[libsodium] build failure, wrong hash since url points to dynamic tag

[Green-Sky]

Operating system

windows - github ci

Compiler

MSVC

Steps to reproduce the behavior

vcpkg install libsodium:x64-windows-static

Failure logs

Installing 7/9 libsodium:x64-windows-static@1.0.19#2...
Building libsodium:x64-windows-static@1.0.19#2...
-- Downloading https://github.com/jedisct1/libsodium/archive/1.0.19.tar.gz -> jedisct1-libsodium-1.0.19.tar.gz...
[DEBUG] To include the environment variables in debug output, pass --debug-env
[DEBUG] Trying to load bundleconfig from C:\vcpkg\vcpkg-bundle.json
[DEBUG] Failed to open: C:\vcpkg\vcpkg-bundle.json
[DEBUG] Bundle config: readonly=false, usegitregistry=false, embeddedsha=nullopt, deployment=Git, vsversion=nullopt
[DEBUG] Metrics enabled.
[DEBUG] Feature flag 'binarycaching' unset
[DEBUG] Feature flag 'compilertracking' unset
[DEBUG] Feature flag 'registries' unset
[DEBUG] Feature flag 'versions' unset
[DEBUG] Feature flag 'dependencygraph' unset
Downloading https://github.com/jedisct1/libsodium/archive/1.0.19.tar.gz
[DEBUG] Trying to hash C:\vcpkg\downloads\jedisct1-libsodium-1.0.19.tar.gz.2992.part
[DEBUG] C:\vcpkg\downloads\jedisct1-libsodium-1.0.19.tar.gz.2992.part has hash efeb4c0dc352993fc128974abb27e4be60521e85ce191c8c38a84168d4e7d7b1d2c26843250077dd21dadb13678bf56712375e74754eb02100b8cc418ebffb94
error: Failed to download from mirror set
error: File does not have the expected hash:
url: https://github.com/jedisct1/libsodium/archive/1.0.19.tar.gz
File: C:\vcpkg\downloads\jedisct1-libsodium-1.0.19.tar.gz.2992.part
Expected hash: 6094d7bf191ea3be85f2ddab76b71f1b9c69c786493db5b84d3c5d5a0237003377ddf6a8687a962ea651fe4a9369cf5ee1676ba0bae82690f5f7ef31a698efa9
Actual hash: efeb4c0dc352993fc128974abb27e4be60521e85ce191c8c38a84168d4e7d7b1d2c26843250077dd21dadb13678bf56712375e74754eb02100b8cc418ebffb94
[DEBUG] D:\a\_work\1\s\src\vcpkg\base\downloads.cpp(997): 
[DEBUG] Time in subprocesses: 0us
[DEBUG] Time in parsing JSON: 8us
[DEBUG] Time in JSON reader: 0us
[DEBUG] Time in filesystem: 741us
[DEBUG] Time in loading ports: 0us
[DEBUG] Exiting after 749 ms (742872us)

CMake Error at scripts/cmake/vcpkg_download_distfile.cmake:32 (message):
      
      Failed to download file with error: 1
      If you are using a proxy, please check your proxy setting. Possible causes are:
      
      1. You are actually using an HTTP proxy, but setting HTTPS_PROXY variable
         to `https://address:port`. This is not correct, because `https://` prefix
         claims the proxy is an HTTPS proxy, while your proxy (v2ray, shadowsocksr
         , etc..) is an HTTP proxy. Try setting `http://address:port` to both
         HTTP_PROXY and HTTPS_PROXY instead.
      
      2. If you are using Windows, vcpkg will automatically use your Windows IE Proxy Settings
         set by your proxy software. See https://github.com/microsoft/vcpkg-tool/pull/77
         The value set by your proxy might be wrong, or have same `https://` prefix issue.
      
      3. Your proxy's remote server is out of service.
      
      If you've tried directly download the link, and believe this is not a temporary
      download server failure, please submit an issue at https://github.com/Microsoft/vcpkg/issues
      to report this upstream download server failure.
      

Call Stack (most recent call first):
  scripts/cmake/vcpkg_download_distfile.cmake:270 (z_vcpkg_download_distfile_show_proxy_and_fail)
  scripts/cmake/vcpkg_from_github.cmake:106 (vcpkg_download_distfile)
  ports/libsodium/portfile.cmake:1 (vcpkg_from_github)
  scripts/ports.cmake:175 (include)


error: building libsodium:x64-windows-static failed with: BUILD_FAILED
Elapsed time to handle libsodium:x64-windows-static: 807 ms

Additional context

The cited url https://github.com/jedisct1/libsodium/archive/1.0.19.tar.gz does not point to the actual release, but to a tag that is used like a branch.
Use 1.0.19-RELEASE tag OR better, the signed release tarballs instead https://github.com/jedisct1/libsodium/releases/download/1.0.19-RELEASE/libsodium-1.0.19.tar.gz

Also, 1.0.20 released yesterday, probably triggering this issue.

[dg0yt]

The cited url https://github.com/jedisct1/libsodium/archive/1.0.19.tar.gz does not point to the actual release, but to a tag that is used like a branch.

Can you please explain this, or point to a document which explains this?
(Why does one need to use tags like a branch?)

[Green-Sky]

Can you please explain this, or point to a document which explains this? (Why does one need to use tags like a branch?)

I just took a look at their repo and compared https://github.com/jedisct1/libsodium/commits/1.0.19/ with https://github.com/jedisct1/libsodium/commits/1.0.19-RELEASE/ .
Both are tags, but only one points to the actual commit form back when it was released.
The non-RELEASE tag points to a commit from just a few days ago.

I still think the release tarball should be used instead https://github.com/jedisct1/libsodium/releases/download/1.0.19-RELEASE/libsodium-1.0.19.tar.gz .

And, while you are at it, update to the fresh 1.0.20 :)

[dg0yt]

It would be good to know if they changed the tag by accident, and to have some official reference to add to a comment.

And vcpkg generally prefers the on-the-fly tarballs from git(hub).

[LilyWangLL]

The related upstream issue: jedisct1/libsodium#1373