Bug 615848 – app-arch/rar-5.5.0_beta1: Wrong size for winrar-x64-55b1.exe

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Erik Zeek 2017-04-17 12:43:59 UTC]

Created attachment 470238 [details]
emerge --info =app-arch/rar-5.5.0_beta1:0/0::gentoo

* rarlinux-x64-5.5.b1.tar.gz SHA256 SHA512 WHIRLPOOL size ;-) ...       [ ok ]
 * rarlinux-5.5.b1.tar.gz SHA256 SHA512 WHIRLPOOL size ;-) ...           [ ok ]
>>> Downloading 'http://www.rarsoft.com/rar/winrar-x64-55b1.exe'
--2017-04-17 06:04:31--  http://www.rarsoft.com/rar/winrar-x64-55b1.exe
Resolving www.rarsoft.com (www.rarsoft.com)... 5.135.104.98
Connecting to www.rarsoft.com (www.rarsoft.com)|5.135.104.98|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2213800 (2.1M) [application/octet-stream]
Saving to: ‘/gentoo/distfiles/winrar-x64-55b1.exe’

     0K .......... .......... .......... .......... ..........  2%  151K 14s
    50K .......... .......... .......... .......... ..........  4%  305K 10s
   100K .......... .......... .......... .......... ..........  6% 1.03M 7s
   150K .......... .......... .......... .......... ..........  9%  168K 8s
   200K .......... .......... .......... .......... .......... 11%  134M 6s
   250K .......... .......... .......... .......... .......... 13% 1.46M 5s
   300K .......... .......... .......... .......... .......... 16%  320K 5s
   350K .......... .......... .......... .......... .......... 18%  326K 5s
   400K .......... .......... .......... .......... .......... 20%  327K 5s
   450K .......... .......... .......... .......... .......... 23%  326K 5s
   500K .......... .......... .......... .......... .......... 25%  342K 5s
   550K .......... .......... .......... .......... .......... 27%  899K 4s
   600K .......... .......... .......... .......... .......... 30%  332K 4s
   650K .......... .......... .......... .......... .......... 32%  336K 4s
   700K .......... .......... .......... .......... .......... 34%  353K 4s
   750K .......... .......... .......... .......... .......... 37%  352K 4s
   800K .......... .......... .......... .......... .......... 39%  833K 4s
   850K .......... .......... .......... .......... .......... 41%  341K 3s
   900K .......... .......... .......... .......... .......... 43%  361K 3s
   950K .......... .......... .......... .......... .......... 46%  382K 3s
  1000K .......... .......... .......... .......... .......... 48%  801K 3s
  1050K .......... .......... .......... .......... .......... 50%  352K 3s
  1100K .......... .......... .......... .......... .......... 53%  394K 3s
  1150K .......... .......... .......... .......... .......... 55%  804K 3s
  1200K .......... .......... .......... .......... .......... 57%  358K 2s
  1250K .......... .......... .......... .......... .......... 60%  396K 2s
  1300K .......... .......... .......... .......... .......... 62%  832K 2s
  1350K .......... .......... .......... .......... .......... 64%  375K 2s
  1400K .......... .......... .......... .......... .......... 67%  403K 2s
  1450K .......... .......... .......... .......... .......... 69%  826K 2s
  1500K .......... .......... .......... .......... .......... 71%  372K 2s
  1550K .......... .......... .......... .......... .......... 74%  496K 1s
  1600K .......... .......... .......... .......... .......... 76%  644K 1s
  1650K .......... .......... .......... .......... .......... 78%  409K 1s
  1700K .......... .......... .......... .......... .......... 80%  848K 1s
  1750K .......... .......... .......... .......... .......... 83%  381K 1s
  1800K .......... .......... .......... .......... .......... 85%  516K 1s
  1850K .......... .......... .......... .......... .......... 87%  621K 1s
  1900K .......... .......... .......... .......... .......... 90%  495K 1s
  1950K .......... .......... .......... .......... .......... 92%  673K 0s
  2000K .......... .......... .......... .......... .......... 94%  418K 0s
  2050K .......... .......... .......... .......... .......... 97%  671K 0s
  2100K .......... .......... .......... .......... .......... 99%  472K 0s
  2150K .......... .                                          100% 1.14M=5.1s

