cdf @3.4.1_1 checksum error - another stealth upgrade

[p-bro]

Probably another stealth upgrade of the cdf package causes install/upgrade to fail with a checksum error:

sudo port -v install cdf
--->  Computing dependencies for cdf.
--->  Fetching archive for cdf
--->  cdf-3.4.1_1+gcc45.darwin_11.x86_64.tbz2 doesn't seem to exist in /opt/local/var/macports/incoming/verified
--->  Attempting to fetch cdf-3.4.1_1+gcc45.darwin_11.x86_64.tbz2 from http://packages.macports.org/cdf
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
--->  Fetching distfiles for cdf
--->  cdf34_1-dist-all.tar.gz doesn't seem to exist in /opt/local/var/macports/distfiles/cdf/3.4.1_1
--->  Attempting to fetch cdf34_1-dist-all.tar.gz from ftp://cdaweb.gsfc.nasa.gov/pub/cdf/dist/cdf34_1/unix
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 1718k  100 1718k    0     0   721k      0  0:00:02  0:00:02 --:--:--  737k
--->  Verifying checksum(s) for cdf
--->  Checksumming cdf34_1-dist-all.tar.gz
Error: Checksum (rmd160) mismatch for cdf34_1-dist-all.tar.gz
Portfile checksum: cdf34_1-dist-all.tar.gz rmd160 e6783d91886bc99869f1e01eba80f22cf70a07d3
Distfile checksum: cdf34_1-dist-all.tar.gz rmd160 abae16c2f60df98754345f1bdda6c8b59aff84d9
Error: Checksum (sha256) mismatch for cdf34_1-dist-all.tar.gz
Portfile checksum: cdf34_1-dist-all.tar.gz sha256 460b56dd82b900c0b2893c61240ffd83d875457c99de3ebf4e2ad222157625f4
Distfile checksum: cdf34_1-dist-all.tar.gz sha256 6bbbb63ca7f5a44e890cd01f51ace818a1f956cfe95bbbcc572b138181ac7cee
The correct checksum line may be:
checksums           rmd160  abae16c2f60df98754345f1bdda6c8b59aff84d9 \
                    sha256  6bbbb63ca7f5a44e890cd01f51ace818a1f956cfe95bbbcc572b138181ac7cee
Error: org.macports.checksum for port cdf returned: Unable to verify file checksums
Warning: targets not executed for cdf: org.macports.activate \
  org.macports.checksum org.macports.extract org.macports.patch \
  org.macports.configure org.macports.build org.macports.destroot \
  org.macports.install
Please see the log file for port cdf for details:
    /opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_science_cdf/cdf/main.log
To report a bug, follow the instructions in the guide:
    http://guide.macports.org/#project.tickets
Error: Processing of port cdf failed

Unfortunately I no longer have the old tarball to compare to, but the downloaded tarball looks like a proper archive of cdf, and the MD5 checksum agrees with the one ​published on the ​cdf FTP server. The files on the cdf FTP server were last modified 2012-07-02, and the following files in the tar ball have a modification date later than the 3.4.1_1 macports version:

-rw-r--r--@ 1 563403 27 Jun 16:49 ./cdfjava/cdftools/CDFToolsDriver.jar
-rw-r--r--@ 1  82309  2 Jul 10:46 ./cdfjava/classes/cdfjava.jar
-rw-r--r--@ 1  14643  2 Jul 10:49 ./cdfjava/examples/CreateCDF.class
-rw-r--r--@ 1  13442  2 Jul 10:49 ./cdfjava/examples/ReadCDF.class
-rw-r--r--@ 1    404  2 Jul 11:03 ./cdfjava/examples/YYY.cdf
-rw-r--r--@ 1  24400  2 Jul 11:03 ./cdfjava/examples/test.cdf
-rw-r--r--@ 1   3722  2 Jul 11:03 ./cdfjava/examples/test1.cdf 

[ryandesign (Ryan Carsten Schmidt)]

Agreed, a stealth update has occurred July 2. Here's the difference between the old file (which you can get from the ​MacPorts distfiles server) and the new one:

$ diff -ru 3.4.1_{1,2}/cdf34_1-dist
Binary files 3.4.1_1/cdf34_1-dist/cdfjava/classes/cdfjava.jar and 3.4.1_2/cdf34_1-dist/cdfjava/classes/cdfjava.jar differ
Only in 3.4.1_2/cdf34_1-dist/cdfjava/examples: YYY.cdf

Since neither of these files get installed we don't need to increase the port revision.

[ryandesign (Ryan Carsten Schmidt)]

r95565