[gentoo-user] Possible heads up: Digest verification failed

[gentoo-user] Possible heads up: Digest verification failed

[Andrew Lowe]

Hi all,
	Anyone seeing this again? I've just sync'd to two servers in Australia, 
and then, for the hell of it, one in Canada and am getting it for:

dev-libs/botan
app-arch/tar
media-video/libav
app-crypt/qca
net-print/cups-filters

I suppose time will sort it out.....

	Andrew

Re: [gentoo-user] Possible heads up: Digest verification failed

[J. Roeleveld]

On October 29, 2016 6:56:46 AM GMT+02:00, Andrew Lowe <agl@wht.com.au> wrote:
>Hi all,
>	Anyone seeing this again? I've just sync'd to two servers in
>Australia, 
>and then, for the hell of it, one in Canada and am getting it for:
>
>dev-libs/botan
>app-arch/tar
>media-video/libav
>app-crypt/qca
>net-print/cups-filters
>
>I suppose time will sort it out.....
>
>	Andrew

I haven't seen this in a while. Ever since switching over to syncing with git.

Would that be an option for you?

--
Joost
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

Re: [gentoo-user] Possible heads up: Digest verification failed

[Daniel Campbell]

[-- Attachment #1.1: Type: text/plain, Size: 943 bytes --]

On 10/28/2016 09:56 PM, Andrew Lowe wrote:
> Hi all,
>     Anyone seeing this again? I've just sync'd to two servers in
> Australia, and then, for the hell of it, one in Canada and am getting it
> for:
> 
> dev-libs/botan
> app-arch/tar
> media-video/libav
> app-crypt/qca
> net-print/cups-filters
> 
> I suppose time will sort it out.....
> 
>     Andrew
> 
This shouldn't happen unless the distfiles aren't found, or someone (a
dev) didn't use repoman to commit, leaving an old Manifest around.

Which servers in question? Have you popped in IRC to ask about it? I'm
not involved with our mirrors, and I sync directly from git, so I can't
really help on that front, but it seems to me that it's a simple
oversight that is sure to be fixed once someone knows about it.

-- 
Daniel Campbell - Gentoo Developer
OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net
fpr: AE03 9064 AE00 053C 270C  1DE4 6F7A 9091 1EA0 55D6


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [gentoo-user] Possible heads up: Digest verification failed

[Andrew Lowe]

On 29/10/16 14:53, Daniel Campbell wrote:
> On 10/28/2016 09:56 PM, Andrew Lowe wrote:
>> Hi all,
>>     Anyone seeing this again? I've just sync'd to two servers in
>> Australia, and then, for the hell of it, one in Canada and am getting it
>> for:
>>
>> dev-libs/botan
>> app-arch/tar
>> media-video/libav
>> app-crypt/qca
>> net-print/cups-filters
>>
>> I suppose time will sort it out.....
>>
>>     Andrew
>>
> This shouldn't happen unless the distfiles aren't found, or someone (a
> dev) didn't use repoman to commit, leaving an old Manifest around.
>
> Which servers in question? Have you popped in IRC to ask about it? I'm
> not involved with our mirrors, and I sync directly from git, so I can't
> really help on that front, but it seems to me that it's a simple
> oversight that is sure to be fixed once someone knows about it.
>

Servers: Swinburne, iiNet, terra-byte.com (Canada)

Sorry, wouldn't know IRC if I tripped over it....

Time will heal all wounds :)

	Andrew

Re: [gentoo-user] Possible heads up: Digest verification failed

[Adam Carter]

[-- Attachment #1: Type: text/plain, Size: 2275 bytes --]

On Sat, Oct 29, 2016 at 6:20 PM, Andrew Lowe <agl@wht.com.au> wrote:

> On 29/10/16 14:53, Daniel Campbell wrote:
>
>> On 10/28/2016 09:56 PM, Andrew Lowe wrote:
>>
>>> Hi all,
>>>     Anyone seeing this again? I've just sync'd to two servers in
>>> Australia, and then, for the hell of it, one in Canada and am getting it
>>> for:
>>>
>>> dev-libs/botan
>>> app-arch/tar
>>> media-video/libav
>>> app-crypt/qca
>>> net-print/cups-filters
>>>
>>> I suppose time will sort it out.....
>>>
>>>     Andrew
>>>
>>> This shouldn't happen unless the distfiles aren't found, or someone (a
>> dev) didn't use repoman to commit, leaving an old Manifest around.
>>
>> Which servers in question? Have you popped in IRC to ask about it? I'm
>> not involved with our mirrors, and I sync directly from git, so I can't
>> really help on that front, but it seems to me that it's a simple
>> oversight that is sure to be fixed once someone knows about it.
>>
>>
> Servers: Swinburne,


