pkg/41699: fetch-list doesn't verify checksum

[Christoph_Egger%gmx.de@localhost]

>Number:         41699
>Category:       pkg
>Synopsis:       fetch-list doesn't verify checksum
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jul 11 10:35:00 +0000 2009
>Originator:     Christoph Egger
>Release:        
>Organization:
>Environment:
Darwin tibook.local 8.11.0 Darwin Kernel Version 8.11.0: Wed Oct 10 18:26:00 
PDT 2007; root:xnu-792.24.17~1/RELEASE_PPC Power Macintosh powerpc

>Description:


Discussion between Min Sik Kim and me:

me: The pkgsrc/textproc/tex-makeindex package doesn't build for me
me: on OSX 10.4 due to a SHA1 checksum mismatch.

Min Sik Kim: That's because the distfile was changed at TeX Live
Min Sik Kim: mirrors.  But pkgsrc is supposed to try another site
Min Sik Kim: until it downloads the correct distfile or there is no
Min Sik Kim: more site to try.  Because ftp.netbsd.org
Min Sik Kim: always has the correct distfile, pkgsrc should
Min Sik Kim: eventually fetch the file there.  Isn't this the case
Min Sik Kim: for you?

me: Nope. Actually I'm about installing the print/teTeX
me: package and I download all files first with
me:   bmake fetch-list | sh

Min Sik Kim: It seems that the script generated by the fetch-list
Min Sik Kim: target doesn't verify checksums and assume the fetch is
Min Sik Kim: always successful.  I think you need to file a PR against
Min Sik Kim: fetch-list.  Fixing tex-makeindex would not prevent this
Min Sik Kim: problem from recurring.

me: Done.

>How-To-Repeat:

>Fix: