Mirror issues on HPPA

--PyYadcECHj+FQF9/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Greetings,

At the moment, I am unable to upgrade my hppa boxes, there are error messages
like "Hash Sum mismatch" or "File has unexpected size".

Example:

| Error: Failed to fetch http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libatomic1_16.1.0-2_hppa.deb  Hash Sum mismatch
|    Hashes of expected file:
|     - SHA256:f45b842483a27a32e8401e44cd9efdd06d308fc744a727c9d29d591893eb2a66
|     - MD5Sum:7b21e02df40e6a7f8174abd101f0c17f [weak]
|     - Filesize:8356 [weak]
|    Hashes of received file:
|     - SHA256:7b26f5b086ed5b2e950858490ff4539d80fb60444110c5ffc6d10eec0b396c83
|     - MD5Sum:c8c1f443fd3252d563384d56a0435754 [weak]
|     - Filesize:8356 [weak]
|    Last modification reported: Thu, 18 Jun 2026 18:03:13 +0000

Affected are these URLs:

http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libgomp1_16.1.0-2_hppa.deb
http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libgcc-s4_16.1.0-2_hppa.deb
http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libcc1-0_16.1.0-2_hppa.deb
http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libatomic1_16.1.0-2_hppa.deb
http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libstdc%2b%2b6_16.1.0-2_hppa.deb

Now I'm fairly certain this is outside my control. A check on a second
mirror returned the same result. Can someone take a look into this?

These are the steps to reproduce:

$ wget http://ftp.de.debian.org/debian-ports/dists/sid/main/binary-hppa/Packages.xz
$ TZ=UTC stat --format='%Y (%y)' Packages.xz
1782049495 (2026-06-21 13:44:55.000000000 +0000)

$ xzgrep -A13 '^Package: libatomic1$' Packages.xz
Package: libatomic1
Architecture: hppa
Version: 16.1.0-2
Multi-Arch: same
Priority: optional
Section: libs
Source: gcc-16
Maintainer: Debian GCC Maintainers <[email protected]>
Installed-Size: 48
Depends: gcc-16-base (= 16.1.0-2), libc6 (>= 2.2)
Filename: pool-hppa/main/g/gcc-16/libatomic1_16.1.0-2_hppa.deb
Size: 8356
MD5sum: 7b21e02df40e6a7f8174abd101f0c17f
SHA256: f45b842483a27a32e8401e44cd9efdd06d308fc744a727c9d29d591893eb2a66

=> These are the "expected" hashsums as above.

$ TZ=UTC stat --format='%Y (%y)' libatomic1_16.1.0-2_hppa.deb
1781805793 (2026-06-18 18:03:13.000000000 +0000)

$ wget http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libatomic1_16.1.0-2_hppa.deb
$ TZ=UTC stat --format='%Y (%y)' libatomic1_16.1.0-2_hppa.deb
1781805793 (2026-06-18 18:03:13.000000000 +0000)

$ md5sum libatomic1_16.1.0-2_hppa.deb ; sha256sum libatomic1_16.1.0-2_hppa.deb
c8c1f443fd3252d563384d56a0435754  libatomic1_16.1.0-2_hppa.deb
7b26f5b086ed5b2e950858490ff4539d80fb60444110c5ffc6d10eec0b396c83  libatomic1_16.1.0-2_hppa.deb

=> These are the "received" hashsums as above.


So my assumption is mirror content and index (Packages) ran out of sync.
In quite a weird way. Whom to ping for a check?

Further information, based on the mtime: The "received" package was
installed on the mirror on 1781589787 (2026-06-16T06:03:07) and
appearently replaced with the "expected" content on 1781805793
(2026-06-18 18:03:13.886190374 +0000). While TTBOMK there is no
guarantee a Debian package file name is unique in a mirror, violating
that causes confusion.

    Christoph

--PyYadcECHj+FQF9/
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEWXMI+726A12MfJXdxCxY61kUkv0FAmo4FB4ACgkQxCxY61kU
kv1fPA/7BH77p7fHjjGDJTH2DtBfCb6eA3qSMwq52XpAGZKe9Yup17saDXDPKa9z
vqH7QX7IF/VL+J1/I5cdsx1oS6VpKxNbwMf9AgDSNrSDlMXhssv9GkTRk9BAa/Sz
CCiCxvq7jpqhK24siduOT/hSpcPyabDB7DAZv6p8oj0oQl59AK7PZ3QY2gxLpAAG
/xmI1mCBEdipOxm5uJL14/+tARJItlWbYfRnxo4qPyKEegElCrj4Ke75Z3jeXyDE
VkSvAmyNFyi+w7BnPP4FNmfbY0YBM0GkqySgqomrhF0xa71qZCRRAT9at+cDvzGX
4ZwZ1p1sKzhAz4PbQEUazJvIgYLF134nKppT4sdznaJHabPxyOwL4sAkPSqqOkRO
nya/PL/jNy3ZOsfcm0gysvpdRXNUgSWzP8lpPN0cUzZ/KLSAzgDO+cVCiOIO1MMt
keaLd7ovo46A8kjb1LWJ4wdQZNkWbGP9jkKlpcA3KVuDowh8O0zgY/EckYe4Noxg
TpEfjEgUGuNuLgHkNwWSORQkCSleHw1KRXAhmxV6m14H83ldvRCGzWPM0gi8fI0S
unVPyxG49C1MwrW3brGj2wUBLL5NJHag2ZDOMZpMd4TCHars4PBb6P8LYO5c1WE6
mXHg4cOcxUujKiJPKv7qTtpwIBZYoSzBe9NzL/NfT35Nzq3pfaA=
=6eRU
-----END PGP SIGNATURE-----

--PyYadcECHj+FQF9/--