GNU bug report logs - #37437
hash mismatch for emacs-elixir-mode

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 37437 in the body.
You can then email your comments to 37437 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Josh Holland <josh <at> inv.alid.pw>
To: bug-guix <bug-guix <at> gnu.org>
Subject: hash mismatch for emacs-elixir-mode
Date: Tue, 17 Sep 2019 11:33:48 +0100

Hi, I just did the following:

$ guix install emacs-elixir-mode
substitute: updating substitutes from 'https://ci.guix.gnu.org'... 100.0%
substitute: updating substitutes from 'https://ci.guix.gnu.org'... 100.0%
downloading from https://ci.guix.gnu.org/nar/gzip/7n24v62aw8sjlrs06gbz4zvj11zvryry-emacs-epl-0.8...
 emacs-epl-0.8  24KiB                                2.6MiB/s 00:00 [##################] 100.0%

downloading from https://ci.guix.gnu.org/nar/gzip/152p023jxd5cf5lr87wighihp92pkal6-emacs-pkg-info-0.6...
 emacs-pkg-info-0.6  17KiB                           3.1MiB/s 00:00 [##################] 100.0%

building /gnu/store/b91172xfzkscfd9627d0ysrdjgpbxs6z-elixir-mode-2.3.1.tar.drv...
downloading from https://stable.melpa.org/packages/elixir-mode-2.3.1.tar...
\sha256 hash mismatch for /gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar:
  expected hash: 091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v
  actual hash:   13d5r64rqskdapnrbbxv0h91gn77c6af5kjjrg5mpphvl887s04c
hash mismatch for store item '/gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar'
build of /gnu/store/b91172xfzkscfd9627d0ysrdjgpbxs6z-elixir-mode-2.3.1.tar.drv failed
View build log at '/var/log/guix/drvs/b9/1172xfzkscfd9627d0ysrdjgpbxs6z-elixir-mode-2.3.1.tar.drv.bz2'.
cannot build derivation `/gnu/store/xqdxvb7xy4ydpwkqgp3jd985qb4vw8k2-emacs-elixir-mode-2.3.1.drv': 1 dependencies couldn't be built
guix install: error: build of `/gnu/store/xqdxvb7xy4ydpwkqgp3jd985qb4vw8k2-emacs-elixir-mode-2.3.1.drv' failed

Is something nefarious going on, or have upstream just changed their
tarballs?

Thanks,

--
Josh Holland

Message #8 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Tobias Geerinckx-Rice <me <at> tobias.gr>
To: bug-guix <at> gnu.org
Cc: 37437 <at> debbugs.gnu.org
Subject: Re: bug#37437: hash mismatch for emacs-elixir-mode
Date: Tue, 17 Sep 2019 13:59:34 +0200

[Message part 1 (text/plain, inline)]

Josh,

Thanks for the report!

Josh Holland 写道：
> \sha256 hash mismatch for 
> /gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar:
>   expected hash: 
>   091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v
>   actual hash: 
>   13d5r64rqskdapnrbbxv0h91gn77c6af5kjjrg5mpphvl887s04c

It's already changed again:

downloading from 
https://stable.melpa.org/packages/elixir-mode-2.3.1.tar...
elixir-mode-2.3.1.tar  60KiB 
359KiB/s 00:00 [##################] 100.0%
sha256 hash mismatch for 
/gnu/store/bb5m97pbmzvwlvn8wmrdfgpvnl0k8r1m-elixir-mode-2.3.1.tar:
 expected hash: 
 091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v
 actual hash: 
 1c4xp9dqnbndrn82qhvv2ix9fvh7abcbmbajiknjfrz2mf9pwxid

I can check my substitute server tomorrow for the ‘original’ 
(091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v) tarball if 
nobody else has a copy.  Guix servers don't seem to.

> Is something nefarious going on, or have upstream just changed 
> their
> tarballs?

If someone is trying something sneaky, they're making an 
incompetent amount of noise about it.

Looks like upstream's just gone a bit timestamp-crazy, judging 
from the small handful of (very recently) mirrored tarballs I 
could find:

/gnu/store/26akldw7c2y6fparfixycdb0lhds8ddj-elixir-mode-2.3.1.tar
 hash: 0jaxy4r7qyl63n9plinz8wc42ywr6sqy4d0p8ma7a1v0svi5cyfx
 https://elpa.emacs-china.org/melpa-stable/elixir-mode-2.3.1.tar
 https://mirrors.nju.edu.cn/elpa/melpa-stable/elixir-mode-2.3.1.tar
/gnu/store/6dh3amvmd4b6rxx995w4zmc582flbfhj-elixir-mode-2.3.1.tar
 hash: 05wdspd43b413x4x2wx1wa8xbasp9rprq3wy5hrai1w72bnpfamc
 http://mirrors.zju.edu.cn/elpa/melpa-stable/elixir-mode-2.3.1.tar
/gnu/store/443bcaq7g5787l0qx76myx7pv2mm8apc-elixir-mode-2.3.1.tar
 hash: 1c4xp9dqnbndrn82qhvv2ix9fvh7abcbmbajiknjfrz2mf9pwxid
 https://stable.melpa.org/packages/elixir-mode-2.3.1.tar
 [the current canonical upstream tarball, I guess, mentioned 
 above]

which differ[0] only in metadata:

