GNU bug report logs - #58561
Source hash mismatch with aggregator + possible guix bug with hashes.

Previous Next

Full log

Message #23 received at 58561 <at> debbugs.gnu.org (full text, mbox):

From: zimoun <zimon.toutoune <at> gmail.com>
To: mail <at> brendan.scot, 58561 <at> debbugs.gnu.org
Cc: phodina <phodina <at> protonmail.com>, Marius Bakke <marius <at> gnu.org>
Subject: Re: bug#58561: Source hash mismatch with aggregator + possible guix
 bug with hashes.
Date: Mon, 17 Oct 2022 10:44:33 +0200

Hi,

I am also confused.

On dim., 16 oct. 2022 at 14:42, Brendan Tildesley <mail <at> brendan.scot> wrote:

> sha256 hash mismatch for 
> /gnu/store/iv6ixlrvh0swq22fjal0cbfbr9ayaq7m-akregator-22.04.3.tar.xz:
>    expected hash: 1yy5c29zxpli4cddknmdvjkgii3j7pvw6lhwqfrqjc8jh83gm8f8
>    actual hash: 08n713271i7ifnbrgwrqmxvcpvj45wfqjiidw8zf9rpwxg2m2m9g
>
>
> However what concerned me more is that when I look in the source code it 
> looks like this:
>
> (sha256
>          (base32 "9yy5c29zxpli4cddknmdvjkgii3j7pvw6lhwqfrqjc8jh83gm8f8"))
>
> Notice how at the start its a '9', not a '1'?


Indeed, commit 6971feca53a19d60fdd2b39fb2a8966ccf1d6598 pushed on
core-updates reads,

--8<---------------cut here---------------start------------->8---
 (define-public akregator
   (package
     (name "akregator")
-    (version "21.12.3")
+    (version "22.04.3")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "mirror://kde/stable/release-service/" version
                            "/src/akregator-" version ".tar.xz"))
        (sha256
-        (base32 "1yy5c29zxpli4cddknmdvjkgii3j7pvw6lhwqfrqjc8jh83gm8f8"))))
+        (base32 "9yy5c29zxpli4cddknmdvjkgii3j7pvw6lhwqfrqjc8jh83gm8f8"))))
     (build-system qt-build-system)
--8<---------------cut here---------------end--------------->8---

> Is there a bug with how guix is reading/writing sha256 hashes?

Is it a mistake here?  A human-typo replacing ’1’ by ’9’?  Or
something else?  Petr?


Then, indeed KDE did a in-place replacement since the hash is now,

--8<---------------cut here---------------start------------->8---
$ guix download https://mirrors.xtom.de/kde/stable/release-service/22.04.3/src/akregator-22.04.3.tar.xz

Starting download of /tmp/guix-file.JTZn04
From https://mirrors.xtom.de/kde/stable/release-service/22.04.3/src/akregator-22.04.3.tar.xz...
 ….04.3.tar.xz  2.2MiB                                                            22.2MiB/s 00:00 [##################] 100.0%
/gnu/store/w4jqrza9ffsflim5ilwq7jr75rxicn1g-akregator-22.04.3.tar.xz
08n713271i7ifnbrgwrqmxvcpvj45wfqjiidw8zf9rpwxg2m2m9g
--8<---------------cut here---------------end--------------->8---

as submitted in patch#57608 [1].

1: <https://issues.guix.gnu.org/57608#1>


Cheers,
simon

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.