Opam fails to download cygwin shasum

[ajbt200128]

We've been getting dozens of these errors on our windows builds:

OPAMSOLVERTIMEOUT=1500 LWT_DISCOVER_ARGUMENTS="--use-libev true" LIBRARY_PATH="/lib:" opam install --confirm-level=unsafe-yes -y --depext-only ./ ./dev/required.opam 
[WARNING] Failed checks on required package definition from source at file://D:/a/semgrep-proprietary/semgrep-proprietary/OSS/dev:
  warning 68: Missing field 'license'
[WARNING] Opam packages conf-mingw-w64-curl-x86_64.1, conf-mingw-w64-gmp-x86_64.1, conf-mingw-w64-pcre-x86_64.1 and conf-mingw-w64-pcre2-x86_64.1 depend on the following system packages that are no longer installed: mingw64-x86_64-curl mingw64-x86_64-gmp mingw64-x86_64-pcre mingw64-x86_64-pcre2

The following system packages will first need to be installed:
    mingw64-x86_64-curl mingw64-x86_64-gmp mingw64-x86_64-pcre mingw64-x86_64-pcre2

<><> Handling external dependencies <><><><><><><><><><><><><><><><><><><><><><>

Fatal error:
OpamDownload.Download_fail(_, "curl failed: \"D:\\\\cygwin\\\\bin\\\\curl.exe --write-out %{http_code}\\\\n --retry 3 --retry-delay 2 --user-agent opam/2.3.0 -L -o C:\\\\Users\\\\runneradmin\\\\AppData\\\\Local\\\\Temp\\\\opam-2896-f71c65\\\\sha512.sum.part -- [https://cygwin.com/sha512.sum\](https://cygwin.com/sha512.sum/)" exited with code 16")
make[1]: *** [Makefile:281: install-opam-deps] Error 99
make[1]: Leaving directory '/cygdrive/d/a/semgrep-proprietary/semgrep-proprietary/OSS'
make: *** [Makefile:255: install-deps-for-semgrep-core] Error 2
make: Leaving directory '/cygdrive/d/a/semgrep-proprietary/semgrep-proprietary/OSS'

It seems like it may be an upstream issue with cygwin (or maybe libcurl?), but it would be awesome if opam retried this step a few times at the least.

[kit-ty-kate]

Is this in a CI or locally? If it's in a CI, we're seeing this too. Especially if it's Github, my guess is that cygwin.com's DDOS protection system is getting triggered on the github/microsoft azure machines

[dijkstracula]

On failure, could we consider pulling from one of the mirrors listed on the Cygwin site? For instance, I notice kernel.org is one such mirror, appears to be up to date, and they are probably used to folks pulling for a CI environment.

(I do not know if there are trust/security issues with such an idea - merely putting it out there.)

[kit-ty-kate]

Sadly the mirrors don't host these files. They only host the package repository

[dijkstracula]

I see. I only investigated so far as confirming that sha512.sum was present on the kernel.org mirror.

[ajbt200128]

@kit-ty-kate I'm not sure I follow

Sadly the mirrors don't host these files

Which files specifically? it seems they have packages and the shasum. Trying to figure out which are missing so I can ask the cygwin maintainers to add them to the mirrors

[kit-ty-kate]

sha512.sum from the mirrors and from cygwin.com doesn't contain the same informations. The former holds informations about the package database and the latter holds information about setup-x86_64.exe.

Here we're trying to download setup-x86_64.exe, so we first download the hash to make sure it was downloaded correctly and then we download the binary.

Mirrors simply don't have those two files

[dijkstracula]

I believe I pointed to the wrong subdirectory in the mirror, my apologies. I think this is whither I should have linked; this seems to have the shasum and a compressed version of cygwin's installed directory tree (but not the setup installer, unfortunately). Maybe @ajbt200128 can ask the maintainers to add the setup installer to the mirrors.

[ajbt200128]

thanks! I'll see if I can get the maintainers to add those files, and maybe resolve the curl issues. I talked with Mark J. Wielaard a sourceware committee member (sourceware is the cygwin host), and they said "We had to block things like google cloud, azure, alibabi, huawei cloud since they were just hammering and abusing the servers", and recommended not using github :/. They also said they'd expect 403s not 404s if this was a rate limiter/blocker thing, and I've been getting 404s from my personal device accessing their website normally too.

They pointed me towards @github-cygwin, the lead cygwin maintainers so maybe they have some ideas.

[jon-turney]

Hi,

We are aware of the current patchiness in the availability of Cygwin installer. Apologies for the inconvenience.

However, relying on a SHA512 checksum fetched from the same site to verify the integrity of the setup executable (which is what you seem to be asking me to put on the mirrors) is exactly not what you should be doing, since it bypasses the trust root of our package distribution system and leaves you entirely at the mercy of a cracked mirror.

I'm working on some changes to put the installer onto our package repository mirrors, without exposing unsophisticated users to those risks, but I'm afraid we're not there yet...

[kit-ty-kate]

I'm working on some changes to put the installer onto our package repository mirrors

That's great news. So does that mean setup.exe will be able to just be upgraded just like any other packages? If so what does that mean for its location? (opam puts it at the root of the cygwin directory as setup-x86_64.exe for example)

However this won't do much for the initial setup where we still need to fetch it from somewhere (currently cygwin.com/setup-x86_64.exe)

[tobil4sk]

In the case of setup-ocaml, the github action downloads and caches its own cygwin installation. Perhaps in this case opam should not be attempting to verify the setup exe? That seems like it should be setup-ocaml's job.

[rjbou]

Fixed by #6482 & #6498 and will be available in the next 2.4.0~beta1 release.