$ diffoscope all_the_things
--- 
   /gnu/store/26akldw7c2y6fparfixycdb0lhds8ddj-elixir-mode-2.3.1.tar
### 
   /gnu/store/6dh3amvmd4b6rxx995w4zmc582flbfhj-elixir-mode-2.3.1.tar
+++ 
/gnu/store/443bcaq7g5787l0qx76myx7pv2mm8apc-elixir-mode-2.3.1.tar
├── file list
│ @@ -1,4 +1,4 @@
│ -drwxr-xr-x   0 root         (0) root         (0)        0 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/
│ --rw-r--r--   0 root         (0) root         (0)    20892 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-mode.el
│ --rw-r--r--   0 root         (0) root         (0)    30321 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-smie.el
│ --rw-r--r--   0 root         (0) root         (0)      257 
2019-09-17 06:17:34.000000 elixir-mode-2.3.1/elixir-mode-pkg.el
│ #drwxr-xr-x   0 root         (0) root         (0)        0 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/
│ #-rw-r--r--   0 root         (0) root         (0)    20892 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-mode.el
│ #-rw-r--r--   0 root         (0) root         (0)    30321 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-smie.el
│ #-rw-r--r--   0 root         (0) root         (0)      257 
2019-09-17 03:49:10.000000 elixir-mode-2.3.1/elixir-mode-pkg.el
│ +drwxr-xr-x   0 root         (0) root         (0)        0 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/
│ +-rw-r--r--   0 root         (0) root         (0)    20892 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-mode.el
│ +-rw-r--r--   0 root         (0) root         (0)    30321 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-smie.el
│ +-rw-r--r--   0 root         (0) root         (0)      257 
2019-09-17 11:18:38.000000 elixir-mode-2.3.1/elixir-mode-pkg.el
[no other differences]

Kind regards,

T G-R

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 37437 <at> debbugs.gnu.org (full text, mbox):

From: Björn Höfling <bjoern.hoefling <at> bjoernhoefling.de>
Cc: 37437 <at> debbugs.gnu.org, Tobias Geerinckx-Rice <me <at> tobias.gr>,
 Josh Holland <josh <at> inv.alid.pw>
Subject: Re: bug#37437: hash mismatch for emacs-elixir-mode
Date: Tue, 17 Sep 2019 22:49:36 +0200

[Message part 1 (text/plain, inline)]

Hi Josh and Tobias,

thanks for reporting and checking. I'm very surprised someone is
already using this :-) I only added this package three days ago, that's
probably the reason why the source code is not available via hash on
ci.guix.gnu.org or any other CAN. There it failed to build due to a
dependency, though it doesn't tell which dependency if failing:

https://ci.guix.gnu.org/build/1713420/details

Is that maybe the source dependency? I thought that Ricardo added a
feature to Cuirass to see the failing dependency?

Anyway, I checked the downloaded source code from the "original"
091cizx hash and it is exactly the same as what I found in Github
(under the version tag). I changed the package definition, the sources
are now taken from the git repository. After compilation, the result is
exactly the same.

Commited as 3a8d68badaca85122d91d8b7045daee87acb0aea

This was my first Emacs package and I used the importer, which went
through very smooth. Have I done anything wrong? I noticed that only 7
packages in emacs-xyz.scm are from stable.melpa.org, where 2 of them
have a 404. Is this repository not as stable as the name suggests? 

Björn

[Message part 2 (application/pgp-signature, inline)]

Message #19 received at 37437-done <at> debbugs.gnu.org (full text, mbox):

From: Tobias Geerinckx-Rice <me <at> tobias.gr>
To: 37437-done <at> debbugs.gnu.org, Björn Höfling
 <bjoern.hoefling <at> bjoernhoefling.de>
Subject: Re: bug#37437: hash mismatch for emacs-elixir-mode
Date: Thu, 19 Sep 2019 11:39:03 +0200

[Message part 1 (text/plain, inline)]

Tobias Geerinckx-Rice 写道：
> I can check my substitute server tomorrow for the ‘original’
> (091cizxg1aw8bkj58y048mj020ssapjflav633z9bl6gmi10dy4v) tarball 
> if
> nobody else has a copy.  Guix servers don't seem to.

I didn't have the chance while in LAN range, and the point's now 
moot anyway.  Thanks, Björn!

Björn Höfling 写道：
> Is [MELPA] not as stable as the name suggests.

Indeed[0], quite unfortunate.

Kind regards,

T G-R

[0]: 
https://guix-devel.gnu.narkive.com/6iiqs1hT/patch-emacs-danneskjold-theme#post3

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 37437 <at> debbugs.gnu.org (full text, mbox):

From: Efraim Flashner <efraim <at> flashner.co.il>
To: Björn Höfling <bjoern.hoefling <at> bjoernhoefling.de>
Cc: 37437 <at> debbugs.gnu.org, Josh Holland <josh <at> inv.alid.pw>
Subject: Re: bug#37437: hash mismatch for emacs-elixir-mode
Date: Mon, 23 Sep 2019 16:48:36 +0300

[Message part 1 (text/plain, inline)]

On Tue, Sep 17, 2019 at 10:49:36PM +0200, Björn Höfling wrote:
> Hi Josh and Tobias,
> 
> thanks for reporting and checking. I'm very surprised someone is
> already using this :-) I only added this package three days ago, that's
> probably the reason why the source code is not available via hash on
> ci.guix.gnu.org or any other CAN. There it failed to build due to a
> dependency, though it doesn't tell which dependency if failing:
> 
> https://ci.guix.gnu.org/build/1713420/details
> 

It's not clear, but one of the dependencies of the package is the
source. So if it already changed between pushing the commit and the
build farm building the package then it may have failed for that reason.


-- 
Efraim Flashner   <efraim <at> flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.