Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 881239 - Found occurrence where distfiles mirror wasn't re-synced upon SRC_URI change leading to same downloaded file
Summary: Found occurrence where distfiles mirror wasn't re-synced upon SRC_URI change ...
Status: UNCONFIRMED
Alias: None
Product: Mirrors
Classification: Unclassified
Component: Feature Request (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Mirror Admins
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-11-13 19:45 UTC by cJ
Modified: 2022-11-14 11:26 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description cJ 2022-11-13 19:45:28 UTC
Gentoo commit:

commit eaf8e436e66469e47fe7f843997f1ca06021e467
Author: Andreas Sturmlechner <asturm@gentoo.org>
Date:   Sun Feb 2 22:19:30 2020 +0100

    net-libs/libgadu: EAPI-7 bump, drop USE openssl and static-libs
    
    Non-maintainer commit.
    
    Closes: https://bugs.gentoo.org/677502
    Package-Manager: Portage-2.3.87, Repoman-2.3.20
    Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>

was a revision bump to net-libs/libgadu-1.12.2 to -r1 ; it changed the SRC_URI this way:
+SRC_URI="https://github.com/wojtekka/${PN}/releases/download/${PV}/${P}.tar.gz"
-SRC_URI="https://github.com/wojtekka/${PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"

And the old ebuild was kept around.

What happened was that the Manifest stayed the same, despite the source changing from the new ebuild, because the downloaded file name was the same (error #1)...

Then, the old ebuild was removed. The manifest somehow stayed the same. I don't know what caused this.

And it turns out that the mirrors didn't pick the change. Today, they still host the old file.


Reproducible: Always

Steps to Reproduce:
1. rm -f /var/cache/distfiles/libgadu-1.12.2.tar.gz
2. pkgdev manifest net-libs/libgadu --force --mirrors # gentoo state
3. rm -f /var/cache/distfiles/libgadu-1.12.2.tar.gz
4. pkgdev manifest net-libs/libgadu --force # expected state for Manifest



Expected Results:  
- Downloaded file collision check available for developers
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-11-13 19:50:30 UTC
I think this is a bug in the change, not mirroring: https://devmanual.gentoo.org/general-concepts/mirrors/index.html#replacing-automatically-mirrored-files.
Comment 2 cJ 2022-11-14 10:03:26 UTC
Note: sam opened https://github.com/pkgcore/pkgcheck/issues/493
Comment 3 cJ 2022-11-14 11:26:01 UTC
Other occurrences of distfile collisions mentioned in https://github.com/pkgcore/pkgcheck/issues/493:
- dev-python/rpyc-5.2.3
- sci-geosciences/viking-2.3.* documentation