I use this one too. Emerge world gave me;

!!! Digest verification failed:
!!! /fast/portage/sys-kernel/gentoo-sources/ChangeLog
!!! Reason: Filesize does not match recorded size
!!! Got: 66345
!!! Expected: 66162

!!! Digest verification failed:
!!! /fast/portage/net-print/hplip/ChangeLog
!!! Reason: Filesize does not match recorded size
!!! Got: 8466
!!! Expected: 8315

And the rsync output shows many/all the ChangeLog and Manifest files were
just updated

<snip>
net-mail/Freemail/ChangeLog
net-mail/altermime/ChangeLog
net-mail/altermime/Manifest
net-mail/amavis-logwatch/ChangeLog
net-mail/amavis-logwatch/Manifest
net-mail/archivemail/ChangeLog
net-mail/archivemail/Manifest
net-mail/asmail/ChangeLog
net-mail/asmail/Manifest
net-mail/automx/ChangeLog
net-mail/automx/Manifest
net-mail/autorespond/ChangeLog
net-mail/autorespond/Manifest
net-mail/bincimap/ChangeLog
net-mail/bincimap/Manifest
net-mail/checkpassword-pam/ChangeLog
net-mail/checkpassword-pam/Manifest
net-mail/checkpassword/ChangeLog
net-mail/checkpassword/Manifest
net-mail/cmd5checkpw/ChangeLog
net-mail/cmd5checkpw/Manifest
net-mail/courier-imap/ChangeLog
net-mail/courier-imap/Manifest
net-mail/courierpassd/ChangeLog
net-mail/courierpassd/Manifest
net-mail/cyrus-imap-admin/ChangeLog
net-mail/cyrus-imap-admin/Manifest
<snip>

[-- Attachment #2: Type: text/html, Size: 3221 bytes --]

Re: [gentoo-user] Possible heads up: Digest verification failed

[Adam Carter]

[-- Attachment #1: Type: text/plain, Size: 90 bytes --]

Checked rsync11.us.gentoo.org and its the same as
rsync.au.gentoo.org/ftp.cc.swin.edu.au.

[-- Attachment #2: Type: text/html, Size: 214 bytes --]

Re: [gentoo-user] Possible heads up: Digest verification failed

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 724 bytes --]

On Fri, 28 Oct 2016 23:53:03 -0700, Daniel Campbell wrote:

> >     Anyone seeing this again? I've just sync'd to two servers in
> > Australia, and then, for the hell of it, one in Canada and am getting
> > it for:
> > 
> > dev-libs/botan
> > app-arch/tar
> > media-video/libav
> > app-crypt/qca
> > net-print/cups-filters
> > 
> > I suppose time will sort it out.....
> > 
> >     Andrew
> >   
> This shouldn't happen unless the distfiles aren't found, or someone (a
> dev) didn't use repoman to commit, leaving an old Manifest around.

It looks like repoman is the culprit

https://bugs.gentoo.org/show_bug.cgi?id=598376


-- 
Neil Bothwick

Scrotum is a small planet near Uranus. True/False?

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-user] Possible heads up: Digest verification failed

[Rich Freeman]

On Sat, Oct 29, 2016 at 5:42 AM, Neil Bothwick <neil@digimed.co.uk> wrote:
> On Fri, 28 Oct 2016 23:53:03 -0700, Daniel Campbell wrote:
>
>> >     Anyone seeing this again? I've just sync'd to two servers in
>> > Australia, and then, for the hell of it, one in Canada and am getting
>> > it for:
>> >
>> > dev-libs/botan
>> > app-arch/tar
>> > media-video/libav
>> > app-crypt/qca
>> > net-print/cups-filters
>> >
>> > I suppose time will sort it out.....
>> >
>> >     Andrew
>> >
>> This shouldn't happen unless the distfiles aren't found, or someone (a
>> dev) didn't use repoman to commit, leaving an old Manifest around.
>
> It looks like repoman is the culprit
>
> https://bugs.gentoo.org/show_bug.cgi?id=598376
>

This is probably not the issue here, since Gentoo uses thin manifests
(there is nothing for repoman to update).  The manifests that are
causing the problem aren't created by regular Gentoo developers.
They're created by a script that runs as a part of the rsync mirror
process.

This is a fairly well-known problem that has been around for over a year.

You will only run into this problem if you use rsync to update your
repository, since the problem is created when creating the master
rsync mirror.  The original git repository doesn't contain the error,
and the git mirror on github doesn't mess with the Manifests.

