>Number:         36391
>Category:       pkg
>Synopsis:       net/kftpgrabber distfile checksum error
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon May 28 11:45:00 +0000 2007
>Originator:     Robert Elz
>Release:        NetBSD 3.99.15
>Organization:
	Prince of Songkla University
>Environment:
	
	
System: NetBSD jade.coe.psu.ac.th 3.99.15 NetBSD 3.99.15 (GENERIC-1.696-20060125) #8: Wed Jan 25 04:59:39 ICT 2006 kre@jade.coe.psu.ac.th:/usr/obj/current/kernels/JADE_ASUS i386
Architecture: i386
Machine: i386
>Description:
	The distfile for net/kftpgrabber ( kftpgrabber-0.8.1.tar.bz2 )
	from the master site doesn't have the checksum expected by the
	distinfo file (nor is the size identical).

	The mod date I get when I fetch the file is the 3rd of May, which
	is not the same time as this distfile was apparently released
	(28 April) but is still before the pkgsrc pkg was updated.
	(Not that I much trust modtimes via http transfers, so that
	might not be meaningfil).

	But what I'd suspect is that the new version was released
	28 April, that distfile was used to build the package,
	which was updated on the 7th of May.  In the interim, the
	distfile changed on the master site (intentionally or not
	I have no idea).

	I haben't been able to check with ftp.netbsd.org, it claims
	to have too many anon users connected (which is the first time
	I think I've ever seen that...)

>How-To-Repeat:
	mv ..../distfiles/kftpgrabber-0.8.1.tar.bz2 /to/somewhere/safe
	cd ..../pkgsrc/net/kftpgrabber
	make checksum

	You may have to watch to see the master site copy fail, as it
	is possible that a successful fetch will work from ftp.netbsd.org
	when it isn't so loaded.

>Fix:
	Someone who has the priginal distfile needs to work out what changed,
	and if the change was harmless, update the fistinfo, and (perhaps) 
	move the distfile to a DIST_SUBDIR (if ftp.netbsd.org doesn't
	have the old distfile, that is probably not necessary, as it
	is unlikely that anyone does, except the package maintainer).

	If the change looks to be a hacked distfile or something, let the
	kftpgrabber people know so they can correct it...

>Unformatted: