Checksum doesn't match when installing from RPM repo

processone / ejabberd

Robust, Ubiquitous and Massively Scalable Messaging Platform (XMPP, MQTT, SIP Server)

https://www.process-one.net/en/ejabberd/

Other

6.06k stars 1.51k forks source link

Checksum doesn't match when installing from RPM repo #3984

Closed johnassel closed 1 year ago

johnassel commented 1 year ago

Environment

ejabberd version: 23.01
OS: Linux (Fedora)
Installed from: official deb/rpm

Hi,

when installing ejabberd from the official rpm repo dnf stops with Downloading Packages: [MIRROR] ejabberd-23.01-1.x86_64.rpm: Downloading successful, but checksum doesn't match. Calculated: 4e63084289a9e8aca3d095ab717dd541be9f13637a6009fb29cf06de609bf75c(sha256) Expected: e2a9726cf3439b0ece63b5a8a785ef7e19442d31cff8a4d12d390a6f7d536ff6(sha256)

When downloading the rpm manually from https://repo.process-one.net/rpm/ejabberd-23.01-1.x86_64.rpm and checking its checksum it is indeed 4e63084289a9e8aca3d095ab717dd541be9f13637a6009fb29cf06de609bf75c.

When downloading the file from https://www.process-one.net/en/ejabberd/downloads/ I get the hash dnf expected e2a9726cf3439b0ece63b5a8a785ef7e19442d31cff8a4d12d390a6f7d536ff6. So both files I get are different.

Anyone got the same problem?

badlop commented 1 year ago

Quite strange. I can reproduce it. Summary:

The sum file in Downloads section Checking code integrity and signature says e2a97
The checksum in the primary.xml.gz file in repodata says e2a97
And the file available to download in Downloads has sha256sum: e2a97
However, as you noticed, when downloading the rpm from the repo, it has sha256sum 4e630

nosnilmot commented 1 year ago

The RPM in the repo is signed, the one in Downloads is not. It looks like the repo metadata was generated, and then the RPMs were signed.

Metalhearf commented 1 year ago

Hello,

Thank you for your feedback. I was indeed able to reproduce the same thing and it helped quite a bit.

I think there was a glitch in the previous release of these packages in the repo. I have re-generated everything and it seems to have solved the situation. I have just succeeded in installing ejabberd via yum in a CentOS container.

In the next days, I will remove https://repo.process-one.net/(...) (which does indeed contain some unsigned files).

This way, that server keeps its original purpose : a simple package repository. For those who still want to access those .rpm/.deb/.run files, they will stay available in the usual two other places:

I'll close this issue tomorrow, leaving some time if anything else gets your attention. Thanks!

johnassel commented 1 year ago

Hi! Yes, can confirm, it now works. Thank you!