The issue apparently has to do with Changelog generation.  In April
the Council gave Infra the option to stop generating Changelogs, which
would eliminate the problem.  I suspect those maintaining the scripts
prefer to keep them around, and I don't think anybody on the Council
has access to change the scripts.

I switched to git syncing eons ago, so I've never seen this bug.  I
recognize it has been a source of frustration for a lot of users, and
a bit of frustration for the Council, since there doesn't seem to be a
lot we can do to change it in practice.

zlg is of course right that these kinds of problems can also be caused
by maintainer failure to use repoman/etc or if an upstream distfile
changes.  If that is the problem then you'll see it no matter how you
sync your repo.  However, when you get a bunch of these after syncing
it is almost always a result of the mirror creation process.  I can't
remember the last time I saw a manifest error (granted, I'm also using
mgorny's stable mirror branch, which I think screens for these kinds
of errors).

While there can be some latency I do in general recommend syncing from
https://github.com/gentoo-mirror/gentoo .  This is a mirror of the
Gentoo developer git repository with two changes:
1.  Metadata is added to the mirror, which greatly speeds things up
compared to using the raw git repository (you can do this yourself, it
is one of the steps done by the rsync generation process as well, but
this one is not buggy).
2.  The default stable branch of this mirror screens for numerous
issues before accepting commits.  That means it is generally a little
behind the main branch (at this moment the main branch is 2 minutes
old, and the default stable branch is 20min old), but a lot of the
really annoying issues that are caused by devs skipping repoman won't
be seen.   Now, if a maintainer breaks a package then this mirror will
quickly get out of date until the problem is corrected, but Gentoo QA
gets warnings when this is happening and usually the maintainer is
being pestered or somebody else is fixing it.  I suspect this process
has probably reduced the error rate for everybody.  I have seen this
get a few days old though, which is something to keep in mind.

It does not contain Changelogs, though if you use it you'll have a
full history so you can just run git whatchanged <path> to get
something pretty close to a changelog.

To use it just put this in /etc/portage/repos.conf/gentoo.conf:
[DEFAULT]
main-repo = gentoo

[gentoo]
location = /usr/portage
sync-type = git
sync-uri = https://github.com/gentoo-mirror/gentoo.git
auto-sync = yes

If you want to git-sync from some other mirror, just change the url accordingly.

If you switch your mirror I suggest just renaming /usr/portage and
letting portage re-create it.

The other big benefit of git syncing is that if you sync every day it
is a lot faster.  If you sync less often it will become slower
compared to rsync.  git is much more efficient at finding what has
changed, but rsync is not burdened with transferring a complete
history.  If you only sync once every few months rsync will be a lot
faster.

-- 
Rich

Re: [gentoo-user] Possible heads up: Digest verification failed

[Daniel Campbell]

[-- Attachment #1.1: Type: text/plain, Size: 5114 bytes --]

