Bash 4.3.28 checksum failure

[Juan Manuel Palacios]

On Oct 2, 2014, at 3:10 PM, Ryan Schmidt <ryandesign at macports.org> wrote:

> 
> On Oct 2, 2014, at 2:37 PM, Bradley Giesbrecht wrote:
>> 
>> On Oct 2, 2014, at 10:56 AM, Juan Manuel Palacios wrote:
>> 
>>> Hey guys!
>>> 
>>> I'm trying to update to bash 4.3.28 but I'm constantly (since yesterday) getting a checksum failure for the bash43-028 patchfile:
>>> 
>>> Error: Checksum (sha1) mismatch for bash43-028
>>> Portfile checksum: bash43-028 sha1 1e05d95e4abd32b631d991fa374d030c1651645d
>>> Distfile checksum: bash43-028 sha1 0cb3ff195fb252ff4bd33f7562c4e1917b210edc
>>> 
>>> Anyone else seen this? Or is it maybe something on my end? It may be completely unrelated, but with all the bash shellshock reports going around, I'm naturally a bit wary of such mismatch.
>> 
>> With:
>> for mirror in $(port distfiles bash | grep "^ .*bash43-028$");do echo $mirror;curl -s ${mirror} -O;openssl sha1 bash43-028;done
>> 
>> These do not match:
>> http://aarnet.au.distfiles.macports.org/pub/macports/mpdistfiles/bash/bash43-028
>> SHA1(bash43-028)= 992fa55af8366819627e5fafa686ed956b24bc4f
>> http://svn.macports.org/repository/macports/distfiles/bash/bash43-028
>> SHA1(bash43-028)= 7d05360cf240509e210ac1f81e2cda75addb4b3e
> 
> Those URLs are both 404 so they don't matter. MacPorts will skip servers that return error codes.
> 


I tried that very ingenious shell loop and found I had three mirrors failing the checksum for that patch file, each of them giving different checksums even among themselves:

Portfile checksum: 1e05d95e4abd32b631d991fa374d030c1651645d (respected by most mirrors).

http://lil.fr.distfiles.macports.org/bash/bash43-028:
SHA1(bash43-028)= 7e96232c3265571fe4f85d33b83684d525b1b246

This server is on-and-off closing the connection before transfer is complete, so sometimes checksum fails and sometimes it doesn't. But in all cases HTTP 200 OK is returned, so it might affect builds.

http://aarnet.au.distfiles.macports.org/pub/macports/mpdistfiles/bash/bash43-028:
SHA1(bash43-028)= 992fa55af8366819627e5fafa686ed956b24bc4f

This one is indeed returning 404, so it can be ignored.

http://svn.macports.org/repository/macports/distfiles/bash/bash43-028:
SHA1(bash43-028)= 7d05360cf240509e210ac1f81e2cda75addb4b3e

This is also returning 404.

I hadn't noticed these are all our mirrors, so maybe there's something we can do to correct the errors?

All in all, I just tried updating again a little while ago, but this time a pre-built package was fetched from packages.macports.org, so I'm in the clear now.

Thanks for the insight!


- jmpp