pkg/50047: x11/xscreensaver distfile screwup(s)

[kre%munnari.OZ.AU@localhost]

>Number:         50047
>Category:       pkg
>Synopsis:       x11/xscreensaver distfile screwup(s)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 13 03:20:00 +0000 2015
>Originator:     Robert Elz
>Release:        NetBSD 6.99.30 (irrelevant) pkgsrc -current 20150711
>Organization:
	Prince of Songkla University
>Environment:
System: NetBSD onyx.coe.psu.ac.th 6.99.30 NetBSD 6.99.30 (ONYX-Dom0) #0: Mon Feb 3 19:26:44 ICT 2014 kre%onyx.coe.psu.ac.th@localhost:/usr/obj/current/kernels/amd64/ONYX-Dom0 amd64
Architecture: x86_64
Machine: amd64
>Description:
	When x11/xscreensaver was updated recently, according to pkgsrc,
	its distfile almost doubled in size (from around 10MB to about 20MB).
	That seems a little unlikely (not impossible obvoiously) - but at
	the master site, the distfile available is just about 150KB bigger
	than the previous version, which seems more plausible for a
	minor update (and in line with previous updates).

	I suspect that the distfile used to create the pkgsrc entry
	might have contained trash that wasn't supposed to be there,
	inflating its size - and which has now been removed (without
	changing the version number...) at the master site.

	This is of course a guess, as I don't hav ethe big distfile
	to look at.

	To compound things, all backup sites (including f.n.o) seem to
	have a 32KB distfie, which appears to be the first 32KB of the
	current master site version (it could also be the first 32KB of
	the previous version, I have no way to tell).

	For that, my guess is that one of them happened to be fetching
	from the master site, just at the instant that the master site
	was having the file replaced by the smaller one and that the
	upload of the distfile was a slower operation than the download,
	causing the download to halt when only part of the file had been
	downloaded - or perhaps the download was starting on the old
	distfile, when the master site truncated it to replace it with the
	newer version - causing EOF on the download.   Or something else...

	In any case, all of those backup/alternate distfiles are useless
	(the one on f.n.o probably needs to be manually removed).

>How-To-Repeat:
	make sure that you don't have a 20MB distfile called
		xscreensaver-5.33.tar.gz
	(move it out of the way, rename it, if you do)>

	cd .../pkgsrc/x11/xscreensaver
	make fetch

	[Note: I am using pkgsrc that's a little over a day old - so it
	is possible this has been corrected in the interim, however I
	did look, and could see no updates mentioned in the commit
	mail that cvs sends out).  I also verified that f.n.o (and other
	backup sites) still have the 32KB runt distfile.

>Fix:
	Trash the runt distfile at f.n.o

	Verify the current distfile at the master site is correct
	(should be being used), and if it looks OK, update pkgsrc
	to use it.

	Unless it can be demonstrated that no pkgsrc user could possibly
	have fetched the big distfile (most likely by showing thet the
	master site was updated with the new smaller one before the pkgsrc
	update commit was done) add a DIST_SUBDIR to the pkgsrc Makefile to
	force everyone to fetch the new one.

	Consider removing the broken backup sites from the list to be
	used for fetching this distfile (then probably reject that idea
	as not worth the hassle to avoid people fetching a few 32KB
	files if their fetch from the master site fails).