checksum phase sometimes skipped!

[ryandesign (Ryan Carsten Schmidt)]

The checksum phase is sometimes skipped, allowing the extract, configure, build, etc. phases to complete even though the checksums have never been checked and maybe don't match. Clearly this is bad. The revision that introduced this problem is r35806.

The incorrect behavior can be triggered by explicitly requesting the fetch phase, then proceeding to another later phase without cleaning the work area. To test the issue, go to a port's directory (for example the zlib port) and make its checksum invalid (e.g. set its checksum to "x") and do this:

sudo port clean --work && sudo port fetch && sudo port checksum

The correct behavior (which is seen before r35806) is:

--->  Cleaning zlib
--->  Fetching zlib
--->  Verifying checksum(s) for zlib
Error: Checksum (md5) mismatch for zlib-1.2.3.tar.bz2
Error: Checksum (sha1) mismatch for zlib-1.2.3.tar.bz2
Error: Checksum (rmd160) mismatch for zlib-1.2.3.tar.bz2
Error: Target org.macports.checksum returned: Unable to verify file checksums
Error: Status 1 encountered during processing.

The incorrect behavior (seen in r35806 and after) is:

--->  Cleaning zlib
--->  Fetching zlib
--->  Verifying checksum(s) for zlib

Priority is high because this is a regression and a potential security issue.

[jmroot (Joshua Root)]

Should be fine to simply revert that change, since IIRC it was obsoleted by r35808.

[raimue (Rainer Müller)]

I can reproduce the issue. checksum needs the global variable all_dist_files which is populated in the proc checkfiles in the fetch phase.

I reverted this change in r36734, the ping feature still works.

[raimue (Rainer Müller)]

Ah, I forgot: Thanks Ryan for reporting the issue and nailing it down to this revision!

[tobypeterson]

Milestone MacPorts base bugs deleted