Subject: [alpine-devel] abuildhelper question

From: Dubiousjim <[email-masked]>
Date: Wed, 3 Jul 2013 10:24:53 -0400

When I fetch and verify abuildhelper from inside my current aports tree, it fails
the checksum. Can anyone else reproduce? Sometimes I've had this issue
in the past and the cause turned out to be some local filesystem thing.

The file in question is at
http://git.alpinelinux.org/cgit/nenolod/abuildhelper.git/snapshot/abuildhelper-0.0.1.tar.bz2

The APKBUILD expects md5sum:
md5sums="136616a15c5e63360a3c871d8de773c2  abuildhelper-0.0.1.tar.bz2"

In fact I'm getting:
228f62315ab107b16c974ed9487236e8  abuildhelper-0.0.1.tar.bz2

-- 
Dubiousjim
[email-masked]

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Natanael Copa <[email-masked]>
Date: Wed, 3 Jul 2013 19:54:22 +0200

On Wed, 3 Jul 2013 10:24:53 -0400

> 228f62315ab107b16c974ed9487236e8  abuildhelper-0.0.1.tar.bz2

yes, it is because the tarball is generated on the fly. I upgraded cgit
not too long ago and something has changed in the way the tarball is
generated so the checksum no longer match.

same thing applies to all packages that has on-the-fly generated
tarballs from git.a.o/cgit (acf-*)

option 1:
we update the checksums on all affected aports (not funny because it
affects all stable apkbuilds). This could be done slowly, when we bump
into issue.

option 2:
we roll back cgit (and try backport the sec fixes. This was strongly
not recommended by cgit maintainer) or try fix it so it behaves
identical as previous.

option 3:
we add a git hook that will generate a tarball and store it
in /archives/$package/ when new tags are found. (we already do this for
apk-tools)

-nc

---

---

From: Dubiousjim <[email-masked]>
Date: Wed, 3 Jul 2013 20:42:15 -0400

> in /archives/$package/ when new tags are found. (we already do this for

Good to know about this. Perhaps you announced it before, but I hadn't
noticed it until now. Yeah, that's messy. A quick scan looks like 49
acf-* packages and 22 others are subject to this.

-- 
Dubiousjim
[email-masked]

---

---

From: Natanael Copa <[email-masked]>
Date: Thu, 4 Jul 2013 11:48:18 +0200

On Wed, 3 Jul 2013 20:42:15 -0400

> acf-* packages and 22 others are subject to this.

it doesnt make it easier that the build servers has the archives
cached... oh wait

maybe we should copy the archives in cache to /archive. then can source
url be changed without checksum changing. that woudl be acceptable for
stable branches too.

-nc

---