On 10/29/2016 03:11 AM, Rich Freeman wrote:
> On Sat, Oct 29, 2016 at 5:42 AM, Neil Bothwick <neil@digimed.co.uk> wrote:
>> On Fri, 28 Oct 2016 23:53:03 -0700, Daniel Campbell wrote:
>>
>>>>     Anyone seeing this again? I've just sync'd to two servers in
>>>> Australia, and then, for the hell of it, one in Canada and am getting
>>>> it for:
>>>>
>>>> dev-libs/botan
>>>> app-arch/tar
>>>> media-video/libav
>>>> app-crypt/qca
>>>> net-print/cups-filters
>>>>
>>>> I suppose time will sort it out.....
>>>>
>>>>     Andrew
>>>>
>>> This shouldn't happen unless the distfiles aren't found, or someone (a
>>> dev) didn't use repoman to commit, leaving an old Manifest around.
>>
>> It looks like repoman is the culprit
>>
>> https://bugs.gentoo.org/show_bug.cgi?id=598376
>>
> 
> This is probably not the issue here, since Gentoo uses thin manifests
> (there is nothing for repoman to update).  The manifests that are
> causing the problem aren't created by regular Gentoo developers.
> They're created by a script that runs as a part of the rsync mirror
> process.
> 
> This is a fairly well-known problem that has been around for over a year.
> 
> You will only run into this problem if you use rsync to update your
> repository, since the problem is created when creating the master
> rsync mirror.  The original git repository doesn't contain the error,
> and the git mirror on github doesn't mess with the Manifests.
> 
> The issue apparently has to do with Changelog generation.  In April
> the Council gave Infra the option to stop generating Changelogs, which
> would eliminate the problem.  I suspect those maintaining the scripts
> prefer to keep them around, and I don't think anybody on the Council
> has access to change the scripts.
> 
> I switched to git syncing eons ago, so I've never seen this bug.  I
> recognize it has been a source of frustration for a lot of users, and
> a bit of frustration for the Council, since there doesn't seem to be a
> lot we can do to change it in practice.
> 
> zlg is of course right that these kinds of problems can also be caused
> by maintainer failure to use repoman/etc or if an upstream distfile
> changes.  If that is the problem then you'll see it no matter how you
> sync your repo.  However, when you get a bunch of these after syncing
> it is almost always a result of the mirror creation process.  I can't
> remember the last time I saw a manifest error (granted, I'm also using
> mgorny's stable mirror branch, which I think screens for these kinds
> of errors).
> 
> While there can be some latency I do in general recommend syncing from
> https://github.com/gentoo-mirror/gentoo .  This is a mirror of the
> Gentoo developer git repository with two changes:
> 1.  Metadata is added to the mirror, which greatly speeds things up
> compared to using the raw git repository (you can do this yourself, it
> is one of the steps done by the rsync generation process as well, but
> this one is not buggy).
> 2.  The default stable branch of this mirror screens for numerous
> issues before accepting commits.  That means it is generally a little
> behind the main branch (at this moment the main branch is 2 minutes
> old, and the default stable branch is 20min old), but a lot of the
> really annoying issues that are caused by devs skipping repoman won't
> be seen.   Now, if a maintainer breaks a package then this mirror will
> quickly get out of date until the problem is corrected, but Gentoo QA
> gets warnings when this is happening and usually the maintainer is
> being pestered or somebody else is fixing it.  I suspect this process
> has probably reduced the error rate for everybody.  I have seen this
> get a few days old though, which is something to keep in mind.
> 
> It does not contain Changelogs, though if you use it you'll have a
> full history so you can just run git whatchanged <path> to get
> something pretty close to a changelog.
> 
> To use it just put this in /etc/portage/repos.conf/gentoo.conf:
> [DEFAULT]
> main-repo = gentoo
> 
> [gentoo]
> location = /usr/portage
> sync-type = git
> sync-uri = https://github.com/gentoo-mirror/gentoo.git
> auto-sync = yes
> 
> If you want to git-sync from some other mirror, just change the url accordingly.
> 
> If you switch your mirror I suggest just renaming /usr/portage and
> letting portage re-create it.
> 
> The other big benefit of git syncing is that if you sync every day it
> is a lot faster.  If you sync less often it will become slower
> compared to rsync.  git is much more efficient at finding what has
> changed, but rsync is not burdened with transferring a complete
> history.  If you only sync once every few months rsync will be a lot
> faster.
> 
Wow, quite the mail there! I actually wasn't aware of thin vs. thick
manifest issues (or mgorny's work on a stable mirror). Thanks for
sharing and teaching.

-- 
Daniel Campbell - Gentoo Developer
OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net
fpr: AE03 9064 AE00 053C 270C  1DE4 6F7A 9091 1EA0 55D6


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [gentoo-user] Digest verification failed

[Peter Humphrey]

On Saturday 29 Oct 2016 12:56:46 Andrew Lowe wrote:

> 	Anyone seeing this again? I've just sync'd to two servers in Australia,
> and then, for the hell of it, one in Canada and am getting it for:
> 
> dev-libs/botan
> app-arch/tar
> media-video/libav
> app-crypt/qca
> net-print/cups-filters

38,000 files were sync'd today here in UK, nearly all of them changelogs and 
manifests, and I now get three of your verification failures. The other ten 
upgrades are in progress at the moment.

> I suppose time will sort it out.....

Indeed.

-- 
Regards
Peter

[gentoo-user] Digest verification failed

[Robert Stockdale IV]

[-- Attachment #1: Type: text/plain, Size: 1476 bytes --]

I have been trying to complete a
glsa-check -f affected
for the past 2 days.
The latest problem I have encountered is:

>>> Downloading '
http://distfiles.gentoo.org/distfiles/firefox-2.0.0.11-source.tar.bz2'
--02:17:55--
http://distfiles.gentoo.org/distfiles/firefox-2.0.0.11-source.tar.bz2
           => `/usr/portage/distfiles/firefox-2.0.0.11-source.tar.bz2'
Resolving distfiles.gentoo.org... 156.56.247.195, 140.211.166.134,
216.165.129.135, ...
Connecting to distfiles.gentoo.org|156.56.247.195|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 37,480,419 (36M) [application/x-tar]

100%[====================================================================================================================>]
37,480,419   236.84K/s    ETA 00:00

02:20:36 (228.12 KB/s) - `/usr/portage/distfiles/firefox-
2.0.0.11-source.tar.bz2' saved [37480419/37480419]

