port:zstd: different tarballs on distfiles.macports.org and github?!

[RJVB (René Bertin)]

Not sure where to report this and if it's not somehow related to where I connect from:

https://github.com/facebook/zstd/tarball/v1.3.8/zstd-1.3.8.tar.gz:

checksums           rmd160  c38a816a365566ebe86be35113e31830c4532b09 \
                    sha256  0012ee7b1f385a34cae12afe09c74b1c3f90afd00fadfcff3092d7bbc02b840c \
                    size    1875516

https://distfiles.macports.org/zstd/zstd-1.3.8.tar.gz:

checksums           rmd160  bdd8607b5fa2382290e8b17daf6e8e97c6d1840c \
                    sha256  293fa004dfacfbe90b42660c474920ff27093e3fb6c99f7b76e6083b21d6d48e \
                    size    1862954

If github has a habit of re-generating tarballs maybe the github PG should fetch from there first before falling back to the mirrors?

[chrstphrchvz (Christopher Chavez)]

If I set macports.conf to try github.com first, I get the correct checksums (I am doing this from San Antonio, Texas):

$ sudo port -d checksum zstd
[…]
--->  Fetching distfiles for zstd
[…]
--->  zstd-1.3.8.tar.gz does not exist in /opt/local/var/macports/distfiles/zstd
--->  Attempting to fetch zstd-1.3.8.tar.gz from https://github.com/facebook/zstd/releases/download/v1.3.8
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   607    0   607    0     0   2099      0 --:--:-- --:--:-- --:--:--  2100
100 1819k  100 1819k    0     0   759k      0  0:00:02  0:00:02 --:--:-- 1130k
[…]
--->  Verifying checksums for zstd
DEBUG: Executing org.macports.checksum (zstd)
--->  Checksumming zstd-1.3.8.tar.gz
DEBUG: Calculated (rmd160) is bdd8607b5fa2382290e8b17daf6e8e97c6d1840c
DEBUG: Correct (rmd160) checksum for zstd-1.3.8.tar.gz
DEBUG: Calculated (sha256) is 293fa004dfacfbe90b42660c474920ff27093e3fb6c99f7b76e6083b21d6d48e
DEBUG: Correct (sha256) checksum for zstd-1.3.8.tar.gz
DEBUG: Calculated (size) is 1862954
DEBUG: Correct (size) checksum for zstd-1.3.8.tar.gz

This matches the published ​zstd-1.3.8.tar.gz.sha256 file on their fancy (not-automatically-created?) ​GitHub releases page.

[chrstphrchvz (Christopher Chavez)]

I now spot the discrepancy here: the reporter's machine used a tags tarball URL (and I confirm it produces the alternative checksums the reporter observed), but the portfile has specified to use a releases tarball URL since it was ​updated to 1.3.7.

Why was the reporter's machine using a tags tarball URL and not the release tarball URL? The GitHub portgroup was last changed months prior to the update to zstd.

[RJVB (René Bertin)]

Good eye. I have a local clone of port:zstd which I thought identical in the crucial parts (it supposed to add only tweaks the AR, NM and RANLIB env. variables). I must have missed the tarball_from change after I forked the port. Sorry for the noise.

[kurthindenburg (Kurt Hindenburg)]

closing per comments