[Magick-bugs] Different mirrors have different files of same name (was: ImageMagick-6.4.1-5.tar.bz2 on SourceForge)

[Ryan Schmidt]

On Jun 8, 2008, at 02:35, Ryan Schmidt wrote:

> Hi. The file ImageMagick-6.4.1-5.tar.bz2 on SourceForge is different
> from the file of the same name on the other mirrors. The only
> difference between the contents of the archives appears to be in the
> file version.sh:
>
>
> diff -ru imagemagick.linux-mirror.org/ImageMagick-6.4.1/version.sh
> internap.dl.sourceforge.net/ImageMagick-6.4.1/version.sh
> --- imagemagick.linux-mirror.org/ImageMagick-6.4.1/version.sh
> 2008-06-03 13:33:15.000000000 -0500
> +++ internap.dl.sourceforge.net/ImageMagick-6.4.1/version.sh
> 2008-06-03 11:12:15.000000000 -0500
> @@ -13,7 +13,7 @@
>   PACKAGE_VERSION='6.4.1'
>   PACKAGE_LIB_VERSION="0x641"
>   PACKAGE_LIB_VERSION_NUMBER="6,4,1,5"
> -PACKAGE_RELEASE="5"
> +PACKAGE_RELEASE="6"
>   PACKAGE_RELEASE_DATE=`date +%x`
>
>   #
>
>
> You should replace the file on SourceForge with the file from another
> mirror, because in MacPorts we record distfile checksums into the
> portfile, because we want to guarantee to our users that the file
> they download is the same as the file the port author downloaded.
> Different users will download from different mirrors because MacPorts
> selects a mirror based on lowest ping time, so we need for the
> distfile to be the same on all mirrors.
>
> Thanks.
>
>
> For SourceForge, I downloaded from:
>
> http://internap.dl.sourceforge.net/sourceforge/imagemagick/
>
> The md5 of the file there is 5e759449c2a644b07550aba1d35f0e08.
>
>
> For the other mirrors, I tried these locations:
>
> http://image_magick.veidrodis.com/image_magick/
> http://imagemagick.linux-mirror.org/download/
> http://ftp.surfnet.nl/pub/ImageMagick/
> ftp://ftp.imagemagick.net/pub/ImageMagick/
> ftp://ftp.nluug.nl/pub/ImageMagick/
>
> The md5 of the file at all these locations is
> d2c82178143ddf7ee685158fd6d8cd52.

It appears the above problem was never resolved. The file  
ImageMagick-6.4.1-5.tar.bz2 on SourceForge is still not the same as  
the file of the same name on the other mirrors. The file on  
SourceForge should be corrected so it matches the other mirrors.

In addition, a similar problem has come up with  
ImageMagick-6.4.2-1.tar.bz2. Here are the md5 checksums of this file  
on the various mirrors from which MacPorts might download it:

image_magick.veidrodis.com:             5ac892274ec37caf5f75628af3eba780
imagemagick.linux-mirror.org:           5ac892274ec37caf5f75628af3eba780
ftp.surfnet.nl:                         6140e6a9a25b9a3c2dc6c52e6c3c4651
ftp.imagemagick.net:                    5ac892274ec37caf5f75628af3eba780
ftp.nluug.nl:                           6140e6a9a25b9a3c2dc6c52e6c3c4651
downloads.sourceforge.net:              5ac892274ec37caf5f75628af3eba780

The difference between the two expanded archives is large (14,260  
lines of diff output, 1,107,488 bytes). I believe the file with  
checksum 5ac892274ec37caf5f75628af3eba780 is the correct one (because  
the last version mentioned in the ChangeLog is 6.4.2-1) and the one  
with 6140e6a9a25b9a3c2dc6c52e6c3c4651 is the incorrect one (because  
the ChangeLog ends at 6.4.2-0). Both, however, claim to be 6.4.2-1  
(both say PACKAGE_LIB_VERSION_NUMBER="6,4,2,1" in version.sh). Please  
let me know if I'm correct in my assumption about which file is the  
correct one. Please replace the incorrect file with the correct file  
on the affected mirrors.

How is it possible for different files to end up on different  
mirrors? There seems to be a problem with your release process since  
this error has occurred twice in three weeks. I hope you can correct  
this problem as well.