 * mozilla-firefox-2.0.0.11-patches-0.5.tar.bz2 RMD160 SHA1 SHA256 size ;-)
...
[ ok ]
 * checking ebuild checksums ;-)
...
[ ok ]
 * checking auxfile checksums ;-)
...
[ ok ]
 * checking miscfile checksums ;-)
...
[ ok ]
 * checking firefox-2.0.0.11-source.tar.bz2 ;-)
...
[ !! ]

!!! Digest verification failed:
!!! /usr/portage/distfiles/firefox-2.0.0.11-source.tar.bz2
!!! Reason: Filesize does not match recorded size
!!! Got: 37480419
!!! Expected: 6794016

Is there a problem with the digest? Is there a work around? Any help would
be appreciated. If this is a bug, I'll report it.
Bob

[-- Attachment #2: Type: text/html, Size: 5157 bytes --]

Re: [gentoo-user] Digest verification failed

[Alexander Meinke]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Robert Stockdale IV wrote:
|  * checking firefox-2.0.0.11-source.tar.bz2 ;-)
| ...

| [ !! ]
|
| !!! Digest verification failed:
| !!! /usr/portage/distfiles/firefox-2.0.0.11-source.tar.bz2
| !!! Reason: Filesize does not match recorded size
| !!! Got: 37480419
| !!! Expected: 6794016
|
| Is there a problem with the digest? Is there a work around? Any help
| would be appreciated. If this is a bug, I'll report it.
| Bob

Maybe you should try emerge --sync before emerging firefox.


Regards,

acm.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.7 (GNU/Linux)

iD8DBQFHuDGcYCx19pTB5PERAp7OAJ4/I2X0c9QewMTNonz1CBQsh/0EuACePrhC
8qR4bYIiHGLikM6CEo/vRm8=
=SU1q
-----END PGP SIGNATURE-----
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] Digest verification failed

[Robert Stockdale IV]

[-- Attachment #1: Type: text/plain, Size: 1025 bytes --]

On Feb 17, 2008 8:07 AM, Alexander Meinke <ameinke@online.de> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Robert Stockdale IV wrote:
> |  * checking firefox-2.0.0.11-source.tar.bz2 ;-)
> | ...
>
> | [ !! ]
> |
> | !!! Digest verification failed:
> | !!! /usr/portage/distfiles/firefox-2.0.0.11-source.tar.bz2
> | !!! Reason: Filesize does not match recorded size
> | !!! Got: 37480419
> | !!! Expected: 6794016
> |
> | Is there a problem with the digest? Is there a work around? Any help
> | would be appreciated. If this is a bug, I'll report it.
> | Bob
>
> Maybe you should try emerge --sync before emerging firefox.
>
>
> Regards,
>
> acm.
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.7 (GNU/Linux)
>
> iD8DBQFHuDGcYCx19pTB5PERAp7OAJ4/I2X0c9QewMTNonz1CBQsh/0EuACePrhC
> 8qR4bYIiHGLikM6CEo/vRm8=
> =SU1q
> -----END PGP SIGNATURE-----
> --
> gentoo-user@lists.gentoo.org mailing list
>
>
I did "emerge --sync" I also ran eix-sync as well which does that and
more.Still have the same issue.
Bob

[-- Attachment #2: Type: text/html, Size: 1436 bytes --]

Re: [gentoo-user] Digest verification failed

[Kenneth Prugh]

[-- Attachment #1: Type: text/plain, Size: 1910 bytes --]

On Sun, 17 Feb 2008 08:03:21 -0500
"Robert Stockdale IV" <bobstockdale@gmail.com> wrote:

> I have been trying to complete a
> glsa-check -f affected
> for the past 2 days.
> The latest problem I have encountered is:
> 
> >>> Downloading '
> http://distfiles.gentoo.org/distfiles/firefox-2.0.0.11-source.tar.bz2'
> --02:17:55--
> http://distfiles.gentoo.org/distfiles/firefox-2.0.0.11-source.tar.bz2
>            => `/usr/portage/distfiles/firefox-2.0.0.11-source.tar.bz2'
> Resolving distfiles.gentoo.org... 156.56.247.195, 140.211.166.134,
> 216.165.129.135, ...
> Connecting to distfiles.gentoo.org|156.56.247.195|:80... connected.
> HTTP request sent, awaiting response... 200 OK
> Length: 37,480,419 (36M) [application/x-tar]
> 
> 100%[====================================================================================================================>]
> 37,480,419   236.84K/s    ETA 00:00
> 
> 02:20:36 (228.12 KB/s) - `/usr/portage/distfiles/firefox-
> 2.0.0.11-source.tar.bz2' saved [37480419/37480419]
> 
>  * mozilla-firefox-2.0.0.11-patches-0.5.tar.bz2 RMD160 SHA1 SHA256
> size ;-) ...
> [ ok ]
>  * checking ebuild checksums ;-)
> ...
> [ ok ]
>  * checking auxfile checksums ;-)
> ...
> [ ok ]
>  * checking miscfile checksums ;-)
> ...
> [ ok ]
>  * checking firefox-2.0.0.11-source.tar.bz2 ;-)
> ...
> [ !! ]
> 
> !!! Digest verification failed:
> !!! /usr/portage/distfiles/firefox-2.0.0.11-source.tar.bz2
> !!! Reason: Filesize does not match recorded size
> !!! Got: 37480419
> !!! Expected: 6794016
> 
> Is there a problem with the digest? Is there a work around? Any help
> would be appreciated. If this is a bug, I'll report it.
> Bob

