filebrowser: checksum mismatch

[ryandesign (Ryan Carsten Schmidt)]

​https://build.macports.org/builders/ports-11_arm64-builder/builds/31884/steps/install-port/logs/stdio

--->  Checksumming jtolds-gls-v4.20.0.tar.gz
Portfile checksum: jtolds-gls-v4.20.0.tar.gz rmd160 31d8656bd6c1426338ceaac9535198244248b254
Distfile checksum: jtolds-gls-v4.20.0.tar.gz rmd160 8e721b1aa6de0606caa5a2a038ddd53a0d05d7b4
DEBUG: Calculated (rmd160) is 8e721b1aa6de0606caa5a2a038ddd53a0d05d7b4
Error: Checksum (rmd160) mismatch for jtolds-gls-v4.20.0.tar.gz
Portfile checksum: jtolds-gls-v4.20.0.tar.gz sha256 04069406ca336d355eab62b4ab9e84b820ac968ac1e20bd3777efec2d3843446
Distfile checksum: jtolds-gls-v4.20.0.tar.gz sha256 6f98dcae4c326cbfb0400e6a01604511e544957ea88494e979ace881e2058cbb
DEBUG: Calculated (sha256) is 6f98dcae4c326cbfb0400e6a01604511e544957ea88494e979ace881e2058cbb
Error: Checksum (sha256) mismatch for jtolds-gls-v4.20.0.tar.gz
DEBUG: Calculated (size) is 7308
Error: Checksum (size) mismatch for jtolds-gls-v4.20.0.tar.gz
Portfile checksum: jtolds-gls-v4.20.0.tar.gz size 7305
Distfile checksum: jtolds-gls-v4.20.0.tar.gz size 7308

[i0ntempest]

Don't really know what's going on, it verified fine on all my three machines. Also the go2port script fetches the wrong sums of this package and I had to manually change them.

[i0ntempest]

Weird that only Big Sur arm64 buildbot had this error: ​https://ports.macports.org/port/filebrowser/details/

[ryandesign (Ryan Carsten Schmidt)]

Not weird. The Apple Silicon buildbot worker is not on the same network as the Intel workers. The Intel machines invariably fetch from our private distfiles server on the same network which has the files with the last known-good checksums, however the Apple Silicon machine could well fetch from the original server if that's closer, just as some users might, and you can see from the log that it did indeed fetch directly from github.com not our distfiles mirror. So obviously a stealth-update has occurred. You can easily download ​https://github.com/jtolds/gls/tarball/v4.20.0/jtolds-gls-v4.20.0.tar.gz and ​https://distfiles.macports.org/go/jtolds-gls-v4.20.0.tar.gz and verify that they are different: specifically, the name of the enclosing directory has changed from jtolds-gls-b4936e0 to jtolio-gls-b4936e0 because the project has moved from GitHub user jtolds to GitHub user jtolio. This is why, if you are going to fetch from an automatically-generated GitHub tarball, it is better to use "archive" type rather than "tarball" type because "tarball" type includes the GitHub user name in the directory name whereas "archive" type does not. Looks like this is a defect in the golang-1.0 portgroup since it does not offer a way to receive GitHub "archive" type files, which will of course be difficult to fix since just changing the GitHub download URL in the portgroup would break the checksums of all the ports that use it.

[i0ntempest]

Okay thanks for the explanation, I can update the portfile soon but how am I going to remove the offending tarball in the mirror?

[ryandesign (Ryan Carsten Schmidt)]

It looks like the golang portgroup sets the distname to include the author name, so presumably if you change the author name listed in your portfile then a new file with the new distname will be mirrored. The old distfile will stay on the mirrors until it is removed by a cleanup script, if we ever run one.

[i0ntempest]

In db980cfaa75cab37b498b7864b5eeaebf4bab8eb/macports-ports (master):

filebrowser: checksum fix

Closes: #63700