Re: [gentoo-user] getting digest verification failed when emerging bittorrent

[Alan McKinnon <alan.mckinnon@gmail.com>]

On Sunday 08 March 2009 07:06:22 John covici wrote:
> on Saturday 03/07/2009 Dale(rdalek1967@gmail.com) wrote
>
>  > Alan McKinnon wrote:
>  > > On Saturday 07 March 2009 23:20:38 John covici wrote:
>  > >> Hi.  I am getting digest verification failed when trying to emerge
>  > >> bittorrent -- it is having trouble with the Changelog file.  The
>  > >> exact message is:
>  > >> !!! Digest verification failed:
>  > >> !!! /usr/portage/net-p2p/bittorrent/ChangeLog
>  > >> !!! Reason: Filesize does not match recorded size
>  > >> !!! Got: 19308
>  > >> !!! Expected: 19466
>  > >>
>  > >> Is there a new ebuild coming?
>  > >
>  > > wait 24 hours, resync, try again.
>  > >
>  > > Or just re-digest the package manually:
>  > >
>  > > ebuild <path_to_ebuild_file> manifest
>  >
>  > Does emerge --digest still exist?  I recall using something like that a
>  > long time ago.  I think I used it for googleforearth which never
>  > matches.
>
> OK, thanks I was hoping something like that would work.

As others have already said (but the importance of it got lost in the ensuing 
retorts), you have to be careful not to redigest stuff arbitrarily. This case 
was a mere Changelog which doesn't affect the built binaries and hence is 
safe.

Most digest failures are for one of two reasons:

1. Proprietary binaries that don't think it necessary to tell their customers 
which version they are getting. They must think customer's are psychic,
2. The developer goofed and forgot to upload one or more changed files.

The dangerous case that digests are designed to help you with is malicious 
changes where you get a trojan. This danger is real and you should take it 
seriously. The fact that I've never actually *seen* it happen doesn't mean 
anything and isn't even relevant.


-- 
alan dot mckinnon at gmail dot com