Bug 580984

Summary:	app-emulation/virtualbox-5.0.18 bad manifest and bad tarball
Product:	Gentoo Linux	Reporter:	Harris Landgarten <harrisl>
Component:	Current packages	Assignee:	Lars Wendler (Polynomial-C) (RETIRED) <polynomial-c>
Status:	RESOLVED OBSOLETE
Severity:	normal	CC:	infra-bugs, jstein
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Harris Landgarten 2016-04-23 22:12:33 UTC

Checking 'VirtualBox-5.0.18.tar.bz2'... failed SHA256
Checking 'virtualbox-5.0.16-patches-01.tar.xz'... ok

If the manifest is forced the tarball fails as corrupt.

I have re-downloading the file 5 or 6 time in the last week.

Comment 1 stephan wezel 2016-04-24 15:36:12 UTC

It seems that the files on the mirrors are corrupted.
After downloading the file directly from virtualbox.org the checks and the build succeeded

Comment 2 Jonas Stein gentoo-dev

2016-04-24 16:51:26 UTC

confirmed:

ebuild virtualbox-5.0.18.ebuild fetch
[..]
http://mirror.netcologne.de/gentoo/distfiles/VirtualBox-5.0.18.tar.bz2
[..]
HTTP request sent, awaiting response... 200 OK
Length: 111237630 (106M) [application/octet-stream]
Saving to: ‘/usr/portage/distfiles/VirtualBox-5.0.18.tar.bz2’

/usr/portage/distfiles/VirtualBox-5.0.18.tar.bz 100%[=======================================================================================================>] 106.08M  1.42MB/s   in 82s    

2016-04-24 18:49:16 (1.29 MB/s) - ‘/usr/portage/distfiles/VirtualBox-5.0.18.tar.bz2’ saved [111237630/111237630]

!!! Fetched file: VirtualBox-5.0.18.tar.bz2 VERIFY FAILED!
!!! Reason: Failed on SHA256 verification
!!! Got:      b10dd2f870673908c5807f2588f1a9823e5bf173394bbdc854426daedafdf5c2
!!! Expected: 18a2c4f2db686da1653e6b8132142669867fc25e574a994d7f595c69d7b46603

Comment 3 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev

2016-04-26 09:18:32 UTC

I don't know how this happened. Indeed, the tarball from download.virtualbox.org is not affected. So I have no idea how to fix this.

CCing infra, as they might have a solution for this.
This bug is different to the problems described in bug #577722 because it's not  the Manifest file that is corrupt (it indeed is even correct as far as I have seen) but the source tarball on the mirrors. So please do not mark this bug as duplicate.

Comment 4 Harris Landgarten 2016-04-26 11:57:17 UTC

I can verify that downloading the file directly from virtualbox.org allows the installation to proceed to conclusion so it is the mirror system that has the corrupted file.

Comment 5 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev

2016-05-01 20:51:11 UTC

I've removed virtualbox-5.0.18 from the tree so this bug should be obsolete now.