A temporary solution:

cd /usr/portage/www-client/mozilla-firefox/ && rm Manifest && ebuild
mozilla-firefox-2.0.0.12.ebuild manifest

Then try to emerge it. 

-- 
Ken69267
Gentoo AMD64 AT

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Digest verification failed

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 974 bytes --]

On Sun, 17 Feb 2008 09:15:06 -0500, Kenneth Prugh wrote:

> A temporary solution:
> 
> cd /usr/portage/www-client/mozilla-firefox/ && rm Manifest && ebuild
> mozilla-firefox-2.0.0.12.ebuild manifest

s/temporary/terrible/

This message means that either the portage tree contains the wrong
checksum for a valid file, or that the file on your mirror has been
replaced by an altered version. Redigesting to fix this problem is like
fixing low oil pressure in your car by disconnecting the warning light.

By all means feel free to take his risk on your own system, but please
don't recommend others to do it without at least pointing out the
potentially serious consequences.

To the OP, it is possible that the Firefox archive was updated and you
still have an older one in $DISTDIR. Try deleting your copy and emerging
again. You could also try using a different mirror.


-- 
Neil Bothwick

"F*ck it" said Pooh, being more forthright than usual.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Digest verification failed

[Kenneth Prugh]

[-- Attachment #1: Type: text/plain, Size: 1369 bytes --]

On Sun, 17 Feb 2008 14:25:11 +0000
Neil Bothwick <neil@digimed.co.uk> wrote:

> On Sun, 17 Feb 2008 09:15:06 -0500, Kenneth Prugh wrote:
> 
> > A temporary solution:
> > 
> > cd /usr/portage/www-client/mozilla-firefox/ && rm Manifest && ebuild
> > mozilla-firefox-2.0.0.12.ebuild manifest
> 
> s/temporary/terrible/
> 
> This message means that either the portage tree contains the wrong
> checksum for a valid file, or that the file on your mirror has been
> replaced by an altered version. Redigesting to fix this problem is
> like fixing low oil pressure in your car by disconnecting the warning
> light.
> 
> By all means feel free to take his risk on your own system, but please
> don't recommend others to do it without at least pointing out the
> potentially serious consequences.
> 
> To the OP, it is possible that the Firefox archive was updated and you
> still have an older one in $DISTDIR. Try deleting your copy and
> emerging again. You could also try using a different mirror.
> 
> 

yawn, and if the download was invalid it would most likely fail to
untar or something similar. I fail to see the point. Either way, he can
delete it in distfiles and just remerge/remanifest so it grabs it off
the mirrors.

I also remember why I hate this mailing list and usually just mark all
read.

-- 
Ken69267
Gentoo AMD64 AT

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Digest verification failed

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 604 bytes --]

On Sun, 17 Feb 2008 09:32:25 -0500, Kenneth Prugh wrote:

> yawn, and if the download was invalid it would most likely fail to
> untar or something similar. I fail to see the point.

That's because you are assuming that all file corruption is accidental,
whereas the manifest system is designed to protect against malicious
corruption.

> I also remember why I hate this mailing list and usually just mark all
> read.

That is safer that advising people to override portage's security
precautions.


-- 
Neil Bothwick

Paranoia: A healthy understanding of the nature of the universe.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Digest verification failed

[Kenneth Prugh]

[-- Attachment #1: Type: text/plain, Size: 1093 bytes --]

On Sun, 17 Feb 2008 14:47:36 +0000
Neil Bothwick <neil@digimed.co.uk> wrote:

> On Sun, 17 Feb 2008 09:32:25 -0500, Kenneth Prugh wrote:
> 
> > yawn, and if the download was invalid it would most likely fail to
> > untar or something similar. I fail to see the point.
> 
> That's because you are assuming that all file corruption is
> accidental, whereas the manifest system is designed to protect
> against malicious corruption.
> 
> > I also remember why I hate this mailing list and usually just mark
> > all read.
> 
> That is safer that advising people to override portage's security
> precautions.
> 
> 

You're right I was assuming it was accidental. I also falsely assumed
he already tried another mirror of the file. 

