Re: Some fink tarballs are actually HTML files

On 4/9/24 1:54 AM, Jean-Claude Arbaut wrote:
>   Hi,
> 
> Not sure it's the right place for this message, but I found no contact list.
> 
> When inspecting files from an rsync mirror of rsync://
> master.us.finkmirrors.net/distfiles/, I noticed some of them are actually
> HTML files, that seem to result from an error in an automatic download.
> 
> To check without rsync, the URLs are like
> https://finkmirrors.net/distfiles/md5/gcc-3.3.6.tar.bz2.
> 
> For instance, among files updated today, there is
> distfiles/md5/gcc-3.3.6.tar.bz2, that is an HTML page titled
> "Download-By.Net - freeware, shareware and software downloads".
> It's the first that catched my eye, as there is no obvious reason to have a
> recent push of such an old version.
> As a side note, it's rather troubling as this file should come from
> https://ftp.gnu.org/gnu/gcc/gcc-3.3.6/gcc-3.3.6.tar.bz2, and not from a
> shareware site. It's not the only one.
> 
> Other titles include "Account Suspended", "DropCatch.com", "Go-Parts » Your
> Go-To Place for Auto Parts!", etc.
> 
> These aren't just old forgotten stuff: file dates range from 2021-09-16 to
> today. There are also 7 files from 2003.
> 
> On the other hand, it's not clear to me how they are referenced within fink:
> * distfiles/md5/gcc-3.3.6.tar.bz2 if bad, but
> distfiles/md5/6936616a967da5a0b46f1e7424a06414/gcc-3.3.6.tar.bz2 looks good
> (SHA512 hash compared with the GNU version)
> * same with distfiles/md5/Statistics-Regression-0.53.tar.gz and
> distfiles/md5/761f4a266b2d376ebd15b2bc6038a757/Statistics-Regression-0.53.tar.gz
> (SHA512 from CPAN version)
> And the 4 bad files that were pushed today do not appear in
> https://finkproject.org/package-updates.php.
> 
> 
> Here is a list of 272 suspicious files (I checked all files < 2MB):

Thanks for the heads up. I've opened ticket 
https://github.com/fink/scripts/issues/62

I know there was a period some time ago where Sourceforge mirrors were 
broken and so the scripts were collecting the HTML error message (but 
not sure why they were saving the HTML error message which didn't match 
the expected file hash).

Hanspeter

-- 
........\|/......\|/........
........~@-/ oO \-@~........
......../_( \__/ )_\........
...........\__U_/...........
....NEENER NEENER NEENER....



_______________________________________________
Fink-users mailing list
[email protected]
List archive:
https://sourceforge.net/p/fink/mailman/fink-users/
Subscription management:
https://lists.sourceforge.net/lists/listinfo/fink-users