Bug 108517 - Mirror Downloading with Incorrect Hash Values
Summary: Mirror Downloading with Incorrect Hash Values
Status: RESOLVED WORKSFORME
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Installation (show other bugs)
Version:
(earliest affected)
5.3.3.2 release
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-06-14 03:53 UTC by Bradley Smith
Modified: 2017-07-11 14:13 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Bradley Smith 2017-06-14 03:53:58 UTC 
Description:
The mirror at http://download.documentfoundation.org/libreoffice/stable/5.3.3/rpm/x86_64/LibreOffice_5.3.3_Linux_x86-64_rpm.tar.gz downloaded twice with an incorrect hash value for all 3 hash types. Additionally even the installation file had errors in it.
After exit 0, there was:
\ED\AB\EE\DB\00\00\00\00fake-db-1.0-0\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\8E\AD\E8\00\00\00\00\00\00\00\00\00\00T\00\00\00>\00\00\00\00\00\00D\00\00\00\00\00
\00\00\00\00\00\00\00\00\00\00\00\00\E8\00\00\00\00\00\00,\00\00\00\00\00\EC\00\00\00\00\00\000\00\00\00\00\00\EF\00\00\00\00\00\00@\00\00\002ac8ffe6d5086534311ba523b83b26de33be640f\00\00\00\00\00\00)\8C\DFj\F4u\DA蹓OQ\C1=,\00\00\00|\00\00\00>\00\00\00\FF\FF\FF\B0\00\00\00\00\00\00\00\8E\AD\E8\00\00\00\00\00\00\00\00\00\C8\00\00\00?\00\00\00\00\00\B8\00\00\00\00\00\00d\00\00\00\00\00\00\00\00\00\00\00\00\E8\00\00\00\00\00\00\00\00\00\00\00\E9\00\00\00\00\00\00
\00\00\00\00\00\EA\00\00\00\00\00\00\00\00\00\00\00\EC\00\00\00	\00\00\00\00\00\00\00\00\ED\00\00\00	\00\00\00(\00\00\00\00\00\EE\00\00\00\00\00\008\00\00\00\00\00\EF\00\00\00\00\00\00<\00\00\00\00\00\F1\00\00\00\00\00\00\\00\00\00\00\00\F6\00\00\00\00\00\00`\00\00\00\00\00\F8\00\00\00	\00\00\00z\00\00\00\00\00\FD\00\00\00\00\00\00\80\00\00\00\00\00\FE\00\00\00\00\00\00\86\00\00\00\00\00\00\00\00\00\00\00\8D\00\00\00\00\00\00\00\00\00\00\00\A3\00\00\00\00\00\00\00\00\00\00\F4\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00g\00\00\00\00\00(\00\00\00\00\00\83\00\00\00\00\00X\00\00\00\00\00\8C\00\00\00\00\00Y\00\00\00\00\00\F8\00\00\00\00\00b\00\00\00\00\00\00\00\00\00\00d\00\00\00\00\00\90\00\00\00\00\00e\00\00\00\00\00\95\00\00\00\00\00f\00\00\00\00\00\98\00\00\00\00\00l\00\00\00\00\00\9A\00\00\00\00\00\93\00\00\00\00\00\B4\00\00\00C\00fake-db\001.0\000\00This is a dummy package\00a dummy package\00Y
\2vm176.documentfoundation.org\00\00\00\00\00\00\00\00LGPLv3 with MPLv2 on ALv2\00dummy\00linux\00noarch\00fake-db-1.0-0.src.rpm\00libgnomevfs-2.so.0\00libgnomevfs-2.so.0()(64bit)\00libfreetype.so.6\00libfreetype.so.6()(64bit)\00/bin/sh\00/bin/basename\00/bin/cat\00/bin/cp\00/bin/gawk\00/bin/grep\00/bin/ln\00/bin/ls\00/bin/mkdir\00/bin/mv\00/bin/pwd\00/bin/rm\00/bin/sed\00/bin/sort\00/bin/touch\00/usr/bin/cut\00/usr/bin/dirname\00/usr/bin/expr\00/usr/bin/find\00/usr/bin/tail\00/usr/bin/tr\00/usr/bin/wc\00fake-db\00\00\00\00\00
\00\00
\00\00
\00\00
rpmlib(FileDigests)\00rpmlib(PayloadFilesHavePrefix)\00rpmlib(CompressedFileNames)\00rpmlib(PayloadIsXz)\004.6.0-1\004.0-1\003.0.4-1\005.2-1\004.8.0\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\001.0-0\00-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic\00cpio\00xz\002\00noarch-redhat-linux-gnu\00\00\00\00\00\00\00\00\00?\00\00\00\FF\FF\FE@\00\00\00\FD7zXZ\00\00
\E1\FB\A1\00!\00\00\00PH6\E0\00{\00]\00
\DDb3;A\E5PtqB\B4\A4\A9\97&\DEDZ\C9.\FF\00\00\00\00\00#\D0B+O\EA(\F7q\E8rt\B3py<\D0S\8E\AF\B4a#>\82\84\B5z.\00Q|)\E4\95\DA\9BK\9A\00\00\00\00
YZ