I also don't think straight without breakfast, so I'm sorry about the
last email.. it wasn't very professional of me :>

On a side note: the reason I hate -user is it completely breaks claws
when it tries to thread it if there are unread :9. May need to nuke it
and regenerate everything from scratch.

-- 
Ken69267
Gentoo AMD64 AT

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Digest verification failed

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 539 bytes --]

On Sun, 17 Feb 2008 09:57:13 -0500, Kenneth Prugh wrote:

> I also don't think straight without breakfast, so I'm sorry about the
> last email.. it wasn't very professional of me :>

How does that differ from the rest of us? :-)

> On a side note: the reason I hate -user is it completely breaks claws
> when it tries to thread it if there are unread

I have no such problem here, but I have Claws set to show only unread
messages.


-- 
Neil Bothwick

"Bad dog! Leave that wire alone.....click.....###@*##....NO TERRIER

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Digest verification failed

[Robert Stockdale IV]

[-- Attachment #1: Type: text/plain, Size: 968 bytes --]

On Feb 17, 2008 7:15 PM, Neil Bothwick <neil@digimed.co.uk> wrote:

> On Sun, 17 Feb 2008 09:57:13 -0500, Kenneth Prugh wrote:
>
> > I also don't think straight without breakfast, so I'm sorry about the
> > last email.. it wasn't very professional of me :>
>
> How does that differ from the rest of us? :-)
>
> > On a side note: the reason I hate -user is it completely breaks claws
> > when it tries to thread it if there are unread
>
> I have no such problem here, but I have Claws set to show only unread
> messages.
>
>
> --
> Neil Bothwick
>
> "Bad dog! Leave that wire alone.....click.....###@*##....NO TERRIER
>

Thanks to everyone who helped. I realizes that a more recent version was
available and I'm emerging it now. When it is done I'll rerun glsa-check
again and let you know if it worked. I't has been some time since I ran a
Gentoo based system and I'm hoping I don't do something to break it. I hate
reinstalling as I usually loose files and time.
Bob

[-- Attachment #2: Type: text/html, Size: 1368 bytes --]

Re: [gentoo-user] Digest verification failed

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 569 bytes --]

On Tue, 19 Feb 2008 07:08:41 -0500, Robert Stockdale IV wrote:

> I't has been some time since I ran a
> Gentoo based system and I'm hoping I don't do something to break it. I
> hate reinstalling as I usually loose files and time.

With the time it takes for a full reinstall and the amount of
documentation available to help fix problems, I find it difficult to
think of a problem not involving dense smoke or horrible grinding noises
that is best fixed with a reinstall.


-- 
Neil Bothwick

Real women don't have hot flashes, they have power surges.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Digest verification failed

[Robert Stockdale IV]

[-- Attachment #1: Type: text/plain, Size: 899 bytes --]

On Feb 19, 2008 7:25 AM, Neil Bothwick <neil@digimed.co.uk> wrote:

> On Tue, 19 Feb 2008 07:08:41 -0500, Robert Stockdale IV wrote:
>
> > I't has been some time since I ran a
> > Gentoo based system and I'm hoping I don't do something to break it. I
> > hate reinstalling as I usually loose files and time.
>
> With the time it takes for a full reinstall and the amount of
> documentation available to help fix problems, I find it difficult to
> think of a problem not involving dense smoke or horrible grinding noises
> that is best fixed with a reinstall.
>
>
> --
> Neil Bothwick
>
> Real women don't have hot flashes, they have power surges.
>

Sabayon takes about 3 hours for a complete install and most of it is
performed automatically. I run the setup configuration at the beginning and
it lets me know when to reboot into the fresh install. Correcting a trashed
system could take days.
Bob

[-- Attachment #2: Type: text/html, Size: 1229 bytes --]

Re: [gentoo-user] Digest verification failed

[Etaoin Shrdlu]

On Sunday 17 February 2008, Kenneth Prugh wrote:

> > !!! Digest verification failed:
> > !!! /usr/portage/distfiles/firefox-2.0.0.11-source.tar.bz2
> > !!! Reason: Filesize does not match recorded size
> > !!! Got: 37480419
> > !!! Expected: 6794016
> >
> > Is there a problem with the digest? Is there a work around? Any help
> > would be appreciated. If this is a bug, I'll report it.
> > Bob
>
> A temporary solution:
>
> cd /usr/portage/www-client/mozilla-firefox/ && rm Manifest && ebuild
> mozilla-firefox-2.0.0.12.ebuild manifest

- he is having problem with 2.0.0.11, not 2.0.0.12
- wasn't manual digest regeneration considered a very Bad Thing?
- look at the expected size. It's much bigger than the actual size. This 
might be caused by a partially downloaded tarball 
in /usr/portage/distfiles. He might try 
rm /usr/portage/distfiles/firefox-2.0.0.11-source.tar.bz2 and try 
reemerging. That should download the correct tarball. 

