.0MiB                                                           4.0MiB/s 00:02 [##################] 100.0%
> sha256 hash mismatch for /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz:
>   expected hash: 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
>   actual hash:   18q5rc1d9d2zvrvsas5h419dv525ig9lyqswrx7bcl38zbjxics4

I got a substitute for the tarball:

--8<---------------cut here---------------start------------->8---
$ guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv"
6.3 MB will be downloaded:
  /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz
substituting /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz...
downloading from https://ci.guix.gnu.org/nar/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz ...
 fossil-src-2.17.tar.gz  6.0MiB                                                                     16.3MiB/s 00:00 [##################] 100.0%

/gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz
$ guix hash $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")
1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
--8<---------------cut here---------------end--------------->8---

Alternatively, we can get it via the content-addressed endpoint:

--8<---------------cut here---------------start------------->8---
$ wget -qO- https://ci.guix.gnu.org/file/fossil-src-2.17.tar.gz/sha256/1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw |guix hash -
1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
--8<---------------cut here---------------end--------------->8---

Last, Disarchive tarball metadata is available:

--8<---------------cut here---------------start------------->8---
$ wget -qO- https://disarchive.guix.gnu.org/sha256/$(guix hash -f hex $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")) |head
(disarchive
  (version 0)
  (gzip-member
    (name "fossil-src-2.17.tar.gz")
    (digest
      (sha256
        "5c7f1c73f7b5e2af24e10e40f0e07391909c1230b9e284a9d548059e7f377dbf"))
    (header
      (mtime 1633790590)
      (extra-flags 2)
$ wget -qO- https://disarchive.guix.gnu.org/sha256/$(guix hash -f hex $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")) |grep swhid
                        (swhid "swh:1:dir:1d10cd5c9e0afaf7c95fa87cd50d4b6b13e6c6c9"))
--8<---------------cut here---------------end--------------->8---

… and tarball content is in Software Heritage:

  https://archive.softwareheritage.org/browse/directory/1d10cd5c9e0afaf7c95fa87cd50d4b6b13e6c6c9/

So we’re doing OK: it’s definitely archived and won’t ever vanish!  :-)

Ludo’.

Message #26 received at 47474 <at> debbugs.gnu.org (full text, mbox):

From: Jack Hill <jackhill <at> jackhill.us>
To: Ludovic Courtès <ludovic.courtes <at> inria.fr>
Cc: 47474 <at> debbugs.gnu.org, phodina <phodina <at> protonmail.com>,
 zimoun <zimon.toutoune <at> gmail.com>
Subject: Re: bug#47474: fossil: hash mismatch
Date: Tue, 5 Jul 2022 11:45:14 -0400 (EDT)

[Message part 1 (text/plain, inline)]

On Tue, 5 Jul 2022, Ludovic Courtès wrote:

