| Summary: | samba ebuild again has problems with checksums | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Andre Hinrichs <andre.hinrichs> |
| Component: | New packages | Assignee: | Gentoo's SAMBA Team <samba> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | critical | CC: | fmouse-gentoo, henrik, jesse, nuno.araujo, security, throstur |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
|
Description
Andre Hinrichs
2004-10-08 10:51:02 UTC
Same problem here. # emerge info Portage 2.0.50-r11 (default-x86-1.4, gcc-3.3.4, glibc-2.3.3.20040420-r2, 2.4.20-gentoo-r9) ================================================================= System uname: 2.4.20-gentoo-r9 i686 Intel(R) Pentium(R) 4 CPU 2.60GHz Gentoo Base System version 1.4.16 ccache version 2.3 [enabled] Autoconf: sys-devel/autoconf-2.59-r4 Automake: sys-devel/automake-1.8.5-r1 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CFLAGS="-O2 -mcpu=pentium4 -march=pentium4 -fprefetch-loop-arrays -pipe" CHOST="i686-pc-linux-gnu" COMPILER="" CONFIG_PROTECT="/etc /usr/X11R6/lib/X11/xkb /usr/kde/2/share/config /usr/kde/3.1/share/config /usr/kde/3.2/share/config /usr/kde/3.3/env /usr/kde/3.3/share/config /usr/kde/3.3/shutdown /usr/kde/3/share/config /usr/lib/mozilla/defaults/pref /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/ /var/qmail/control" CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d" CXXFLAGS="-O2 -mcpu=pentium4 -march=pentium4 -fprefetch-loop-arrays -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="autoaddcvs ccache sandbox" GENTOO_MIRRORS="ftp://gentoo.noved.org/ http://gentoo.noved.org/ ftp://ftp.ussg.iu.edu/pub/linux/gentoo" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="X Xaw3d acl acpi alsa apache2 apm arts avi berkdb bindist bitmap-fonts bonobo cdr crypt cups curl doc dvd dvdr encode esd evo f77 fastcgi flash foomaticdb gdbm gif gnome gpm gps gstreamer gtk gtk2 gtkhtml guile imap imlib ipv6 java jikes jpeg libg++ libwww mad maildir mcal mikmod motif mozilla mpeg mysql nas ncurses nls oggvorbis opengl oss pam pdflib perl plotutils png ppds python quicktime readline samba sasl scanner sdl slang slp snmp spell sse ssl svga tcltk tcpd tetex tiff truetype usb x86 xml xml2 xmms xosd xprint xv zeo zlib" Yup.. >>> emerge (1 of 1) net-fs/samba-3.0.7-r1 to / >>> Downloading http://mirror.tucdemonic.org/gentoo/distfiles/samba-3.0.7.tar.gz --17:47:51-- http://mirror.tucdemonic.org/gentoo/distfiles/samba-3.0.7.tar.gz => `/usr/portage/distfiles/samba-3.0.7.tar.gz' Resolving mirror.tucdemonic.org... 128.196.95.10 Connecting to mirror.tucdemonic.org[128.196.95.10]:80... connected. HTTP request sent, awaiting response... 200 OK Length: 15,012,667 [application/x-tar] 100%[====================================>] 15,012,667 171.51K/s ETA 00:00 17:49:09 (188.00 KB/s) - `/usr/portage/distfiles/samba-3.0.7.tar.gz' saved [15012667/15012667] !!! File is corrupt or incomplete. (Digests do not match) >>> our recorded digest: a3e74c3cbb3303dcc92f037fdb35ff20 >>> your file's digest: 5906341429e64214909865a4be92e4ab !!! File does not exist: /usr/portage/distfiles/samba-3.0.7.tar.gz Also have this one... Calculating world dependencies ...done! >>> emerge (1 of 1) net-fs/samba-3.0.7-r1 to / >>> Downloading http://gentoo.inode.at/distfiles/samba-3.0.7.tar.gz --01:30:53-- http://gentoo.inode.at/distfiles/samba-3.0.7.tar.gz => `/usr/portage/distfiles/samba-3.0.7.tar.gz' Resolving gentoo.inode.at... 81.223.20.162 Connecting to gentoo.inode.at[81.223.20.162]:80... connected. HTTP request sent, awaiting response... 200 OK Length: 15,012,667 [text/plain] 100%[====================================>] 15,012,667 79.22K/s ETA 00:00 01:34:11 (74.12 KB/s) - `/usr/portage/distfiles/samba-3.0.7.tar.gz' saved [15012667/15012667] !!! File is corrupt or incomplete. (Digests do not match) >>> our recorded digest: a3e74c3cbb3303dcc92f037fdb35ff20 >>> your file's digest: 5906341429e64214909865a4be92e4ab !!! File does not exist: /usr/portage/distfiles//samba-3.0.7.tar.gz zot root # rm /usr/portage/distfiles//samba-3.0.7.tar.gz Richie a workaround : cd /usr/portage/net-fs/samba/ rm files/digest-samba-3.0.7* ebuild ./digest-samba-3.0.7 ebuild ebuild ./digest-samba-3.0.7-r1 ebuild now your md5sum will be correct again , had same problem on many systems overhere. Same here. Adding CC. Confirming the problem: >>> emerge (1 of 3) net-fs/samba-3.0.7-r1 to / !!! File is corrupt or incomplete. (Digests do not match) >>> our recorded digest: a3e74c3cbb3303dcc92f037fdb35ff20 >>> your file's digest: 5906341429e64214909865a4be92e4ab !!! File does not exist: /usr/portage/distfiles//samba-3.0.7.tar.gz Googling for the md5sums, I get the impression that my file (59063) is genuine. If that is true, the person creating the ebuild digest has used a wrong/corrupt samba source file. This may be an innocent mistake, but it might also mean that someone somewhere has managed to insert a manipulated samba source archive into an FTP archive, sufficient to fool the digest author. The digest author should do a forensic investigation of the (a3e74) samba source file he/she has used. It is imperative that the community finds out - which way the file has been altered, - whether the alteration was an accident or intentional, - how this altered file has found its way to the gentoo ebuild author. There have been cases of source archives on FTP servers altered with evil intent before; this might be such a case. (I would like to escalate by setting keyword SECURITY and severity critical, but the bug system does not let me.) I confirm that the samba-3.0.7.tar.gz should be : 5906341429e64214909865a4be92e4ab samba-3.0.7.tar.gz samba team, please elaborate... dupe of bug #64202, fixed in cvs. christians's hd had problems, distfiles got corrupted, he committed a bad md5sum ... *** This bug has been marked as a duplicate of 64202 *** This was due to my faulty HD, which I'm burying now, I swear... _many_ thanks to mglauche who fixed it, and _many_ excuses to you all :-( Yeah, I would have guessed (95%) that there was a technical explanation instead of something sinister. Wouldn't it be nice if the ebuild production process would use the (presumably verified) checksums of the source files to warn you about your files being corrupted, instead of silently replacing the good checksums with bad ones!? |
