wol 1.0: bad checksum

[Kakadu]

CC @patricoferris @RyanGibb
I checked manually: error persists unless it is a MiM attack.

[ERROR] Got some errors while processing: wol.1.0, wol-eio.1.0, wol-mirage.1.0
  - [wol.1.0] https://tangled.org/ryan.freumh.org/ocaml-wake-on-lan/archive/1.0.tar.gz (Bad
    checksum, expected
    sha512=a254cefa47360b7e60c875db254062645c629a95f063cd500955109e18ebd2918f1d977024747f17841ad02e8f2d911deb158552e85459b23d0c5772d52e5bb4)
  - [wol-eio.1.0] https://tangled.org/ryan.freumh.org/ocaml-wake-on-lan/archive/1.0.tar.gz (Bad
    checksum, expected
    sha512=a254cefa47360b7e60c875db254062645c629a95f063cd500955109e18ebd2918f1d977024747f17841ad02e8f2d911deb158552e85459b23d0c5772d52e5bb4)
  - [wol-mirage.1.0] https://tangled.org/ryan.freumh.org/ocaml-wake-on-lan/archive/1.0.tar.gz
    (Bad checksum, expected
    sha512=a254cefa47360b7e60c875db254062645c629a95f063cd500955109e18ebd2918f1d977024747f17841ad02e8f2d911deb158552e85459b23d0c5772d52e5bb4)

[mseri]

I have just checked all three. They have the correct checksum when I try to download them

[Kakadu]

I have just checked all three. They have the correct checksum when I try to download them

I checked three locations and my sha512sum is e8e325f272851ed350cea2a9de49a796c75ed51009cf2671c923f509e97ebf8fe3d22fff0ec80b0d5d069ec6357d1e94555e1c6ea6bef0d69e0a81f4eed576e8.

[mseri]

Oh I found my mistake. Since this was not the first time I had to make this check, I finally decided to write a script for it, relying on the opam internal library... I did not realize that this was silently downloading the tarball from the opam cache instead, sorry 😓 I get your same mismatch, if there is no reply, I'll update the cached source to opam-source-archives and redirect the sources there

[mseri]

But I manually checked the folders and the look unmodified, the only difference is that one extract on a subfolder named did:plc:pubx6tpxwwjnxxog7ix43re5-1.0 while the other extracts cleanly

[oppiliappan]

hi all, tangled maintainer here! the tarballs are not byte-for-byte identical because of this change that we deployed (shelling out to git archive was far more performant and allowed more formats). i didn't foresee it breaking like this, very sorry about that!

while i'd like to keep the change to how we generate archives, i want to ask: is it possible to update checksums for packages served from tangled? if that is infeasible, i will revert the changes that modify how archives are generated, and the checksums should match once more.

[Kakadu]

is it possible to update checksums for packages served from tangled?

Seems right thing to do. Somebody should volunteer, though

[avsm]

@oppiliappan I think you should keep your change. @RyanGibb you should do a dune-release distrib and upload the artefact to https://tangled.org/ryan.freumh.org/ocaml-wake-on-lan/tags as an annotated tag artefact. This way the tarball is preserved and served from the PDS instead of depending on a dynamic git archive algorithm. See e.g. the deepseek package here as an example.

[hannesm]

Changes to the archive checksum are against the policy. https://github.com/ocaml/opam-repository/tree/master/governance/policies#11-changes-to-a-packages-source-archive-are-prohibited-including-patches-and-other-ways-to-modify-the-source

I'm sure there's a wol tarball somewhere in the archive mirrors that we can re-upload elsewhere (opam-source-archives) and point the url there.

[mseri]

Indeed we could either replace the tarball on tangled with the one from the cache (if possible) and otherwise it is quite easy to copy the tarball from the cache (it is there!) into the opam-source-archive repository: I have a couple of scripts to do that in a few seconds. It won’t take long but I am traveling without my laptop right now, I can easily do it tomorrow