Opened 5 years ago

Closed 5 years ago

#48268 closed defect (fixed)

curl-ca-bundle @7.43.0: Checksum mismatch for certdata-aa275ad846f1.tar.bz2

Reported by: ph@… Owned by: ryandesign (Ryan Schmidt)
Priority: Normal Milestone:
Component: ports Version: 2.3.3
Keywords: Cc:
Port: curl-ca-bundle

Description

Trying to install gnuplot, the installation failed when installing the dependency curl-ca-bundle. There seems to be a checksums issue. I tried several times, cleaning the installation with

sudo port clean --all curl-ca-bundle

with the same checksum error. Here's the log:

--->  Fetching archive for curl-ca-bundle
--->  Attempting to fetch curl-ca-bundle-7.43.0_0.darwin_9.noarch.tbz2 from http://lil.fr.packages.macports.org/curl-ca-bundle
--->  Attempting to fetch curl-ca-bundle-7.43.0_0.darwin_9.noarch.tbz2 from http://mse.uk.packages.macports.org/sites/packages.macports.org/curl-ca-bundle
--->  Attempting to fetch curl-ca-bundle-7.43.0_0.darwin_9.noarch.tbz2 from http://nue.de.packages.macports.org/macports/packages/curl-ca-bundle
--->  Fetching distfiles for curl-ca-bundle
--->  Attempting to fetch curl-7.43.0.tar.bz2 from http://curl.haxx.se/download/
--->  Attempting to fetch certdata-aa275ad846f1.tar.bz2 from http://hg.mozilla.org/mozilla-central/archive/aa275ad846f1.tar.bz2/security/nss/lib/ckfw/builtins/certdata.txt?dummy=
--->  Verifying checksums for curl-ca-bundle                                                 
Error: Checksum (rmd160) mismatch for certdata-aa275ad846f1.tar.bz2
Error: Checksum (sha256) mismatch for certdata-aa275ad846f1.tar.bz2
Error: org.macports.checksum for port curl-ca-bundle returned: Unable to verify file checksums
Error: Failed to install curl-ca-bundle
Please see the log file for port curl-ca-bundle for details:
    /opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_curl/curl-ca-bundle/main.log

Change History (3)

comment:1 Changed 5 years ago by ph@…

I updated Mozilla Firefox on my computer, then the checksums worked and the installation completed normally.... Dunno if there's a link or not with the Mozilla Firefox update though... Patrice

comment:2 Changed 5 years ago by ryandesign (Ryan Schmidt)

Owner: changed from macports-tickets@… to ryandesign@…
Port: curl-ca-bundle added
Status: newassigned
Summary: Problem verifying checksums for curl-ca-bundlecurl-ca-bundle @7.43.0: Checksum mismatch for certdata-aa275ad846f1.tar.bz2

I can confirm this. The tar.bz2 file the Mozilla server delivers today is different from the one it delivered to us when we originally updated curl-ca-bundle to its current version in r135276 on April 21, 2015. Notably, the tar files inside the two tar.bz2 files are identical, as are the files inside the two identical tar files. I'm not sure why the Mozilla server would be doing different bzip2 compression of its tarballs today than it did in April. But the tarballs are automatically generated, so it's likely they don't keep the generated tarballs around indefinitely, and it's possible that since the last time the tarball was generated, they changed the version of their bzip2 software, or changed the options with which it is invoked, such that the compressed result differs.

The fact that it started working after you updated Firefox can only be a coincidence. It's more likely that when you cleaned and tried again after updating Firefox, MacPorts happened to try to download the file from our mirror servers (which have the old file with the correct checksums) instead of the Mozilla server (which now has the new file with the different checksums).

Last edited 5 years ago by ryandesign (Ryan Schmidt) (previous) (diff)

comment:3 Changed 5 years ago by ryandesign (Ryan Schmidt)

Resolution: fixed
Status: assignedclosed

Temporary workaround committed in r138396.

Note: See TracTickets for help on using tickets.