curl-ca-bundle @7.43.0: Checksum mismatch for certdata-aa275ad846f1.tar.bz2

[ph@…]

Trying to install gnuplot, the installation failed when installing the dependency curl-ca-bundle. There seems to be a checksums issue. I tried several times, cleaning the installation with

sudo port clean --all curl-ca-bundle

with the same checksum error. Here's the log:

--->  Fetching archive for curl-ca-bundle
--->  Attempting to fetch curl-ca-bundle-7.43.0_0.darwin_9.noarch.tbz2 from http://lil.fr.packages.macports.org/curl-ca-bundle
--->  Attempting to fetch curl-ca-bundle-7.43.0_0.darwin_9.noarch.tbz2 from http://mse.uk.packages.macports.org/sites/packages.macports.org/curl-ca-bundle
--->  Attempting to fetch curl-ca-bundle-7.43.0_0.darwin_9.noarch.tbz2 from http://nue.de.packages.macports.org/macports/packages/curl-ca-bundle
--->  Fetching distfiles for curl-ca-bundle
--->  Attempting to fetch curl-7.43.0.tar.bz2 from http://curl.haxx.se/download/
--->  Attempting to fetch certdata-aa275ad846f1.tar.bz2 from http://hg.mozilla.org/mozilla-central/archive/aa275ad846f1.tar.bz2/security/nss/lib/ckfw/builtins/certdata.txt?dummy=
--->  Verifying checksums for curl-ca-bundle                                                 
Error: Checksum (rmd160) mismatch for certdata-aa275ad846f1.tar.bz2
Error: Checksum (sha256) mismatch for certdata-aa275ad846f1.tar.bz2
Error: org.macports.checksum for port curl-ca-bundle returned: Unable to verify file checksums
Error: Failed to install curl-ca-bundle
Please see the log file for port curl-ca-bundle for details:
    /opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_curl/curl-ca-bundle/main.log

[ph@…]

I updated Mozilla Firefox on my computer, then the checksums worked and the installation completed normally.... Dunno if there's a link or not with the Mozilla Firefox update though... Patrice

[ryandesign (Ryan Carsten Schmidt)]

I can confirm this. The tar.bz2 file the Mozilla server delivers today is different from the one it delivered to us when we originally updated curl-ca-bundle to its current version in r135276 on April 21, 2015. Notably, the tar files inside the two tar.bz2 files are identical, as are the files inside the two identical tar files. I'm not sure why the Mozilla server would be doing different bzip2 compression of its tarballs today than it did in April. But the tarballs are automatically generated, so it's likely they don't keep the generated tarballs around indefinitely, and it's possible that since the last time the tarball was generated, they changed the version of their bzip2 software, or changed the options with which it is invoked, such that the compressed result differs.

The fact that it started working after you updated Firefox can only be a coincidence. It's more likely that when you cleaned and tried again after updating Firefox, MacPorts happened to try to download the file from our mirror servers (which have the old file with the correct checksums) instead of the Mozilla server (which now has the new file with the different checksums).

[ryandesign (Ryan Carsten Schmidt)]

Temporary workaround committed in r138396.