Mirror unpacks distfile before sending

Dave Allured - NOAA Affiliate dave.allured at noaa.gov
Wed Apr 3 03:45:58 UTC 2019


I'm new to this mailing list.  I ran into a strange problem tonight with
one of the mirror sites.  While running a port update on a different port,
I got a checksum error on this distfile:

http://mirror.facebook.net/gnu/groff/groff-1.22.4.tar.gz

I tried manually downloading using curl, from both this site and a
different mirror.  The other site provided a correct version with two
correct checksums and a correct size match, when compared with expected
checksums in the current groff port file.

Here is the weird part.  It seems like the facebook.net mirror (or perhaps
my curl command) was silently un-gzipping the tar file before delivery to
my local disk, and without removing the ".gz" extension.  When I gunzipped
the "legitimate" tar file from the other mirror, it was bit identical with
the supposedly packed tar file from the facebook mirror.  I tested this
several times and always got the same strange result.

Reference mirror and gunzipped contents:
-rw-r--r--  1    4137480 Jan 26 14:37:23 2019 1/groff-1.22.4.tar.gz
-rw-r--r--  1   17827840 Jan 26 14:37:23 2019 1/gunzip/groff-1.22.4.tar

Facebook.net mirror:
-rw-r--r--  1   17827840 Dec 23 08:06:58 2018 3/groff-1.22.4.tar.gz

> diff -qs 1/gunzip/groff-1.22.4.tar 3/groff-1.22.4.tar.gz
Files 1/gunzip/groff-1.22.4.tar and 3/groff-1.22.4.tar.gz are identical

There was nothing else weird that I could see with my repeated curl command
attempts.  It looks like facebook.net wants to "magically" unpack the
requested tar.gz file before sending.  This results in checksum breakage
during port update.

I have never before seen this sort of fradulent behavior, silent unpacking,
from either an http hosted data site, or the curl command.  Can anyone else
confirm this weird download behavior from that facebook.net mirror?  Is
there an alternate explanation?  Thanks for taking a look at this.

--Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.macports.org/pipermail/macports-users/attachments/20190402/913f45f0/attachment.html>


More information about the macports-users mailing list