Re: [graphviz-interest] graphviz-2.39.20150520.1950.tar.gz has been stealth-updated

On 06/02/2015 03:56 AM, Ryan Schmidt wrote:
> On Jun 1, 2015, at 7:46 PM, John Ellson wrote:
>> Ryan,
>>
>> OK, now I'm confused.
>>
>> The md5sum on the web site matches the tar file:
>>
>> $ wget -q -O - http://graphviz.org/pub/graphviz/development/SOURCES/graphviz-.tar.gz | md5sum
>> 6b57d70edba18861f7ac2d92808e8ffe -
>> $ wget -q -O - http://graphviz.org/pub/graphviz/development/SOURCES/graphviz-2.39.20150520.1950.tar.gz.md5
>> 6b57d70edba18861f7ac2d92808e8ffe  graphviz-2.39.20150520.1950.tar.gz
>>
>>
>> So I don't quite understand how you are detecting a problem?
>>
>> The timestamp is now that of the last commit into github,  so the timestamps of any generated files inside the tar will always be later.      (Normally these will be <24hours later,  but right now they may be later than that because I've been messing with the build scripts.)
>>
>> I don't understand the https://trac.macports.org/ticket/47902 report.  Are they using some different checksum?
> John,
>
> Most every port in MacPorts keeps track of the checksums of the files it downloads, to verify they haven't been tampered with.
>
> When I updated graphviz-devel to version 2.39.20150520.1950 on 2015-05-23 at 02:03 CDT, the file I got had the md5 sum 28e97e4fed7c09260d1f8c1ebc32d0aa. I recorded the checksum of the downloaded file in the MacPorts portfile. MacPorts infrastructure automatically mirrors these downloaded files so you can get a copy of it here:
>
> http://distfiles.macports.org/graphviz/graphviz-2.39.20150520.1950.tar.gz
>
> The top-level directory contains items timestamped as recently as 2015-05-22 23:46 CDT.
>
> Today, if I download the file from your web site, it has md5 sum 6b57d70edba18861f7ac2d92808e8ffe as you said. In the top-level directory, it has items timestamped as recently as 2015-05-24 23:46 CDT. The checksum does not match what I recorded in the MacPorts portfile on 2015-05-23 so MacPorts bails, which prompted the user to file the ticket with us.
>
> I just want to ensure that your downloadable files' timestamps and checksums won't change again -- that whatever process caused that file to be replaced with a re-packaged version with newer timestamps won't do that anymore.
>
> I assume that you have a script that runs daily around 23:45 CDT, and that between May 20 any May 24 it rebuilt and re-uploaded the archive every day with that day's timestamps, but that after that you fixed the problem by changing the script to exit early if there were no changes to the sources since the last run, or something like that.
>
> -Ryan
>
>
>

OK.  I think this issue was caused by me working on the scripts. It 
should not happen again.  (I was changing from "scp" to "rsync -e ssh 
--ignore-existing" to upload files without clobbering the timestamp if 
the file already exists.)

John
_______________________________________________
[email protected]
http://lists.research.att.com/mailman/listinfo/graphviz-interest