Build failure: hash mismatch in qemu-8.2.3

[jcumming]

$ nix-prefetch-url https://download.qemu.org/qemu-8.2.3.tar.xz 
path is '/nix/store/hv1fyagi0acym5xlws4gjmj54qz4nvl3-qemu-8.2.3.tar.xz'
0r4raqm2rcaswivgp0ryl8r9m0pns5mqgi01fqqmb540csrpyx6w
$ nix hash to-sri --type sha256 0r4raqm2rcaswivgp0ryl8r9m0pns5mqgi01fqqmb540csrpyx6w
sha256-3HR/s2aAlFUxdgHEh2vR9oKaMqI+g/t25FqxLCpWmWQ=

The hash in nixpkgs/master right now is:

  version = "8.2.3";

  src = fetchurl {
    url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
    hash = "sha256-d1sRjKpjZiCnr0saFWRFoaKA9a1Ss7y7F/jilkhB21g=";
  };

I had both tarballs kicking around, so I checked the differences:

diff -rc good/qemu-8.2.3/roms/seabios/.version sus/qemu-8.2.3/roms/seabios/.version
*** good/qemu-8.2.3/roms/seabios/.version       2024-04-24 09:09:59.000000000 -0700
--- sus/qemu-8.2.3/roms/seabios/.version        2024-04-24 13:15:10.000000000 -0700
***************
*** 1 ****
! rel-1.16.3-0-ga6ed6b70
--- 1 ----
! rel-1.16.3-0-ga6ed6b7
Only in good/qemu-8.2.3/subprojects: dtc

[jcumming]

@Misterio77

A tarball with a hash matching what is in master is at https://download.qemu.org/old/qemu-8.2.3.tar.xz

seems like some trouble with the release.

[Misterio77]

That's... super weird. download.qemu.org says the tarballs last modified date was April 25th (before I even opened the PR):

qemu-8.2.3-reupload.tar.bz2                        06-May-2024 13:59           156774533
qemu-8.2.3-reupload.tar.bz2.sig                    06-May-2024 13:59                 310
qemu-8.2.3-reupload.tar.xz                         06-May-2024 13:59           129917944
qemu-8.2.3-reupload.tar.xz.sig                     06-May-2024 14:00                 310
qemu-8.2.3.tar.bz2                                 25-Apr-2024 02:18           156774533
qemu-8.2.3.tar.bz2.sig                             25-Apr-2024 02:18                 310
qemu-8.2.3.tar.xz                                  25-Apr-2024 02:18           129917944
qemu-8.2.3.tar.xz.sig                              25-Apr-2024 02:18                 310

Maybe we should use the gitlab tarball instead?

[Misterio77]

Okay, found some context: https://mail.gnu.org/archive/html/qemu-stable/2024-05/msg00025.html. This took a while to break due to aggressive CDN caching, it seems.

[jcumming]

Thanks!

Not sure this is worth fixing or just wait for #298097 to land.

[alyssais]

It's going to be a while before we can get 9.0.0 due to the release freeze, so this is definitely worth fixing now.