erlang port - broken checksums

[mouse07410 (Mouse)]

Mac OS X 10.10.5, Xcode-7.2.1, current Macports.

  port upgrade outdated
--->  Computing dependencies for erlang
--->  Fetching archive for erlang
--->  Attempting to fetch erlang-18.3_0+hipe+ssl+wxwidgets.darwin_14.x86_64.tbz2 from https://packages.macports.org/erlang
--->  Attempting to fetch erlang-18.3_0+hipe+ssl+wxwidgets.darwin_14.x86_64.tbz2 from http://fco.it.packages.macports.org/mirrors/macports-packages/erlang/erlang
--->  Attempting to fetch erlang-18.3_0+hipe+ssl+wxwidgets.darwin_14.x86_64.tbz2 from http://her.gr.packages.macports.org/erlang
--->  Fetching distfiles for erlang
--->  Verifying checksums for erlang
Error: Checksum (rmd160) mismatch for otp_src_18.3.tar.gz
Error: Checksum (sha256) mismatch for otp_src_18.3.tar.gz
Error: Checksum (rmd160) mismatch for otp_doc_man_18.3.tar.gz
Error: Checksum (sha256) mismatch for otp_doc_man_18.3.tar.gz
Error: Checksum (rmd160) mismatch for otp_doc_html_18.3.tar.gz
Error: Checksum (sha256) mismatch for otp_doc_html_18.3.tar.gz
Error: org.macports.checksum for port erlang returned: Unable to verify file checksums
Please see the log file for port erlang for details:
    /opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_lang_erlang/erlang/main.log
Error: Unable to upgrade port: 1
To report a bug, follow the instructions in the guide:
    http://guide.macports.org/#project.tickets
$ 

Attaching the log file.

[mouse07410 (Mouse)]

/opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_lang_erlang/erlang/main.log

[ci42]

The checksums are correct and checked against ​http://erlang.org/download/MD5.

[mouse07410 (Mouse)]

MD5 has been deprecated more than a decade ago. Macports seems to be using rmd160 and sha256 - see the log attached above. Here's the excerpt:

