Bug 916675 – sys-libs/zlib-1.2.13-r2 fails in fetch stage

• Product: Gentoo Linux
• Status: UNCONFIRMED ---

[Description Jason Lethbridge 2023-11-01 19:38:23 UTC]

sys-libs/zlib-1.2.13-r2 fails to download source tarballs due to file extension change in the file server. A quick visit to 'https://zlib.net/fossils/' shows that the files are now .tar.gz instead of .tar.xz

Reproducible: Always

Steps to Reproduce:
1.emerge -f =sys-libs/zlib-1.2.13-r2
Actual Results:  
ebuild fails to download 'https://zlib.net/fossils/${P}.tar.xz'

Expected Results:  
ebuild downloads 'https://zlib.net/fossils/${P}.tar.gz'

'wget https://zlib.net/fossils/zlib-1.2.13.tar.gz' works as expected

[Comment 1 Ionen Wolkens 2023-11-01 20:05:08 UTC]

Note that gentoo mirrors will still have the file assuming your GENTOO_MIRRORS settings are not broken (which is what would lead to fetch failure).

i.e. https://distfiles.gentoo.org/distfiles/0e/zlib-1.2.13.tar.xz

[Comment 2 Eli Schwartz 2023-11-02 00:24:53 UTC]

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4efe01ba2e5b6a4696ce14f70006f4ec05ac14ac

This is a fascinating change. I thought all historical versions of zlib ever, used gzip -- why did it temporarily switch over to an xz tarball?

There's additional context behind the incredible awkwardness, of course -- zlib traditionally provides a couple different tarballs outside of the fossils/ directory, and PGP signatures, but only for the current release -- they get dropped whenever a new release is uploaded. Bizarre. So with verify-sig, you kind of have to rely on a mirror either way.

[Comment 3 Jason Lethbridge 2023-11-02 01:13:12 UTC]

Created attachment 873860 [details, diff]
Updated source tarball URLs

Looks like 1.2.13 is available as a .xz(.asc) from Github (https://github.com/madler/zlib/releases/) here's a patch

[Comment 4 Jason Lethbridge 2023-11-02 01:34:43 UTC]

(In reply to Ionen Wolkens from comment #1)
> Note that gentoo mirrors will still have the file assuming your
> GENTOO_MIRRORS settings are not broken (which is what would lead to fetch
> failure).
> 
> i.e. https://distfiles.gentoo.org/distfiles/0e/zlib-1.2.13.tar.xz

This was indeed semi-broken on my network. It turns out the local networks http cache proxy was throwing a 403 whenever portage tried to fetch 'http://distfiles.gentoo.org/distfiles/layout.conf' which caused portage to try http://distfiles.gentoo.org/distfiles/zlib-1.2.13.tar.xz before the other addresses listed in the ebuild.