bug#27556: libpng has wrong hash. [Fwd: Re: why has the hash for libpng-apng 1.6.28 changed?]

[Efraim Flashner]

On Wed, Jul 26, 2017 at 06:56:51AM +0000, ng0 wrote:
> Leo Famulari transcribed 2.3K bytes:
> > On Sun, Jul 23, 2017 at 10:15:47AM +0000, ng0 wrote:
> > > ----- Forwarded message -----
> > > 
> > > > Date: Sun, 23 Jul 2017 18:21:19 +0900 (JST)
> > > > To: ng0
> > > > Cc: address@hidden
> > > > Subject: Re: why has the hash for libpng-apng 1.6.28 changed?
> > > > 
> > > > Hi,
> > > > 
> > > > I calculated the hash for libpng-apng files on my local orignals.
> > > > 
> > > > md5sum
> > > > 9f2b36bccf89c5f4097111f0f73c1798  libpng-1.6.28-apng.patch.README.txt
> > > > fca7c6d87c8352e645facefc2e1dd153  libpng-1.6.28-apng.patch.gz
> > > > 
> > > > sha1sum
> > > > cb620589ecf9c28a4ecc00e6225dd41ca660a959  
> > > > libpng-1.6.28-apng.patch.README.txt
> > > > 4fa952f5ad374fce8d478b7e54ee4298a0b8d159  libpng-1.6.28-apng.patch.gz
> > > > 
> > > > Local file time stamps are
> > > > 2017-01-06 21:02:10.938833896 +0900  libpng-1.6.28-apng.patch.README.txt
> > > > 2017-01-06 21:02:10.938833896 +0900  libpng-1.6.28-apng.patch.gz
> > > > 
> > > > That values equals on sourceforge.net.
> > > > https://sourceforge.net/projects/libpng-apng/files/libpng16/1.6.28/
> > > > 
> > > > I don't really understand what happend, but it look just fine.
> > > > 
> > > > Cheers,
> > > > ---
> > > > address@hidden
> > 
> > Okay, this doesn't help us, so we need to inspect the different tarballs
> > ourselves. Do you have an old copy of the patch you can share?
> 
> Yes. I mean no. I am not sure. I have libpng-apng git checkout
> and also the 1.6.25 extracted tarball directory (but not sure
> when I got it), and the tarballs for 1.6.5 and 1.6.28.
> 
> But I think I found our problem:
> 
> address@hidden ~/re-src$ guix hash tarballs/libpng-1.6.28-apng.patch.gz
> 0m5nv70n9903x3xzxw9qqc6sgf2rp106ha0x6gix0xf8wcrljaab
> address@hidden ~/re-src$ guix hash tarballs/libpng-1.6.25-apng.patch.gz
> 026r0gbkf6d6v54wca02cdxln8sj4m2c1yk62sj2aasv2ki2ffh5
> 
> (inputs
>  `(("apng" ,(origin
>     (method url-fetch)
>      (uri
>      (string-append "mirror://sourceforge/libpng-apng/libpng16/"
>      version "/libpng-" version "-apng.patch.gz"))
>      (sha256
>      (base32
>      "026r0gbkf6d6v54wca02cdxln8sj4m2c1yk62sj2aasv2ki2ffh5"))))))
> 
> My really strong guess is that we never updated the hash for
> libpng-apng when the libpng was updated fron which libpng-apng
> inherits its version.
> 
> I don't have the time to look at our git history right now,
> but you could do that, look at wether libpng-apng was touched
> since 1.6.25->1.6.28 update of libpng.
> 

git blame shows that back in February I updated libpng to 1.6.28 from
1.6.25, but that the last time libpng-apng was touched was by ng0 back
in January.

commit: 864738baaa7bb75c08647ccfc684736479e67f7f

-- 
Efraim Flashner   <address@hidden>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

signature.asc
Description: PGP signature