To the OP: if you just synced, you can do "emerge mozilla-firefox" and 
get version 2.0.0.12, which is the current stable version, which I 
suppose also fixes the glsa problems (if the glsa is 200712-21).
-- 
gentoo-user@lists.gentoo.org mailing list

[gentoo-user] Digest verification Failed

[Daevid Vincent]

It seems lately (within the past few months), I am seeing a lot more of
these:

!!! Digest verification Failed:
!!!    /usr/portage/distfiles/foo-1.2.3.tar.gz
!!! Reason: Failed on MD5 verification

The problem (aside from the obvious) is that portage just shits the bed and
doesn't try to re-get the file (which would solve the problem more often
than not). Even if I manually "rm /usr/portage/distfiles/foo*" and emerge it
again, it's a crap-shoot if it will pass the Digest verification. Sometimes
I've tried as many as five or more times this obnoxious cycle and finally
said fsck it and just manually emerged the OTHER packages, hoping that in a
week or so, there will be a newer version of whatever the offending package
was and we can try this all over again with fingers crossed.

I would use --skipfirst, but that doesn't work with "emerge -Davu world"...
*sigh*.

Anyone know why the digests are failing so frequently? Are they packaged
poorly? Is it the mirror I'm getting them from? But then that begs the
question, aren't the mirrors synchronized and MD5 verified with each other?
Shouldn't TCP/IP be safe in that it retries a packet until it gets it -- and
therefore, why is the MD5 different?

-- 
gentoo-user@gentoo.org mailing list

RE: [gentoo-user] Digest verification Failed

[Dave Nebinger]

> Anyone know why the digests are failing so frequently? Are they packaged
> poorly? Is it the mirror I'm getting them from? But then that begs the
> question, aren't the mirrors synchronized and MD5 verified with each
> other?
> Shouldn't TCP/IP be safe in that it retries a packet until it gets it --
> and
> therefore, why is the MD5 different?

I haven't had any issues with md5 sums on recent packages and my systems are
updated pretty much daily (thus requiring frequent downloads).

When it has happened I had to delete the file from /usr/portage/distfiles in
order to fetch a clean copy.  And since I'm running http-replicator I will
also remove any cached copy and recycle http-replicator to ensure it is
starting from a clean state.  If you're using this or another cache/proxy
you'll want to ensure that you clean it out before retrying the fetch.

I'm not sure how the mirrors are synchronized but I would guess it's rsync
based.  There should not be any problems there.  I don't know if they check
the md5 sums on files pulled into the mirror, but I would guess they do not.

I'd look at your /var/log/emerge.log for errors dealing with the fetch.
Also check for filesystem errors if you're using a separate FS for the
/usr/portage space; it could be a read/write error associated with the disk
itself.




-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Digest verification Failed

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 342 bytes --]

On Tue, 19 Jul 2005 10:48:10 -0700, Daevid Vincent wrote:

> I would use --skipfirst, but that doesn't work with "emerge -Davu
> world"... *sigh*.

--skipfirst only works in conjunction with --resume

emerge -avuD world
something fails
emerge --resume --skipfirst


-- 
Neil Bothwick

Another casualty of applied metaphysics.

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Digest verification Failed

[Petteri Räty]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daevid Vincent wrote:
> It seems lately (within the past few months), I am seeing a lot more of
> these:
> 
> !!! Digest verification Failed:
> !!!    /usr/portage/distfiles/foo-1.2.3.tar.gz
> !!! Reason: Failed on MD5 verification
> 

This is probably because FEATURES="strict" is now the default. If the is
cvs commit going on when the sync from cvs to rsync happens you could
have wrong manifest and so on. Developers could also forget to run
ebuild digest but that should not happen very often (the devs should
know how to do things). Maybe moving the svn could help these problems
because you have atomic operations. Usually these problems are solved by
waiting a while and syncing again.

Regards,
Petteri Räty
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFC3oT1cxLzpIGCsLQRAszFAJ0XpnW7pX2+qr8wjQFy9M1/34kLywCbB5pE
cwOlw0CX8/xyT/330zuBPEE=
=OkLR
-----END PGP SIGNATURE-----
-- 
gentoo-user@gentoo.org mailing list