Bug 686868 – dev-libs/libxslt-1.1.33-r1 - Fetched file: libxslt-1.1.33-CVE-2019-11068.patch VERIFY FAILED!

• Product: Gentoo Linux
• Status: RESOLVED WONTFIX

[Description doj 2019-05-27 17:07:26 UTC]

I've updated my portage tree about one hour ago, now dev-libs/libxslt-1.1.33-r1 fails to build:

>>> Downloading 'https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch'
--2019-05-27 09:59:25--  https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch
Resolving gitlab.gnome.org... 209.132.180.181
Connecting to gitlab.gnome.org|209.132.180.181|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/plain]
Saving to: ‘/usr/portage/distfiles/libxslt-1.1.33-CVE-2019-11068.patch.__download__’

/usr/portage/distfi     [ <=>                ]   3.87K  --.-KB/s    in 0.001s  

2019-05-27 09:59:26 (3.79 MB/s) - ‘/usr/portage/distfiles/libxslt-1.1.33-CVE-2019-11068.patch.__download__’ saved [3965]

!!! Fetched file: libxslt-1.1.33-CVE-2019-11068.patch VERIFY FAILED!
!!! Reason: Failed on BLAKE2B verification
!!! Got:      4e32deea543862d928c4a8b28412c3081a53fdbad734e6ef6c3856b81feb0e39b50ebd2548b2dfd9f4701f1831a314a4149f139b68d22357df7912d0135f8d67
!!! Expected: eb3a0741ac9f464e31e8edd276fec4d837c63676a56a446ad42a0e251508bacb0129cbe18783de305336eaa32b189ffc23e95e03cfd5f940d4dee376f1fa0f8c
Refetching... File renamed to '/usr/portage/distfiles/libxslt-1.1.33-CVE-2019-11068.patch._checksum_failure_.8rlkpz8l'

!!! Couldn't download 'libxslt-1.1.33-CVE-2019-11068.patch'. Aborting.

[Comment 1 Anthony Ianozi 2019-06-04 20:40:35 UTC]

Same happening for me, here is my emerge --info: http://dpaste.com/3WBTX88
And log for dev-libs/libxslt-1.1.33-r1: http://dpaste.com/1QJBD3V

[Comment 2 Jan Nárovec 2019-06-12 18:17:08 UTC]

Created attachment 579676 [details]
The original patch file

This is the original patch file.

[Comment 3 Anthony Ianozi 2019-07-07 15:36:44 UTC]

Looks like the depastes expired.  This is still happening on all of my computers.

emerge attempt: https://bugs.gentoo.org/686868

emerge --info: https://pastebin.com/tfVwT4bM

cat /var/tmp/portage/dev-libs/libxslt-1.1.33-r1/temp/build.log: https://pastebin.com/ZMRgnHfs

[Comment 4 Thomas Deutschmann (RETIRED) 2019-07-07 16:27:45 UTC]

You are right, the upstream URL

https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch

is unstable because it will contain the version number of the software used to generate that view:

--- /var/cache/distfiles/libxslt-1.1.33-CVE-2019-11068.patch    2019-05-14 07:52:41.000000000 +0200
+++ /var/cache/distfiles/libxslt-1.1.33-CVE-2019-11068.patch._checksum_failure_.nlfe82la        2019-07-07 18:25:53.676956869 +0200
@@ -116,5 +116,5 @@
        }
      }
 --
-2.18.1                                                                                                                 +2.21.0


However, file is already mirrored on Gentoo mirrors (check your GENTOO_MIRRORS variable) so no action is required.

[Comment 5 Bryant Hansen 2019-07-16 15:57:50 UTC]

Note: this patch is not updated on the mirror, http://mirror.switch.ch/ftp/mirror/gentoo/

This is the mirror I've used without issue for years.

>>> Downloading 'http://mirror.switch.ch/ftp/mirror/gentoo/distfiles/libxslt-1.1.33-CVE-2019-11068.patch'
--2019-07-16 16:52:04--  http://mirror.switch.ch/ftp/mirror/gentoo/distfiles/libxslt-1.1.33-CVE-2019-11068.patch
Resolving mirror.switch.ch... 86.119.30.68, 2001:620:5ca1:2002:f816:3eff:fe95:a889
Connecting to mirror.switch.ch|86.119.30.68|:80... connected.
HTTP request sent, awaiting response... 410 Gone
2019-07-16 16:52:04 ERROR 410: Gone.


After that failure, the ebuild instructs portage to download the incorrect version from https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.pat


Then when one performs a *default* search for libxslt or libxslt-1.1.33-r1 on https://bugs.gentoo.org, no bugs show up because this issue has a status of "RESOLVED"

Should a new bug be filed on mirror.switch.ch?