On Tue, 12 Jan 2021 00:13:21 +0000, Cristian Morales Vega wrote:
Not sure exactly when, but it looks like me creating
https://src.fedoraproject.org/rpms/doxygen/pull-request/9 has
triggered a process uploading the tarball to the lookaside cache.
The tarball inside
https://kojipkgs.fedoraproject.org//work/tasks/5674/59445674/doxygen-1.9....
is fine. But when I later tried to build the same sources in copr I
got a 404 error when downloading the tarball from the lookaside cache
(
https://download.copr.fedorainfracloud.org/results/reddwarf/personal/srpm...).
The thing is that
https://src.fedoraproject.org/lookaside/pkgs/doxygen/doxygen-1.9.1.src.ta...
is a 19 MiB monster (instead of the 5 MiB of the real tarball) with,
obviously, the wrong hash.
How did this happen? Is it "expected" even if I don't understand it?
Is it a bug somewhere?
The tarball you refer to first is gzipped and matches the commit diff for
the "sources" file:
$ sha512sum doxygen-1.9.1.src.tar.gz
637496c549a4a150cfaeb5d4913de512262145ecd7d455d7b7f3dd68f9416e47d931a6c1efd8a17d931e4baf4a8a9f2ed21124664003b123b6f89ca4abf263ed
doxygen-1.9.1.src.tar.gz
The later one ends with .tar.gz but is uncompressed and matches the "sources"
file in Fedora dist-git:
$ file doxygen-1.9.1.src.tar.gz
doxygen-1.9.1.src.tar: POSIX tar archive
$ grep doxygen sources
SHA512 (doxygen-1.9.1.src.tar.gz) =
a84fbea1874921317b58345c53fc4eac0382c9e593f0e1ee899a31e67ead3fd12b2da8145b37e2e09d665e28d060e6717c92de7e8d0a31fc5f24fdcc4715f54d
$ sha512sum doxygen-1.9.1.src.tar.gz
a84fbea1874921317b58345c53fc4eac0382c9e593f0e1ee899a31e67ead3fd12b2da8145b37e2e09d665e28d060e6717c92de7e8d0a31fc5f24fdcc4715f54d
doxygen-1.9.1.src.tar
So, it seems a Fedora maintainer of doxygen has uploaded the huge
uncompressed tarball to the lookaside cache accidentally or unknowingly
because of its .gz extension.