gig @0.8.3: checksum mismatch

[ryandesign (Ryan Carsten Schmidt)]

​https://build.macports.org/builders/ports-26_arm64-builder/builds/16515/steps/install-port/logs/stdio

--->  smartystreets-assertions-b2de0cb4f26d.tar.gz does not exist in /opt/local/var/macports/distfiles/go
--->  Attempting to fetch smartystreets-assertions-b2de0cb4f26d.tar.gz from https://codeload.github.com/smartystreets/assertions/legacy.tar.gz/b2de0cb4f26d?dummy=

--->  imdario-mergo-v0.3.12.tar.gz does not exist in /opt/local/var/macports/distfiles/go
--->  Attempting to fetch imdario-mergo-v0.3.12.tar.gz from https://codeload.github.com/imdario/mergo/legacy.tar.gz/v0.3.12?dummy=

--->  Checksumming smartystreets-assertions-b2de0cb4f26d.tar.gz
DEBUG: Calculated (rmd160) is 59a3d1fabff343e90465049f976996f6c306a582
Error: Checksum (rmd160) mismatch for smartystreets-assertions-b2de0cb4f26d.tar.gz
Portfile checksum: smartystreets-assertions-b2de0cb4f26d.tar.gz rmd160 32d7082172ea8c4a03119f3ffb803f8aad9744ce
Distfile checksum: smartystreets-assertions-b2de0cb4f26d.tar.gz rmd160 59a3d1fabff343e90465049f976996f6c306a582
DEBUG: Calculated (sha256) is bf4819ccb9021d83e9b33e374f18d5bb752072b35b14ef800dded3c3a5dd4b02
Error: Checksum (sha256) mismatch for smartystreets-assertions-b2de0cb4f26d.tar.gz
Portfile checksum: smartystreets-assertions-b2de0cb4f26d.tar.gz sha256 469875871db96f87e62f76f0bfc4b3b0b9e4761c2a14d4ce12f246797a7c342c
Distfile checksum: smartystreets-assertions-b2de0cb4f26d.tar.gz sha256 bf4819ccb9021d83e9b33e374f18d5bb752072b35b14ef800dded3c3a5dd4b02
DEBUG: Calculated (size) is 52210
Error: Checksum (size) mismatch for smartystreets-assertions-b2de0cb4f26d.tar.gz
Portfile checksum: smartystreets-assertions-b2de0cb4f26d.tar.gz size 52177
Distfile checksum: smartystreets-assertions-b2de0cb4f26d.tar.gz size 52210

--->  Checksumming imdario-mergo-v0.3.12.tar.gz
DEBUG: Calculated (rmd160) is 92146df5e8cd63505a96de7ae6acb66051afd211
Error: Checksum (rmd160) mismatch for imdario-mergo-v0.3.12.tar.gz
Portfile checksum: imdario-mergo-v0.3.12.tar.gz rmd160 44dbd1f58fd9ea7697f302c86f110ab796b5a041
Distfile checksum: imdario-mergo-v0.3.12.tar.gz rmd160 92146df5e8cd63505a96de7ae6acb66051afd211
DEBUG: Calculated (sha256) is b9d17589da0e392f6da103b4b4007f53dad384f26cd9468b602c02cec717f2b2
Error: Checksum (sha256) mismatch for imdario-mergo-v0.3.12.tar.gz
Portfile checksum: imdario-mergo-v0.3.12.tar.gz sha256 dadb5b52d2de5fe7336eda4c331eefb0d4be716a5844cc7ab15c96b9b6e07b2d
Distfile checksum: imdario-mergo-v0.3.12.tar.gz sha256 b9d17589da0e392f6da103b4b4007f53dad384f26cd9468b602c02cec717f2b2
DEBUG: Calculated (size) is 22341
DEBUG: Correct (size) checksum for imdario-mergo-v0.3.12.tar.gz

because ​http://github.com/smartystreets/assertions has changed to ​https://github.com/smarty/assertions

and ​http://github.com/imdario/mergo is now ​https://github.com/darccio/mergo

and this port is using the old "tarball" type for downloading.

[jrjsmrtn]

Root cause: smartystreets/assertions was renamed to smarty/assertions. GitHub embeds the repository name in the top-level directory of the tarball it generates, so smartystreets-assertions-b2de0cb/ became smarty-assertions-b2de0cb/ and every byte after it differs.

The commit is unaffected: b2de0cb4f26d still resolves, and the extracted tarball is byte-identical to a checkout of it. Only the recorded checksums are stale.

recorded  rmd160 32d7082172ea8c4a03119f3ffb803f8aad9744ce
          sha256 469875871db96f87e62f76f0bfc4b3b0b9e4761c2a14d4ce12f246797a7c342c
          size   52177
served    rmd160 59a3d1fabff343e90465049f976996f6c306a582
          sha256 bf4819ccb9021d83e9b33e374f18d5bb752072b35b14ef800dded3c3a5dd4b02
          size   52210

distfiles.macports.org serves the new tarball as well, so no copy of the original survives and the fetch cannot succeed anywhere.

This is wider than gig. Eight ports still carry the stale checksums:

devel/gig         devel/mos        devel/mos-devel   devel/gomodctl
net/ec2-ls-hosts  sysutils/leaf    sysutils/chaakoo  sysutils/kubeval

net/trojan-go hit the same thing and was corrected in 64bfe50e74e, without the others being swept.