:debug:checksum checksum phase started at Mon Apr  4 09:52:13 EDT 2016
37	:notice:checksum --->  Verifying checksums for erlang
38	:debug:checksum Executing org.macports.checksum (erlang)
39	:info:checksum --->  Checksumming otp_src_18.3.tar.gz
40	:debug:checksum Calculated (rmd160) is fa1e34aed74147096f48252af0e8e45afd194429
41	:error:checksum Checksum (rmd160) mismatch for otp_src_18.3.tar.gz
42	:info:checksum Portfile checksum: otp_src_18.3.tar.gz rmd160 290044d1b466c525beaaa0d7d9d83405d7b9cc63
43	:info:checksum Distfile checksum: otp_src_18.3.tar.gz rmd160 fa1e34aed74147096f48252af0e8e45afd194429
44	:debug:checksum Calculated (sha256) is 0e24e32ca4912b7b08d6b8e33c25c107486da410f6c8d56ef81b17f018b0c614
45	:error:checksum Checksum (sha256) mismatch for otp_src_18.3.tar.gz
46	:info:checksum Portfile checksum: otp_src_18.3.tar.gz sha256 fdab8129a1cb935db09f1832e3a7d511a4aeb2b9bb3602ca6a7ccb9730d5c9c3
47	:info:checksum Distfile checksum: otp_src_18.3.tar.gz sha256 0e24e32ca4912b7b08d6b8e33c25c107486da410f6c8d56ef81b17f018b0c614
48	:info:checksum --->  Checksumming otp_doc_man_18.3.tar.gz
49	:debug:checksum Calculated (rmd160) is 0755d0dc250a4f63aa981eac9c6331e2e6380908
50	:error:checksum Checksum (rmd160) mismatch for otp_doc_man_18.3.tar.gz
51	:info:checksum Portfile checksum: otp_doc_man_18.3.tar.gz rmd160 d58d6d6e1c4c9c4011ea9d7b2c0fa6e8693021e9
52	:info:checksum Distfile checksum: otp_doc_man_18.3.tar.gz rmd160 0755d0dc250a4f63aa981eac9c6331e2e6380908
53	:debug:checksum Calculated (sha256) is 4e8f57e663ded2eb4ac11d1df93c1ba0db325aca3910ce97b9f047343b67b9d3
54	:error:checksum Checksum (sha256) mismatch for otp_doc_man_18.3.tar.gz
55	:info:checksum Portfile checksum: otp_doc_man_18.3.tar.gz sha256 978be100e9016874921b3ad1a65ee46b7b6a1e597b8db2ec4b5ef436d4c9ecc2
56	:info:checksum Distfile checksum: otp_doc_man_18.3.tar.gz sha256 4e8f57e663ded2eb4ac11d1df93c1ba0db325aca3910ce97b9f047343b67b9d3
57	:info:checksum --->  Checksumming otp_doc_html_18.3.tar.gz
58	:debug:checksum Calculated (rmd160) is 6fa6c5cbbe810a41c5b0ac2d3e545417514172b3
59	:error:checksum Checksum (rmd160) mismatch for otp_doc_html_18.3.tar.gz
60	:info:checksum Portfile checksum: otp_doc_html_18.3.tar.gz rmd160 ce852db50268f0738723ba6afa69a2218784f856
61	:info:checksum Distfile checksum: otp_doc_html_18.3.tar.gz rmd160 6fa6c5cbbe810a41c5b0ac2d3e545417514172b3
62	:debug:checksum Calculated (sha256) is 6e8525541341b3beef25ba00f26b584e32d7abaef4b837fb087613ebc3623f10
63	:error:checksum Checksum (sha256) mismatch for otp_doc_html_18.3.tar.gz
64	:info:checksum Portfile checksum: otp_doc_html_18.3.tar.gz sha256 8fd6980fd05367735779a487df107ace7c53733f52fbe56de7ca7844a355676f
65	:info:checksum Distfile checksum: otp_doc_html_18.3.tar.gz sha256 6e8525541341b3beef25ba00f26b584e32d7abaef4b837fb087613ebc3623f10
66	:info:checksum The correct checksum line may be:
67	:info:checksum checksums           otp_src_18.3.tar.gz \
68	                    rmd160  fa1e34aed74147096f48252af0e8e45afd194429 \
69	                    sha256  0e24e32ca4912b7b08d6b8e33c25c107486da410f6c8d56ef81b17f018b0c614 \
70	                    otp_doc_man_18.3.tar.gz \
71	                    rmd160  0755d0dc250a4f63aa981eac9c6331e2e6380908 \
72	                    sha256  4e8f57e663ded2eb4ac11d1df93c1ba0db325aca3910ce97b9f047343b67b9d3 \
73	                    otp_doc_html_18.3.tar.gz \
74	                    rmd160  6fa6c5cbbe810a41c5b0ac2d3e545417514172b3 \
75	                    sha256  6e8525541341b3beef25ba00f26b584e32d7abaef4b837fb087613ebc3623f10
76	:error:checksum org.macports.checksum for port erlang returned: Unable to verify file checksums

[larryv (Lawrence Velázquez)]

Replying to uri@…:

MD5 has been deprecated more than a decade ago.

That’s not really relevant unless you’re worried about an active attacker.

In any case, I just downloaded the files from the Erlang website and am not seeing the mismatch.

% openssl dgst -rmd160 ~/Downloads/otp_*
RIPEMD160(/Users/larryv/Downloads/otp_doc_html_18.3.tar.gz)= ce852db50268f0738723ba6afa69a2218784f856
RIPEMD160(/Users/larryv/Downloads/otp_doc_man_18.3.tar.gz)= d58d6d6e1c4c9c4011ea9d7b2c0fa6e8693021e9
RIPEMD160(/Users/larryv/Downloads/otp_src_18.3.tar.gz)= 290044d1b466c525beaaa0d7d9d83405d7b9cc63
% openssl dgst -sha256 ~/Downloads/otp_*
SHA256(/Users/larryv/Downloads/otp_doc_html_18.3.tar.gz)= 8fd6980fd05367735779a487df107ace7c53733f52fbe56de7ca7844a355676f
SHA256(/Users/larryv/Downloads/otp_doc_man_18.3.tar.gz)= 978be100e9016874921b3ad1a65ee46b7b6a1e597b8db2ec4b5ef436d4c9ecc2
SHA256(/Users/larryv/Downloads/otp_src_18.3.tar.gz)= fdab8129a1cb935db09f1832e3a7d511a4aeb2b9bb3602ca6a7ccb9730d5c9c3

It is possible your distfiles were corrupted locally or are corrupted on one of our mirrors, which would be unfortunate. Run sudo port clean --all erlang and try installing again. Then, if you still see a mismatch, provide the new log so we can see where the distfiles were downloaded from.