> Hi!
>
> Jack Hill <jackhill <at> jackhill.us> skribis:
>
>> I'm also curious to know to fill in the archive for old versions. I
>> guess the first step would be to preserve the tarballs with the
>> original hashes. Does anyone have them? I notice that this happened
>> again with 2.17:
>>
>> downloading from https://www.fossil-scm.org/home/tarball/f48180f2ff3169651a725396d4f7d667c99a92873b9c3df7eee2f144be7a0721/fossil-src-2.17.tar.gz ...
>>  fossil-src-2.17.tar.gz  6.0MiB                                                           4.0MiB/s 00:02 [##################] 100.0%
>> sha256 hash mismatch for /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz:
>>   expected hash: 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
>>   actual hash:   18q5rc1d9d2zvrvsas5h419dv525ig9lyqswrx7bcl38zbjxics4
>
> I got a substitute for the tarball:
>
> --8<---------------cut here---------------start------------->8---
> $ guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv"
> 6.3 MB will be downloaded:
>  /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz
> substituting /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz...
> downloading from https://ci.guix.gnu.org/nar/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz ...
> fossil-src-2.17.tar.gz  6.0MiB                                                                     16.3MiB/s 00:00 [##################] 100.0%
>
> /gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz
> $ guix hash $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")
> 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
> --8<---------------cut here---------------end--------------->8---
>
> Alternatively, we can get it via the content-addressed endpoint:
>
> --8<---------------cut here---------------start------------->8---
> $ wget -qO- https://ci.guix.gnu.org/file/fossil-src-2.17.tar.gz/sha256/1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw |guix hash -
> 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
> --8<---------------cut here---------------end--------------->8---
>
> Last, Disarchive tarball metadata is available:
>
> --8<---------------cut here---------------start------------->8---
> $ wget -qO- https://disarchive.guix.gnu.org/sha256/$(guix hash -f hex $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")) |head
> (disarchive
>  (version 0)
>  (gzip-member
>    (name "fossil-src-2.17.tar.gz")
>    (digest
>      (sha256
>        "5c7f1c73f7b5e2af24e10e40f0e07391909c1230b9e284a9d548059e7f377dbf"))
>    (header
>      (mtime 1633790590)
>      (extra-flags 2)
> $ wget -qO- https://disarchive.guix.gnu.org/sha256/$(guix hash -f hex $(guix build "/gnu/store/svcwny2aw005mgyz7fsnm8m7v612q9d4-fossil-src-2.17.tar.gz.drv")) |grep swhid
>                        (swhid "swh:1:dir:1d10cd5c9e0afaf7c95fa87cd50d4b6b13e6c6c9"))
> --8<---------------cut here---------------end--------------->8---
>
> … and tarball content is in Software Heritage:
>
>  https://archive.softwareheritage.org/browse/directory/1d10cd5c9e0afaf7c95fa87cd50d4b6b13e6c6c9/
>
> So we’re doing OK: it’s definitely archived and won’t ever vanish!  :-)
>
> Ludo’.

That's great!

I guess I ran into this because I was using `guix build` with 
`--no-substitutes`. Is it expected that we don't fallback to disarchive 
and Software Heritage in that case? If so, I guess my problem was an 
operator error. Can we close this ticket then, or are we still missing the 
tarballs for the older releases?

Best,
Jack

Message #29 received at 47474 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludovic.courtes <at> inria.fr>
To: Jack Hill <jackhill <at> jackhill.us>
Cc: 47474 <at> debbugs.gnu.org, phodina <phodina <at> protonmail.com>,
 zimoun <zimon.toutoune <at> gmail.com>
Subject: Re: bug#47474: fossil: hash mismatch
Date: Tue, 05 Jul 2022 17:49:40 +0200

Hi!

Jack Hill <jackhill <at> jackhill.us> skribis:

> I guess I ran into this because I was using `guix build` with
> `--no-substitutes`. Is it expected that we don't fallback to
> disarchive and Software Heritage in that case?

Yes, and that’s actually suboptimal:

  https://issues.guix.gnu.org/28659

> If so, I guess my problem was an operator error. Can we close this
> ticket then, or are we still missing the tarballs for the older
> releases?

We would need to check whether older releases are available.  Disarchive
is relatively recent so they’re likely to be missing there, but Timothy
Sample has a Disarchive database that goes several years back, unlike
disarchive.guix.gnu.org.  Worth checking!

Anyhow, I think this issue can be closed.

Ludo’.

Message #34 received at 47474-done <at> debbugs.gnu.org (full text, mbox):

From: zimoun <zimon.toutoune <at> gmail.com>
To: Ludovic Courtès <ludovic.courtes <at> inria.fr>
Cc: Jack Hill <jackhill <at> jackhill.us>, 47474-done <at> debbugs.gnu.org,
 phodina <phodina <at> protonmail.com>
Subject: Re: bug#47474: fossil: hash mismatch
Date: Tue, 05 Jul 2022 18:50:35 +0200

Hi,

Thanks Jack for the follow up. :-)

On Tue, 05 Jul 2022 at 17:49, Ludovic Courtès <ludovic.courtes <at> inria.fr> wrote:

> We would need to check whether older releases are available.  Disarchive
> is relatively recent so they’re likely to be missing there, but Timothy
> Sample has a Disarchive database that goes several years back, unlike
> disarchive.guix.gnu.org.  Worth checking!

I guess the Timothy’s database starts on 2019-05-05 which is v1.0.  The
last coverage is from Jan 2022.

<https://ngyro.com/pog-reports/latest/>


> Anyhow, I think this issue can be closed.

Done.


Cheers,
simon

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.