gdk-pixbuf2: fetching from mirror fails

[petrrr]

I observe the following problem when trying to update gdk-pixbuf2:

petr% sudo port -v checksum gdk-pixbuf2
--->  Fetching distfiles for gdk-pixbuf2
--->  gdk-pixbuf-2.31.2.tar.xz doesn't seem to exist in /opt/local/var/macports/distfiles/gdk-pixbuf2
--->  Attempting to fetch gdk-pixbuf-2.31.2.tar.xz from http://fco.it.distfiles.macports.org/mirrors/macports-distfiles/gdk-pixbuf2
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1350  100  1350    0     0   2465      0 --:--:-- --:--:-- --:--:--  2468
--->  Verifying checksums for gdk-pixbuf2
--->  Checksumming gdk-pixbuf-2.31.2.tar.xz
Error: Checksum (rmd160) mismatch for gdk-pixbuf-2.31.2.tar.xz
Portfile checksum: gdk-pixbuf-2.31.2.tar.xz rmd160 6b36559fbbb0153c2c83a7df4ca70590e05f16bb
Distfile checksum: gdk-pixbuf-2.31.2.tar.xz rmd160 9478588eed20b5e15a9dc39f906b71d285be98ab
Error: Checksum (sha256) mismatch for gdk-pixbuf-2.31.2.tar.xz
Portfile checksum: gdk-pixbuf-2.31.2.tar.xz sha256 9e467ed09894c802499fb2399cd9a89ed21c81700ce8f27f970a833efb1e47aa
Distfile checksum: gdk-pixbuf-2.31.2.tar.xz sha256 df734cdf13e89d5545f341d440981803fe90ada80994773b011000ace43b0813
***
The non-matching file appears to be HTML. See this page for possible reasons
for the checksum mismatch:
<https://trac.macports.org/wiki/MisbehavingServers>
***
The file has been moved to: /opt/local/var/macports/distfiles/gdk-pixbuf2/gdk-pixbuf-2.31.2.tar.xz.html
Error: org.macports.checksum for port gdk-pixbuf2 returned: Unable to verify file checksums
Warning: targets not executed for gdk-pixbuf2: org.macports.checksum
Please see the log file for port gdk-pixbuf2 for details:
    /opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_graphics_gdk-pixbuf2/gdk-pixbuf2/main.log
To report a bug, follow the instructions in the guide:
    http://guide.macports.org/#project.tickets
Error: Processing of port gdk-pixbuf2 failed

The problem is apparently due to the mirror ​http://fco.it.distfiles.macports.org/mirrors/macports-distfiles/gdk-pixbuf2/ itself. When I try to fetch from this mirror manually I get a Security Alert instead.

Curiously, when I fetch from ​https://git.gnome.org/browse/gdk-pixbuf, I get a different checksum again:

petr% wget --no-check-certificate https://git.gnome.org/browse/gdk-pixbuf/snapshot/gdk-pixbuf-2.31.2.tar.xz
--2015-01-21 14:46:17--  https://git.gnome.org/browse/gdk-pixbuf/snapshot/gdk-pixbuf-2.31.2.tar.xz
Resolving git.gnome.org (git.gnome.org)... 209.132.180.184
Connecting to git.gnome.org (git.gnome.org)|209.132.180.184|:443... connected.
WARNING: The certificate of ‘git.gnome.org’ is not trusted.
WARNING: The certificate of ‘git.gnome.org’ hasn't got a known issuer.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/x-xz]
Saving to: ‘gdk-pixbuf-2.31.2.tar.xz’

gdk-pixbuf-2.31.2.tar.xz               [             <=>                                                ]   1.16M   278KB/s   in 4.3s   

2015-01-21 14:46:22 (278 KB/s) - ‘gdk-pixbuf-2.31.2.tar.xz’ saved [1219472]

petr% openssl sha256 gdk-pixbuf-2.31.2.tar.xz
SHA256(gdk-pixbuf-2.31.2.tar.xz)= 62b52784b574bc4ed2ebf619d79e85cc63ccd32e63850884ab3f6f4964c17d7f

[dbevans (David B. Evans)]

Possibly a transient problem with the given mirror. However, I cannot reproduce the problem.

Manually fetching gives

$ wget --no-check-certificate http://fco.it.distfiles.macports.org/mirrors/macports-distfiles/gdk-pixbuf2/gdk-pixbuf-2.31.2.tar.xz
--2015-01-21 07:30:24--  http://fco.it.distfiles.macports.org/mirrors/macports-distfiles/gdk-pixbuf2/gdk-pixbuf-2.31.2.tar.xz
Resolving fco.it.distfiles.macports.org (fco.it.distfiles.macports.org)... 193.206.139.34, 2001:760:ffff:b1::34
Connecting to fco.it.distfiles.macports.org (fco.it.distfiles.macports.org)|193.206.139.34|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1624496 (1.5M) [text/plain]
Saving to: ‘gdk-pixbuf-2.31.2.tar.xz’

gdk-pixbuf-2.31.2.tar.xz                 100%[=================================================================================>]   1.55M   628KB/s   in 2.5s   

2015-01-21 07:30:27 (628 KB/s) - ‘gdk-pixbuf-2.31.2.tar.xz’ saved [1624496/1624496]

$ openssl sha256 gdk-pixbuf-2.31.2.tar.xz
SHA256(gdk-pixbuf-2.31.2.tar.xz)= 9e467ed09894c802499fb2399cd9a89ed21c81700ce8f27f970a833efb1e47aa

which agress with the port checksum.

It is not surprising that the git snapshot has a different checksum since git snapshots often have file content that is not included in the distributed tarball.

The official GNOME download URL is ​http://ftp.gnome.org/pub/gnome/sources or one of the other GNOME mirrors.

Fetching the tarball from that site gives the same checksum

$ wget --no-check-certificate http://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/2.31/gdk-pixbuf-2.31.2.tar.xz
--2015-01-21 07:44:54--  http://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/2.31/gdk-pixbuf-2.31.2.tar.xz
Resolving ftp.gnome.org (ftp.gnome.org)... 2001:6b0:e:2018::165, 2001:6b0:e:2018::163, 2001:6b0:e:2018::173, ...
Connecting to ftp.gnome.org (ftp.gnome.org)|2001:6b0:e:2018::165|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1624496 (1.5M) [application/x-xz]
Saving to: ‘gdk-pixbuf-2.31.2.tar.xz.1’

gdk-pixbuf-2.31.2.tar.xz.1               100%[=================================================================================>]   1.55M   432KB/s   in 12s    

2015-01-21 07:45:08 (129 KB/s) - ‘gdk-pixbuf-2.31.2.tar.xz.1’ saved [1624496/1624496]

$ openssl sha256 gdk-pixbuf-2.31.2.tar.xz.1
SHA256(gdk-pixbuf-2.31.2.tar.xz.1)= 9e467ed09894c802499fb2399cd9a89ed21c81700ce8f27f970a833efb1e47aa

which also agrees with the port's checksum as well as the official checksum ​http://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/2.31/gdk-pixbuf-2.31.2.sha256sum

6e78c1317197bf2e7fa966b756007b05dadd787e50bcb6acc2270a7675cf9a13  gdk-pixbuf-2.31.2.news
9e467ed09894c802499fb2399cd9a89ed21c81700ce8f27f970a833efb1e47aa  gdk-pixbuf-2.31.2.tar.xz