bsdmake @24_1 checksum mismatch

[OlivierDoriath]

Hello!

I'm trying to install xorg-server on a fresh installation of MacPorts and I get an error. I checked out all the links from which MacPorts is trying to fetch bsdmake-24_1.darwin_22.arm64.tbz2 from, and none of them have the file at all. I tried Googling the file name and it doesn't seem to be available or mentioned anywhere, so I figured I'd post a ticket about it.

[OlivierDoriath]

main.log

[jmroot (Joshua Root)]

I'm not able to reproduce this, FWIW:

% sudo port -v checksum bsdmake
Password:
--->  Fetching distfiles for bsdmake
--->  bsdmake-24.tar.gz does not exist in /opt/local/var/macports/distfiles/bsdmake/24_1
--->  Attempting to fetch bsdmake-24.tar.gz from http://opensource.apple.com/tarballs/bsdmake
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   257  100   257    0     0   6603      0 --:--:-- --:--:-- --:--:--  7138
100   257  100   257    0     0   3107      0 --:--:-- --:--:-- --:--:--  3107
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  232k    0  232k    0     0   298k      0 --:--:-- --:--:-- --:--:--  298k
--->  Verifying checksums for bsdmake
--->  Checksumming bsdmake-24.tar.gz

[OlivierDoriath]

Edit: I just installed MacPorts but runnning

sudo port clean --all installed

Seems to have fixed it. I can't explain it and I'm new to this. Sorry!

This is what I get with the same command.

% sudo port -v checksum bsdmake
--->  Verifying checksums for bsdmake
--->  Checksumming bsdmake-24.tar.gz
Error: Checksum (rmd160) mismatch for bsdmake-24.tar.gz
Portfile checksum: bsdmake-24.tar.gz rmd160 1f08d49704391725cc304c455ead7e48103fd8cf
Distfile checksum: bsdmake-24.tar.gz rmd160 af5c25248ddfd36691525ab1ac2cd2c0fc1ae5f3
Error: Checksum (sha256) mismatch for bsdmake-24.tar.gz
Portfile checksum: bsdmake-24.tar.gz sha256 096f333f94193215931a9fab86b9bca0713fbd22ec465bf55510067b53940e62
Distfile checksum: bsdmake-24.tar.gz sha256 d272227f3ea074c95c8b87620fddf114813ea3fbd6351d7dd380af0da808a4c6
Error: Checksum (size) mismatch for bsdmake-24.tar.gz
Portfile checksum: bsdmake-24.tar.gz size 238536
Distfile checksum: bsdmake-24.tar.gz size 238692
The correct checksum line may be:
checksums           rmd160  af5c25248ddfd36691525ab1ac2cd2c0fc1ae5f3 \
                    sha256  d272227f3ea074c95c8b87620fddf114813ea3fbd6351d7dd380af0da808a4c6 \
                    size    238692
Error: Failed to checksum bsdmake: Unable to verify file checksums
Error: See /opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_devel_bsdmake/bsdmake/main.log for details.
Error: Follow https://guide.macports.org/#project.tickets if you believe there is a bug.
Error: Processing of port bsdmake failed

[jsalort (Julien Salort)]

I just downloaded directly from GitHub at ​https://github.com/apple-oss-distributions/bsdmake/releases/tag/bsdmake-24, and compared the file to that downloaded by MacPorts, and they differ. However, according to GitHub, the files haven't changed since 2009.

% openssl dgst -rmd160 /opt/local/var/macports/distfiles/bsdmake/24_1/bsdmake-24.tar.gz 
RIPEMD-160(/opt/local/var/macports/distfiles/bsdmake/24_1/bsdmake-24.tar.gz)= af5c25248ddfd36691525ab1ac2cd2c0fc1ae5f3
% openssl dgst -rmd160 ~/Downloads/bsdmake-bsdmake-24.tar.gz 
RIPEMD-160(/Users/jsalort/Downloads/bsdmake-bsdmake-24.tar.gz)= 1f08d49704391725cc304c455ead7e48103fd8cf

The rmd160 of the file directly downloaded matches the checksum of the Portfile. So the workaround for me was:

sudo mv ~/Downloads/bsdmake-bsdmake-24.tar.gz /opt/local/var/macports/distfiles/bsdmake/24_1/bsdmake-24.tar.gz
sudo port install bsdmake

I wonder if it is somehow related to the problem I am facing with py-rawpy (​https://github.com/macports/macports-ports/pull/17535).

[jsalort (Julien Salort)]

Offending tar gz with rmd160=af5c25248ddfd36691525ab1ac2cd2c0fc1ae5f3

[jsalort (Julien Salort)]

Good tar.gz with rmd160=1f08d49704391725cc304c455ead7e48103fd8cf

[jsalort (Julien Salort)]

What is strange is that once extracted, the files are actually all similar. I attached the offending tar.gz with wrong checksum, and the good tar.gz with the correct checksum. They both create similar files, with no difference.

[ryandesign (Ryan Carsten Schmidt)]

Yes, that's what I found in another ticket about a different port. There may be an issue with the way that GitHub is serving these files.

[ryandesign (Ryan Carsten Schmidt)]

This appears to have been ​a problem on GitHub that was resolved:

January 30 18:35 UTC (lasting 7 hours)

We upgraded our production Git binary with a recent version from upstream. The updates included a change to use an internal implementation of gzip when generating archives. This resulted in subtle changes to the contents of the “Download Source” links served by GitHub, leading to checksum mismatches. No content was changed.

After becoming aware of the impact to many communities, we rolled back the compression change to restore the previous behavior.

Similar to the above, we are still investigating the contributing factors of this incident, and will provide a more thorough update in next month’s report.