Steps to Reproduce:
1. Download from the default Linux link http://download.documentfoundation.org/libreoffice/stable/5.3.3/rpm/x86_64/LibreOffice_5.3.3_Linux_x86-64_rpm.tar.gz
2. Check hash values.

Actual Results:  
MD5: e9b0c43a7845fa79754ac3fdd7a6a144
SHA1: 2b2136e31abae5df97af526c13e27062899aebab
SHA256: 9029a04d3e80683a6dca1890700d55ca814fc27f6cb261699c664a3e3935e26a

Expected Results:
SHA-256 Hash: 9029a04d3e80683a6dca1890700d55ca814fc27f6cb261699c664a3e3935e26a
SHA-1 Hash: 2b2136e31abae5df97af526c13e27062899aebab
MD5 Hash: e9b0c43a7845fa79754ac3fdd7a6a144
As per the mirror list site.


Reproducible: Always

User Profile Reset: No

Additional Info:
Downloading from the Brazilian http://ftp.unicamp.br/pub/tdf/libreoffice/stable/5.3.3/rpm/x86_64/LibreOffice_5.3.3_Linux_x86-64_rpm.tar.gz does give the proper hash values.


User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36
Comment 1 Xisco Faulí 2017-06-19 11:38:01 UTC 
> 
> Actual Results:  
> MD5: e9b0c43a7845fa79754ac3fdd7a6a144
> SHA1: 2b2136e31abae5df97af526c13e27062899aebab
> SHA256: 9029a04d3e80683a6dca1890700d55ca814fc27f6cb261699c664a3e3935e26a
> 
> Expected Results:
> SHA-256 Hash:
> 9029a04d3e80683a6dca1890700d55ca814fc27f6cb261699c664a3e3935e26a
> SHA-1 Hash: 2b2136e31abae5df97af526c13e27062899aebab
> MD5 Hash: e9b0c43a7845fa79754ac3fdd7a6a144
> As per the mirror list site.

Hashes in Actual and Expected results are the same... Which is the problem?
Comment 2 berrram 2017-06-24 00:08:56 UTC 
I have encountered a similar problem.

http://download.documentfoundation.org/libreoffice/stable/5.3.3/rpm/x86_64/LibreOffice_5.3.3_Linux_x86-64_rpm.tar.gz.mirrorlist

From the above link, I clicked "Mirrors for LibreOffice_5.3.3_Linux_x86-64_rpm.tar.gz" and downloaded directly. 

Results: 
SHA-256 Hash: bb32a2c025569d7083593e64cb6c29bf93c7b54c44ee8972be5a2ac0eef1f4af
SHA-1 Hash: 48c1dcb5b9171b643ee6bdd59a2259aea25c68cb 
MD5 Hash: f0d97218981632d12194617b8ad377fa

Expected Results: 
SHA-256 Hash: 9029a04d3e80683a6dca1890700d55ca814fc27f6cb261699c664a3e3935e26a
SHA-1 Hash: 2b2136e31abae5df97af526c13e27062899aebab
MD5 Hash: e9b0c43a7845fa79754ac3fdd7a6a144
Comment 3 Xisco Faulí 2017-07-11 08:56:27 UTC 
Is it the same for 5.3.4 links ?
Comment 4 Bradley Smith 2017-07-11 14:08:41 UTC 
Okay, my apologies on posting the same one. I think I deleted the original file after I hashed it and then hashed the functioning download.
I promise I tried several times and they all returned incorrect hash values.

But anyway. The 5.3.4 Linux 64 deb has the right values from the link at http://ftp.unicamp.br/pub/tdf/libreoffice/stable/5.3.4/deb/x86_64/LibreOffice_5.3.4_Linux_x86-64_deb.tar.gz
Comment 5 Xisco Faulí 2017-07-11 14:13:07 UTC 
Then I think we can close this as RESOLVED WORKSFORME.
Anyway, thank your for let us know and please, feel free to report it again if you encounter the same problem.
Regards