SourceForge redirecting to latest file unexpectedly

[fgaz]

Hi, I'm the packager of warzone2100 for NixOS, and I just noticed the hash of the 4.4.1 source tarball recently changed.

Usually this is just because of a force push or similar, but it could also be a security issue.

Could you please check if this is expected?

Here is a diff of the contents of the two tarball versions, extracted from our cache: 4.4.1.diff.txt

[fgaz]

Upon further inspection it appears the 4.4.1 tarball is now identical to the 4.4.2 one. Maybe it was accidentally copied over 4.4.1?

Could you please reupload the correct one? Preferably the exact same as before, so hashes aren't broken.

[past-due]

4.4.1/warzone2100_src.tar.xz should have the following hashes:

"sha256": "f2f6f03b83d710ec99a86892cf5caa85ef237dee04e22bfdd3c99cfbcc6e1fc2",
"sha512": "74c5304f945914024de4d3168f926d7851a81ad32625b0714cb6338d93bb9e0aca49e20e38bf9c35ac3a1c7edd96d2c83c695c5376a11fc4a8c21309716ca5ee",
"blake2b": "0993f554fe60c04cc5e3cc3698854e322e43b84b7bff642e9dc3d49f6cbd46ffed0f655e8882657349bf8a4ea5eb6a230a04930d1af1eff00d5da368cb2c35fc"

I have verified that both SourceForge and GitHub have the expected hash.

However, I notice that when following the link you provided, SourceForge seems to be redirecting to the 4.4.2 file.

GET https://downloads.sourceforge.net/warzone2100/releases/4.4.1/warzone2100_src.tar.xz
HTTP RESPONSE: 301 Moved Permanently
Location: https://sourceforge.net/projects/warzone2100/files/releases/4.4.2/warzone2100_src.tar.xz/download?use_mirror=cfhcable

So this looks like a possible SourceForge configuration issue?

You might want to try the GitHub Releases url instead. And, of course, we'd recommend the latest which is currently 4.4.2: https://github.com/Warzone2100/warzone2100/releases/download/4.4.2/warzone2100_src.tar.xz

[fgaz]

Thanks, I didn't notice the redirect! Using the URL you posted (which is the same as the one on the warzone website) works fine. I don't know why we even used the variant in the first place. I consider this closed on my end, thanks again for the help.

And, of course, we'd recommend the latest which is currently 4.4.2: https://github.com/Warzone2100/warzone2100/releases/download/4.4.2/warzone2100_src.tar.xz

Yes of course, updating is next on my to do list.