-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SHA256 mismatch for libdap 3.19.1 #37
Comments
What is the source of the expected and actual values? I downloaded the file and its sig from the web site and the tar.gz verifies: edamame:libdap4 jimg$ gpg --verify /Users/jimg/Downloads/libdap-3.19.1.tar.gz.sig /Users/jimg/Downloads/libdap-3.19.1.tar.gz |
The expected value were listed in the homebrew formula which I presume was entered by the author of the formula. The concern is if the file was changed maliciously thus causing the checksum to no longer match. The issue I raised in the homebrew repo can be found here Here is the formula for libdap in homebrew. |
So it seems someone decided to overwrite the original tarball two months after it was originally posted with a different tarball. |
Note that for security reasons we cannot update the checksum in Homebrew until we understand what exactly happened here. Also, note that Homebrew/homebrew-core#18773 was green on our CI meaning the checksum in the formula matched both my local download and the independent downloads on our three CI servers. |
@ilovezfs thanks for the investigation. Hope it could be resolved soon. It was blocking the completion of my install for gdal. Will look for another solution in the mean time. Thanks. |
Fixed. Here's what happened: In late Sept we planned on releasing our data server and pushed libdap-3.19.1 up to our ftp site. But other commitments meant that some issues in the rest of the server had to wait to be fixed. As a result we didn't release the server until early Dec and I (mistakenly) built a new source dist for libdap on a different host. I've replaced that with the original one and the sha256 of the original matches the one homebrew expects. I also checked that the package that you got that failed the check is not the result of malicious action - it was the source dist I built in early Dec. Please let me know if this does not fix your build issues. |
Thanks for the detailed explanation @jgallagher59701! It looks like we're all good again:
|
There's a SHA256 mismatch for libdap. Encountered this while installing gdal via homebrew on Mac OS 10.10.5. Was asked to rule out rule out malicious circumstances and to find out why the file changed.
The text was updated successfully, but these errors were encountered: