cargo-c @0.9.16_0: Unable to verify file checksums

[mslaskawski]

Unable to verify checksums on macOS Ventura 13.2 with Xcode Version 14.1 (14B47b) installed

Error: Checksum (rmd160) mismatch for cargo-c-0.9.16.tar.gz
Error: Checksum (sha256) mismatch for cargo-c-0.9.16.tar.gz
Error: Checksum (size) mismatch for cargo-c-0.9.16.tar.gz
Error: Failed to checksum cargo-c: Unable to verify file checksums

[MarcusCalhoun-Lopez (Marcus Calhoun-Lopez)]

As a first step, could you please post a clean build log for the failed attempt?
As another data point, could you also please try sudo port clean --all cargo-c && sudo port install cargo-c master_sites=macports_distfiles

[ryandesign (Ryan Carsten Schmidt)]

We have had at least four other tickets in the past week about checksum errors that we haven't been able to explain with ports that download from GitHub, which cargo-c does as well; we suspect GitHub is sometimes serving different files than we expect. Perhaps some of their servers are configured to generate these files with different gzip compression settings. (In the other tickets, we've found that although the gz file is different, the tar file inside is identical.) Please see wiki:FAQ#checksums and attach a main.log file that shows that server the bad file is being downloaded from. If you follow Marcus's suggestion, then the server you download from should be a MacPorts mirror, which should have the correct file (unless one of our mirrors is compromised or misconfigured), so while that should help you install the port I suspect it won't help us narrow down where the problem is and how to fix it.

[mslaskawski]

As suggested in the previous comment, I executed the commands:

$ sudo port selfupdate
$ sudo port clean --dist cargo-c
$ sudo port install cargo-c

As a result, the port was downloaded, the checksum verification was successful which allowed me to install the port successfully. So the problem seems to be solved.

Thank you for your help.

As an attachment, I am sending the main.log file obtained before executing the aforementioned commands.

[ryandesign (Ryan Carsten Schmidt)]

This appears to have been ​a problem on GitHub that was resolved:

January 30 18:35 UTC (lasting 7 hours)

We upgraded our production Git binary with a recent version from upstream. The updates included a change to use an internal implementation of gzip when generating archives. This resulted in subtle changes to the contents of the “Download Source” links served by GitHub, leading to checksum mismatches. No content was changed.

After becoming aware of the impact to many communities, we rolled back the compression change to restore the previous behavior.

Similar to the above, we are still investigating the contributing factors of this incident, and will provide a more thorough update in next month’s report.