2017-04-17 06:04:36 (426 KB/s) - ‘/gentoo/distfiles/winrar-x64-55b1.exe’ saved [2213800/2213800]

!!! Fetched file: winrar-x64-55b1.exe VERIFY FAILED!
!!! Reason: Filesize does not match recorded size
!!! Got:      2213800
!!! Expected: 2195920
Refetching... File renamed to '/gentoo/distfiles/winrar-x64-55b1.exe._checksum_failure_.z6p6law5'

!!! Couldn't download 'winrar-x64-55b1.exe'. Aborting.
 * Fetch failed for 'app-arch/rar-5.5.0_beta1', Log file:
 *  '/var/log/portage/app-arch:rar-5.5.0_beta1:20170417-120430.log.gz'

[Comment 1 Matthew Turnbull 2017-04-26 03:32:28 UTC]

Same with 5.4.0 amd64

!!! Fetched file: rarlinux-x64-5.4.0.tar.gz VERIFY FAILED!
!!! Reason: Filesize does not match recorded size
!!! Got:      531782
!!! Expected: 1156900

[Comment 2 Thomas Deutschmann (RETIRED) 2017-04-26 07:50:21 UTC]

Yeah, upstream has replaced several files on 2017-04-24 for latest stable 5.4.0 and 5.5.0b1. Will have to investigate... Thanks for the report!

[Comment 3 Thomas Deutschmann (RETIRED) 2017-04-27 09:42:31 UTC]

Upstream answered my mail and confirmed that they removed rar_static. Reasons for doing this is https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860952;msg=5. It is questionable if they are violating LGPL because they provide a dynamically linked rar file in the same source file. However, upstream decided to remove the file in question to be done.

I asked upstream if they want us to remove static support. They answered

> We'll not include rar_static to 5.50 release. Please decide yourself
> what to do with earlier versions. 


@ Gentoo Licenses Project:

Ulrich will remember, we had a discussion about mirroring rar source file or not (bug 596154). Ulrich wasn't sure about the changed license text in recent 5.x releases so we decided to ask Debian if they already noticed the changed text and if they think the changed text disallow redistribution. To my knowledge, there wasn't a final decision (in the end we were discussing if the EULA only forbids cracks/keygens). However, Debian still has an exclusive written permission to redistribute ...

Now what should we do with rar? I have the permission to upload the previous rar source (before they removed rar_static) to our mirrors. This would allow us to keep existing stable marked packages.

Otherwise I would need to drop "static" USE flag from existing stable marked packages.

[Comment 4 Ulrich Müller 2017-04-27 11:16:43 UTC]

So upstream acknowledges that distribution of the statically linked binaries violates the GPL?

[Comment 5 mimosinnet 2017-04-30 09:40:26 UTC]

Stable app-arch/rar-5.4.0 seems to be also affected by this bug. 

See: 
https://forums.gentoo.org/viewtopic-t-1062836.html

[Comment 6 Thomas Deutschmann (RETIRED) 2017-05-02 10:30:49 UTC]

Fixed via https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0ee188131fc509efdc605c94af6b7f400a9264e7

I dropped "static" USE flag.

I have rewritten ebuild's src_unpack function to allow revisions in SRC files (i.e. rarlinux-x64-r1.tar.gz) to allow smooth transition for people who downloaded old rarlinux-x64.tar.gz package before upstream changed the SRC file so that the new ebuild revision won't throw an error due to file checksum mismatch.

[Comment 7 Thomas Deutschmann (RETIRED) 2017-05-04 12:26:23 UTC]

*** Bug 617250 has been marked as a duplicate of this bug. ***