bob

I just did emerge system -e and now I've been getting a few of these:

antlor ~ # emerge gettext
Calculating dependencies... done!

!!! Digest verification failed:
!!! /usr/portage/sys-devel/gettext/files/gettext-0.12.1-without_java.patch
!!! Reason: Failed on SHA256 verification
!!! Got: c5a6a223c8be6ba11f1c180c7f381914abe127c0dffb0ec91d 2e0a8e06892c92
!!! Expected:
6dfefe191bc9435a957f7f6ff0658a771cf6ccffbaf169cae7 9ce7017a0421ee


I wonder, has anyone been having the same problem, or does anyone have
an idea of where to start looking?

bob

As a temporary solution, I can

ebuild gettext-0.14.5.ebuild digest

and this "fixes" it.

I rebuilt hashalot and the problem persists, seeming to imply that the
problem is in a library that hashalot uses. Damn.

Any ideas?

By the way, it's not on every emerge I do, but a select few.

ben measures

Careful there - that's quite dangerous. If your mirror modified the
file maliciously it would result in a bad digest. A failed verification
shouldn't be ignored like that.

In this case, I'd delete the file and 'emerge --sync' - it may simply have
been corrupted in transfer.

Hth,
--
Ben Measures
$email =~ s/is@silly/@/

jouni

It seems that the packages are actually correct, it is the verification
that is broken.

For me the problem was a bit easier to find, as this happened right
after emerge -pDuv portage and only four packages got updated. I tend
to do portage updates separately, before world, as portage is one of
the few packages I use ~x86 with.

After the portage update, some of the ebuilds that I had downloaded
prior to the update with emerge -fDuv world failed the verification
stage just as Bob states.

It seems that the problem is in dev-python/pycrypto-2.0.1-r5 and the
SHA256 routine there is somehow broken.

Reverting to dev-python/pycrypto-2.0.1-r4 cleared the problem for me.

Hth,
Jouni

bob

Yep, this was the first thing I thought of, except I had done an emerge
system -e earlier that day and didn't run an emerge --sync before I did
the second emerge system -e.

And I checked it against another box of mine that syncs to somewhere else.

Thanks anyway.

jouni

Sorry to reply to my own posting, but this seems to be a known issue.
See the discussion on "http://bugs.gentoo.org/show_bug.cgi?id=131293"

Jouni

ben measures

All bets are off if using a testing keyword, and you are indeed correct
here. I find it strange that Bob failed to mention this.

It is dev-python/pycrypto-2.0.1-r4 which is broken, not r5 - the tree will
soon be fixed (and you'll have to revert to the correct package once
more). <http://bugs.gentoo.org/show_bug.cgi?id=131293>

--
Ben Measures
$email =~ s/is@silly/@/

bob

Yeah, sorry guys, ACCEPT_KEYWORDS="~x86" it is.


Yeah, the new portage is broken it seems. Hmmm, I wonder if it's safe
downgrading my portage...

jouni

So, I wouldn't go as far as to downgrading your portage - wouldn't
really even be safe given the testing keyword. There's bound to be some
nasty interdependencies by now.

I'd just force =dev-python/pycrypto-2.0.1-r4 until the corrections have
been made to the affected ebuilds in the tree and propagated through
the mirrors.

Jouni

ben measures

Unless you are a regular user of <http://bugs.gentoo.org/> I recommend you
avoid using unstable/testing packages for your whole system. Major bugs
are a common occurrence in such a setup. If you think this has caused
you problems you ain't [sic] seen nothing yet!

--
Ben Measures
$email =~ s/is@silly/@/