Mailing List Archive: heads up: codeberg changed gzip impls (?) for ${REPO}/archive/${TAG}.tar.gz files

heads up: codeberg changed gzip impls (?) for ${REPO}/archive/${TAG}.tar.gz files

Dec 11, 2023, 2:47 AM

Post #1 of 3 (56 views)

hi,

it seems that codeberg has changed how they produce their archives on
URLs like <https://codeberg.org/dnkl/foot/archive/${tag}.tar.gz> leading
to digest failures like <https://bugs.gentoo.org/919135>, as implied by
the following checks:

~$ diff <(<dls/foot-1.16.2.tar.gz gzip -d) <(</var/cache/distfiles/foot-1.16.2.tar.gz gzip -d)
~$ diff <(<dls/foot-1.16.2.tar.gz cat) <(</var/cache/distfiles/foot-1.16.2.tar.gz cat)
Binary files /dev/fd/63 and /dev/fd/62 differ

the above shows that compressed content differs while decompressed
content remains identical.

(dls/foot-1.16.2.tar.gz is downloaded from the master distfiles mirror,
/var/cache/distfiles/foot-1.16.2.tar.gz is fetched from codeberg at
around two in the morning last night)

you might want to regenerate manifests for projects fetching from
/archive/ urls on codeberg.

Daniel, thank you for working on foot. may I ask that you attach 'meson
dist'-generated files to releases? you could also use that opportunity
to hash or sign them, if you so desire.

in either case, thank you again.

have a lovely day, all!
--
Arsen Arsenovi?

Re: heads up: codeberg changed gzip impls (?) for ${REPO}/archive/${TAG}.tar.gz files [ In reply to ]

arsen at gentoo

Dec 11, 2023, 4:47 AM

Post #2 of 3 (56 views)

Permalink

Arsen Arsenovi? <arsen@gentoo.org> writes:

> hi,
>
> it seems that codeberg has changed how they produce their archives on
> URLs like <https://codeberg.org/dnkl/foot/archive/${tag}.tar.gz> leading
> to digest failures like <https://bugs.gentoo.org/919135>, as implied by
> the following checks:
>
> ~$ diff <(<dls/foot-1.16.2.tar.gz gzip -d) <(</var/cache/distfiles/foot-1.16.2.tar.gz gzip -d)
> ~$ diff <(<dls/foot-1.16.2.tar.gz cat) <(</var/cache/distfiles/foot-1.16.2.tar.gz cat)
> Binary files /dev/fd/63 and /dev/fd/62 differ
>
> the above shows that compressed content differs while decompressed
> content remains identical.
>
> (dls/foot-1.16.2.tar.gz is downloaded from the master distfiles mirror,
> /var/cache/distfiles/foot-1.16.2.tar.gz is fetched from codeberg at
> around two in the morning last night)
>
> you might want to regenerate manifests for projects fetching from
> /archive/ urls on codeberg.

ps, also filed https://codeberg.org/Codeberg/Community/issues/1366 per
ulms suggestion.
--
Arsen Arsenovi?

Re: heads up: codeberg changed gzip impls (?) for ${REPO}/archive/${TAG}.tar.gz files [ In reply to ]

eschwartz93 at gmail

Dec 11, 2023, 5:43 AM

Post #3 of 3 (56 views)

Permalink

On 12/11/23 5:47 AM, Arsen Arsenovi? wrote:
> hi,
>
> it seems that codeberg has changed how they produce their archives on
> URLs like <https://codeberg.org/dnkl/foot/archive/${tag}.tar.gz> leading
> to digest failures like <https://bugs.gentoo.org/919135>, as implied by
> the following checks:
>
> ~$ diff <(<dls/foot-1.16.2.tar.gz gzip -d) <(</var/cache/distfiles/foot-1.16.2.tar.gz gzip -d)
> ~$ diff <(<dls/foot-1.16.2.tar.gz cat) <(</var/cache/distfiles/foot-1.16.2.tar.gz cat)
> Binary files /dev/fd/63 and /dev/fd/62 differ
>
> the above shows that compressed content differs while decompressed
> content remains identical.
>
> (dls/foot-1.16.2.tar.gz is downloaded from the master distfiles mirror,
> /var/cache/distfiles/foot-1.16.2.tar.gz is fetched from codeberg at
> around two in the morning last night)
>
> you might want to regenerate manifests for projects fetching from
> /archive/ urls on codeberg.
>
> Daniel, thank you for working on foot. may I ask that you attach 'meson
> dist'-generated files to releases? you could also use that opportunity
> to hash or sign them, if you so desire.
>
> in either case, thank you again.
>
> have a lovely day, all!

It sounds like they completely failed to get the memo about:
https://github.com/orgs/community/discussions/46034

However, I really do wish tremendously that they *would* change all
tarball checksums... for a good reason!

Namely, they need to fix https://github.com/go-gitea/gitea/issues/18078
because currently gitea-based software forges kind of suck and I'd
rather no one used them for anything, lol.

It does appear that since last year when they fixed an unrelated issue,
closed *this* issue as "not fixed but sometime in the future we'll fix
it, we pinky promise"...

... that they've fixed the issue for manually uploaded release assets
where the download url was based on an unpredictable uuid.

So that's sort of kind of a little bit good at least.

--
Eli Schwartz

Mailing List Archive

Attached Files:

Attached Files: